{"record":{"id":"ATTACK:enterprise:T1055","title":"Process Injection","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1055","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--43e7dc91-05b2-474c-b9ac-2ed4fe101f4d","external_id":"T1055","domain":"enterprise","created":"2017-05-31T21:30:47.843Z","modified":"2026-09-11T20:00:48.048Z","version":"2.0","aliases":[],"tactics":["stealth","privilege-escalation"],"source_references":[]},"assertions":[{"id":"enterprise:relationship--0200e185-a06e-470c-af16-814f84f1f6d7","subject":"ATTACK:enterprise:S9025","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0200e185-a06e-470c-af16-814f84f1f6d7","modified":"2026-04-29T14:23:05.905Z","references":[{"source_name":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0321e766-10c1-4215-9fd6-7f712b642dca","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0321e766-10c1-4215-9fd6-7f712b642dca","modified":"2026-09-30T19:04:00.629Z","references":[{"source_name":"Microsoft Axios Compromise APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"},{"source_name":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0432482e-344c-4be3-9a70-5391cf41a935","subject":"ATTACK:enterprise:S0331","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0432482e-344c-4be3-9a70-5391cf41a935","modified":"2026-04-29T14:23:05.909Z","references":[{"source_name":"SentinelLabs Agent Tesla Aug 2020","url":"https://labs.sentinelone.com/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--07683c47-4572-4579-93e7-ac83f2933ac2","subject":"ATTACK:enterprise:T1055.013","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--07683c47-4572-4579-93e7-ac83f2933ac2","modified":"2026-04-29T14:23:05.913Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--07c87a67-32d0-4b86-9345-aad1a0241340","subject":"ATTACK:enterprise:S0681","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--07c87a67-32d0-4b86-9345-aad1a0241340","modified":"2026-04-29T14:23:05.914Z","references":[{"source_name":"BiZone Lizar May 2021","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--11f33a6b-f2f5-4c35-a72a-e2197340b425","subject":"ATTACK:enterprise:S0533","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--11f33a6b-f2f5-4c35-a72a-e2197340b425","modified":"2026-04-29T14:23:05.928Z","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--14d60e02-4ceb-4972-844c-412e9599144f","subject":"ATTACK:enterprise:S0581","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--14d60e02-4ceb-4972-844c-412e9599144f","modified":"2026-04-29T14:23:05.932Z","references":[{"source_name":"Unit 42 IronNetInjector February 2021 ","url":"https://unit42.paloaltonetworks.com/ironnetinjector/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--15ccaabe-9b15-4d30-8931-d86d9af9f911","subject":"ATTACK:enterprise:S1159","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--15ccaabe-9b15-4d30-8931-d86d9af9f911","modified":"2026-04-29T14:23:05.934Z","references":[{"source_name":"Google Cloud APT41 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--17ec5db7-d1cd-4057-9d95-a6da56b06825","subject":"ATTACK:enterprise:S1081","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--17ec5db7-d1cd-4057-9d95-a6da56b06825","modified":"2026-04-29T14:23:05.937Z","references":[{"source_name":"Gigamon BADHATCH Jul 2019","url":"https://blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/"},{"source_name":"BitDefender BADHATCH Mar 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1d79747d-3ff5-44ab-ae40-80823347c7d7","subject":"ATTACK:enterprise:T1055.012","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1d79747d-3ff5-44ab-ae40-80823347c7d7","modified":"2026-04-29T14:23:05.945Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e9c15dc-2ba7-421e-8d67-6b59e0c457c7","subject":"ATTACK:enterprise:S0398","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e9c15dc-2ba7-421e-8d67-6b59e0c457c7","modified":"2026-04-29T14:23:05.946Z","references":[{"source_name":"Unit42 Emissary Panda May 2019","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--223a75cd-eb8f-4477-b4c3-e2a4e651d875","subject":"ATTACK:enterprise:S0633","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--223a75cd-eb8f-4477-b4c3-e2a4e651d875","modified":"2026-04-29T14:23:05.952Z","references":[{"source_name":"GitHub Sliver C2","url":"https://github.com/BishopFox/sliver/"},{"source_name":"Cybereason Sliver Undated","url":"https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors"},{"source_name":"Bishop Fox Sliver Framework August 2019","url":"https://labs.bishopfox.com/tech-blog/sliver"},{"source_name":"Microsoft Sliver 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--227624a1-7dda-4691-89b3-49336aa68bfa","subject":"ATTACK:enterprise:S0534","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--227624a1-7dda-4691-89b3-49336aa68bfa","modified":"2026-04-29T14:23:05.952Z","references":[{"source_name":"Cybereason Bazar July 2020","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--287b6305-0592-4843-a12b-57f96741a36e","subject":"ATTACK:enterprise:T1055.009","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--287b6305-0592-4843-a12b-57f96741a36e","modified":"2026-04-29T14:23:05.960Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--289c43cc-3b61-4b33-8af7-3010c94b6467","subject":"ATTACK:enterprise:T1055.015","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--289c43cc-3b61-4b33-8af7-3010c94b6467","modified":"2026-04-29T14:23:05.960Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--28a76700-4834-4a1b-bb56-2005bc044e29","subject":"ATTACK:enterprise:G0091","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--28a76700-4834-4a1b-bb56-2005bc044e29","modified":"2026-07-31T18:48:21.042Z","references":[{"source_name":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2a7a5ee2-e949-4d25-895a-43ba0bc8cc33","subject":"ATTACK:enterprise:S0436","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2a7a5ee2-e949-4d25-895a-43ba0bc8cc33","modified":"2026-04-29T14:23:05.962Z","references":[{"source_name":"JPCert BlackTech Malware September 2019","url":"https://blogs.jpcert.or.jp/en/2019/09/tscookie-loader.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2c66270f-e6eb-4f0b-9006-9be7fcc9ba3a","subject":"ATTACK:enterprise:S0496","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2c66270f-e6eb-4f0b-9006-9be7fcc9ba3a","modified":"2026-04-29T14:23:05.965Z","references":[{"source_name":"McAfee REvil October 2019","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-crescendo/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2c6c5572-9b89-40cd-8faa-6317945cf939","subject":"ATTACK:enterprise:S0695","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2c6c5572-9b89-40cd-8faa-6317945cf939","modified":"2026-04-29T14:23:05.965Z","references":[{"source_name":"Donut Github","url":"https://github.com/TheWover/donut"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2dcfc7b7-ead5-4996-b70d-205d4f9d59f5","subject":"ATTACK:enterprise:S0470","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2dcfc7b7-ead5-4996-b70d-205d4f9d59f5","modified":"2026-04-29T14:23:05.967Z","references":[{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f0bcef1-1f30-4585-b158-25d614f5f350","subject":"ATTACK:enterprise:C0029","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f0bcef1-1f30-4585-b158-25d614f5f350","modified":"2026-07-31T18:47:22.760Z","references":[{"source_name":"Mandiant Cutting Edge Part 3 February 2024","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30df477a-f775-4349-ba03-07a3f4293db4","subject":"ATTACK:enterprise:S0561","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30df477a-f775-4349-ba03-07a3f4293db4","modified":"2026-04-29T14:23:05.979Z","references":[{"source_name":"Medium Eli Salem GuLoader April 2021","url":"https://elis531989.medium.com/dancing-with-shellcodes-cracking-the-latest-version-of-guloader-75083fb15cb4"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--36af6d80-fef4-40b9-9b32-a2947eadd9e7","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--36af6d80-fef4-40b9-9b32-a2947eadd9e7","modified":"2026-07-31T18:47:44.119Z","references":[{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3a5b04dd-815c-4f52-be7a-e997625c18e6","subject":"ATTACK:enterprise:G0102","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3a5b04dd-815c-4f52-be7a-e997625c18e6","modified":"2026-07-31T20:48:50.099Z","references":[{"source_name":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3bffbeb5-27d2-4fc3-b28b-b9f686572009","subject":"ATTACK:enterprise:S1074","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3bffbeb5-27d2-4fc3-b28b-b9f686572009","modified":"2026-04-29T14:23:06.004Z","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f7f515f-25f9-4afb-becf-6247f4d6ecd2","subject":"ATTACK:enterprise:T1055.014","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f7f515f-25f9-4afb-becf-6247f4d6ecd2","modified":"2026-04-29T14:23:06.011Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4030c6bb-1f3d-4553-90d7-b984c12c5eb7","subject":"ATTACK:enterprise:T1055.005","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4030c6bb-1f3d-4553-90d7-b984c12c5eb7","modified":"2026-04-29T14:23:06.012Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4293a182-e45b-4043-a5e7-d0ef8ae3a863","subject":"ATTACK:enterprise:S1105","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4293a182-e45b-4043-a5e7-d0ef8ae3a863","modified":"2026-04-29T14:23:06.016Z","references":[{"source_name":"NCSC-NL COATHANGER Feb 2024","url":"https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4a73a308-45aa-4dcd-9253-c15a065fac84","subject":"ATTACK:enterprise:T1055.011","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4a73a308-45aa-4dcd-9253-c15a065fac84","modified":"2026-04-29T14:23:06.027Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4c654359-aefe-4c86-a092-44e99931d340","subject":"ATTACK:enterprise:S0347","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4c654359-aefe-4c86-a092-44e99931d340","modified":"2026-04-29T14:23:06.029Z","references":[{"source_name":"TrendMicro Lazarus Nov 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-continues-heists-mounts-attacks-on-financial-organizations-in-latin-america/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5291c077-dc09-4716-ab9a-d65318794839","subject":"ATTACK:enterprise:S0032","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5291c077-dc09-4716-ab9a-d65318794839","modified":"2026-04-29T14:23:06.038Z","references":[{"source_name":"Gh0stRAT ATT March 2019","url":"https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--529ad26d-b31e-41c0-8f19-80e2727eb739","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--529ad26d-b31e-41c0-8f19-80e2727eb739","modified":"2026-04-29T14:23:06.038Z","references":[{"source_name":"Red Canary NETWIRE January 2020","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--535e3fbe-e6d9-4608-9689-f8f1f8c1ddc9","subject":"ATTACK:enterprise:S0093","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--535e3fbe-e6d9-4608-9689-f8f1f8c1ddc9","modified":"2026-04-29T14:23:06.039Z","references":[{"source_name":"Symantec Dragonfly","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"},{"source_name":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--54e70260-cbf3-4c6b-bd30-208329cfef26","subject":"ATTACK:enterprise:S0332","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--54e70260-cbf3-4c6b-bd30-208329cfef26","modified":"2026-04-29T14:23:06.041Z","references":[{"source_name":"Fortinet Remcos Feb 2017","url":"https://www.fortinet.com/blog/threat-research/remcos-a-new-rat-in-the-wild-2.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--56e0b679-1c1b-4c82-9346-bde619c21117","subject":"ATTACK:enterprise:S0579","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--56e0b679-1c1b-4c82-9346-bde619c21117","modified":"2026-04-29T14:23:06.044Z","references":[{"source_name":"Trend Micro Waterbear December 2019","url":"https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5bf6d81e-634d-4035-a895-87d2d31341ce","subject":"ATTACK:enterprise:S0692","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5bf6d81e-634d-4035-a895-87d2d31341ce","modified":"2026-04-29T14:23:06.051Z","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5e6cf759-1690-41b3-9e41-d8317f4ef83d","subject":"ATTACK:enterprise:T1055.001","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5e6cf759-1690-41b3-9e41-d8317f4ef83d","modified":"2026-04-29T14:23:06.054Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5ebc97a3-54ee-4582-92ce-981f67c26f45","subject":"ATTACK:enterprise:S0154","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5ebc97a3-54ee-4582-92ce-981f67c26f45","modified":"2026-04-29T14:23:06.054Z","references":[{"source_name":"DFIR Conti Bazar Nov 2021","url":"https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"},{"source_name":"cobaltstrike manual","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--60a46293-ec9e-4931-8315-03b4f68c2e74","subject":"ATTACK:enterprise:S0040","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--60a46293-ec9e-4931-8315-03b4f68c2e74","modified":"2026-04-29T14:23:06.056Z","references":[{"source_name":"NCSC Joint Report Public Tools","url":"https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--65cf270c-174f-4733-a755-35e2171a529c","subject":"ATTACK:enterprise:T1055.003","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--65cf270c-174f-4733-a755-35e2171a529c","modified":"2026-04-29T14:23:06.063Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--666f1286-c25b-49ef-9d86-42a00ea69ab1","subject":"ATTACK:enterprise:S0660","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--666f1286-c25b-49ef-9d86-42a00ea69ab1","modified":"2026-04-29T14:23:06.064Z","references":[{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--66f859b2-4bc2-4520-afd4-8f8a7b71a50c","subject":"ATTACK:enterprise:S0206","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--66f859b2-4bc2-4520-afd4-8f8a7b71a50c","modified":"2026-04-29T14:23:06.065Z","references":[{"source_name":"Symantec Wiarp May 2012","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-051606-1005-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ada1a93-2fc2-4bd7-bec8-5d41b406e181","subject":"ATTACK:enterprise:G1018","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ada1a93-2fc2-4bd7-bec8-5d41b406e181","modified":"2026-07-31T18:47:55.340Z","references":[{"source_name":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"},{"source_name":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6b083f3f-f8db-403d-b922-308b79d20cc7","subject":"ATTACK:enterprise:G0080","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6b083f3f-f8db-403d-b922-308b79d20cc7","modified":"2026-07-31T18:48:22.996Z","references":[{"source_name":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--722ffa83-29e2-48bb-a7c1-1cb52fb4aa18","subject":"ATTACK:enterprise:S1122","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--722ffa83-29e2-48bb-a7c1-1cb52fb4aa18","modified":"2026-04-29T14:23:06.081Z","references":[{"source_name":"Segurança Informática URSA Sophisticated Loader 2020","url":"https://seguranca-informatica.pt/threat-analysis-the-emergent-ursa-trojan-impacts-many-countries-using-a-sophisticated-loader/"},{"source_name":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--72810e5a-0394-4acc-8c3d-3360df2679ee","subject":"ATTACK:enterprise:S0201","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--72810e5a-0394-4acc-8c3d-3360df2679ee","modified":"2026-04-29T14:23:06.082Z","references":[{"source_name":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--78af537b-48cc-411d-a209-3e01c44aa87b","subject":"ATTACK:enterprise:M1026","predicate":"mitigates","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--78af537b-48cc-411d-a209-3e01c44aa87b","modified":"2026-04-29T14:23:06.090Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7d7adc46-deab-4b32-9902-ac1beb0e95fa","subject":"ATTACK:enterprise:S0380","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7d7adc46-deab-4b32-9902-ac1beb0e95fa","modified":"2026-04-29T14:23:06.097Z","references":[{"source_name":"Kaspersky StoneDrill 2017","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--81bace85-005e-4edd-bb71-ca7a57bc8a07","subject":"ATTACK:enterprise:S0247","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--81bace85-005e-4edd-bb71-ca7a57bc8a07","modified":"2026-04-29T14:23:06.103Z","references":[{"source_name":"Talos NavRAT May 2018","url":"https://blog.talosintelligence.com/2018/05/navrat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8235c444-415e-49ee-8ed9-10c24075be1f","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8235c444-415e-49ee-8ed9-10c24075be1f","modified":"2026-04-29T14:23:06.103Z","references":[{"source_name":"Trend Micro Black Basta October 2022","url":"https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"},{"source_name":"Kaspersky QakBot September 2021","url":"https://securelist.com/qakbot-technical-analysis/103931/"},{"source_name":"Trend Micro Qakbot May 2020","url":"https://www.trendmicro.com/vinfo/ph/security/news/cybercrime-and-digital-threats/qakbot-resurges-spreads-through-vbs-files"},{"source_name":"Kroll Qakbot June 2020","url":"https://www.kroll.com/en/insights/publications/cyber/qakbot-malware-exfiltrating-emails-thread-hijacking-attacks"},{"source_name":"Trend Micro Qakbot December 2020","url":"https://success.trendmicro.com/en-US/solution/KA-0011282"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--836575fd-ffa1-4531-8c16-c875b7f0c177","subject":"ATTACK:enterprise:S1039","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--836575fd-ffa1-4531-8c16-c875b7f0c177","modified":"2026-04-29T14:23:06.105Z","references":[{"source_name":"Cybereason Bumblebee August 2022","url":"https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--85dc96ac-ec8e-4e15-ba4b-807c1a7b46cc","subject":"ATTACK:enterprise:S0363","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--85dc96ac-ec8e-4e15-ba4b-807c1a7b46cc","modified":"2026-04-29T14:23:06.108Z","references":[{"source_name":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86f8bebc-a5fc-43d7-9af0-0024e07ca8d1","subject":"ATTACK:enterprise:G0067","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86f8bebc-a5fc-43d7-9af0-0024e07ca8d1","modified":"2026-07-31T18:47:55.531Z","references":[{"source_name":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8acca861-11fd-49bd-8dbc-0b326f5303d6","subject":"ATTACK:enterprise:S0168","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8acca861-11fd-49bd-8dbc-0b326f5303d6","modified":"2026-04-29T14:23:06.114Z","references":[{"source_name":"ESET Gazer Aug 2017","url":"https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf"},{"source_name":"Securelist WhiteBear Aug 2017","url":"https://securelist.com/introducing-whitebear/81638/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--90e6cb2a-55c4-4533-bbdc-b8eed2132344","subject":"ATTACK:enterprise:S1065","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--90e6cb2a-55c4-4533-bbdc-b8eed2132344","modified":"2026-04-29T14:23:06.123Z","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--90eb6858-e561-4ed0-855b-f9afbe3ac394","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--90eb6858-e561-4ed0-855b-f9afbe3ac394","modified":"2026-04-29T14:23:06.123Z","references":[{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9305bc36-68ab-4354-bfa4-6834e028b258","subject":"ATTACK:enterprise:S9020","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9305bc36-68ab-4354-bfa4-6834e028b258","modified":"2026-04-29T14:23:06.125Z","references":[{"source_name":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"Kaspersky LODEINFO Part II OCT 2022","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"},{"source_name":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--95d0ca69-0e05-4f68-ba95-99094f01e140","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--95d0ca69-0e05-4f68-ba95-99094f01e140","modified":"2026-07-31T18:47:31.770Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--95ed1db5-c388-4b1b-9824-9703b248f798","subject":"ATTACK:enterprise:S0226","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--95ed1db5-c388-4b1b-9824-9703b248f798","modified":"2026-04-29T14:23:06.129Z","references":[{"source_name":"Talos Smoke Loader July 2018","url":"https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html#more"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--95fac0e8-32e3-4854-b542-5eb897d76f2e","subject":"ATTACK:enterprise:S0378","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--95fac0e8-32e3-4854-b542-5eb897d76f2e","modified":"2026-04-29T14:23:06.129Z","references":[{"source_name":"GitHub PoshC2","url":"https://github.com/nettitude/PoshC2_Python"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--967ab393-8181-4a66-a406-39459b4a1ac7","subject":"ATTACK:enterprise:S1100","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--967ab393-8181-4a66-a406-39459b4a1ac7","modified":"2026-04-29T14:23:06.130Z","references":[{"source_name":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"},{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--97fe312d-7a04-43f9-8076-69fe324517ce","subject":"ATTACK:enterprise:S0469","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--97fe312d-7a04-43f9-8076-69fe324517ce","modified":"2026-04-29T14:23:06.132Z","references":[{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--99365890-fc6c-46ec-bf1f-66ccbe5d52e7","subject":"ATTACK:enterprise:S0473","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--99365890-fc6c-46ec-bf1f-66ccbe5d52e7","modified":"2026-04-29T14:23:06.134Z","references":[{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9e784751-c08e-43d8-957a-7d9a35e1cf05","subject":"ATTACK:enterprise:C0013","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9e784751-c08e-43d8-957a-7d9a35e1cf05","modified":"2026-07-31T18:47:20.236Z","references":[{"source_name":"Threatpost New Op Sharpshooter Data March 2019","url":"https://threatpost.com/sharpshooter-complexity-scope/142359/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a08454ac-6680-4ea1-ab2a-f272f562fc25","subject":"ATTACK:enterprise:S0614","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a08454ac-6680-4ea1-ab2a-f272f562fc25","modified":"2026-04-29T14:23:06.144Z","references":[{"source_name":"BlackBerry CostaRicto November 2020","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a24d8975-fa51-4ac1-b928-9af5b5660109","subject":"ATTACK:enterprise:S0348","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a24d8975-fa51-4ac1-b928-9af5b5660109","modified":"2026-04-29T14:23:06.146Z","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a308d350-2b2b-486a-a778-8e80f231dc68","subject":"ATTACK:enterprise:S0438","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a308d350-2b2b-486a-a778-8e80f231dc68","modified":"2026-04-29T14:23:06.147Z","references":[{"source_name":"ESET Attor Oct 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a49898fe-a9a0-4e90-9b9e-235d82f2fea7","subject":"ATTACK:enterprise:C0056","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a49898fe-a9a0-4e90-9b9e-235d82f2fea7","modified":"2026-07-31T18:47:20.221Z","references":[{"source_name":"Juniper RedPenguin MAR 2025","url":"https://supportportal.juniper.net/sfc/servlet.shepherd/document/download/069Dp00000FzdmIIAR?operationContext=S1"},{"source_name":"Mandiant UNC3886 Juniper Routers MAR 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--afdf9b0e-5539-464a-a403-202eaedb13cd","subject":"ATTACK:enterprise:S0446","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--afdf9b0e-5539-464a-a403-202eaedb13cd","modified":"2026-04-29T14:23:06.165Z","references":[{"source_name":"CrowdStrike Ryuk January 2019","url":"https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b27650da-9a26-4bd3-9e9e-2559a0b6dc86","subject":"ATTACK:enterprise:S0670","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b27650da-9a26-4bd3-9e9e-2559a0b6dc86","modified":"2026-04-29T14:23:06.169Z","references":[{"source_name":"Check Point Warzone Feb 2020","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b4b4c873-3a4a-4bd1-adc2-631c02ddd91c","subject":"ATTACK:enterprise:T1055.008","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b4b4c873-3a4a-4bd1-adc2-631c02ddd91c","modified":"2026-04-29T14:23:06.172Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bbe59869-4ae5-4bb5-a300-eba77096846f","subject":"ATTACK:enterprise:S9023","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bbe59869-4ae5-4bb5-a300-eba77096846f","modified":"2026-04-29T14:23:06.182Z","references":[{"source_name":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bc4ba2dc-e9f4-4047-959d-c18d0bafcf8a","subject":"ATTACK:enterprise:G1047","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bc4ba2dc-e9f4-4047-959d-c18d0bafcf8a","modified":"2026-07-31T18:48:24.099Z","references":[{"source_name":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bcdd57cf-632f-4fc5-a8e8-d3137cb832e8","subject":"ATTACK:enterprise:M1040","predicate":"mitigates","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bcdd57cf-632f-4fc5-a8e8-d3137cb832e8","modified":"2026-04-29T14:23:06.183Z","references":[{"source_name":"win10_asr","url":"https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bd648f03-7313-4e05-bd6e-b499f76a295c","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bd648f03-7313-4e05-bd6e-b499f76a295c","modified":"2026-07-31T20:48:25.403Z","references":[{"source_name":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c0d5dbce-41bf-4b6a-ad07-a9c39b8ed6fa","subject":"ATTACK:enterprise:S9050","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c0d5dbce-41bf-4b6a-ad07-a9c39b8ed6fa","modified":"2026-09-25T17:58:28.834Z","references":[{"source_name":"QuorumCyber_Vidar_March2023","url":"https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c1341f02-e2be-4c70-8d14-28170bee2133","subject":"ATTACK:enterprise:G1023","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c1341f02-e2be-4c70-8d14-28170bee2133","modified":"2026-07-31T18:48:17.416Z","references":[{"source_name":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c376fa52-2641-4c12-bd08-ad020d3f5306","subject":"ATTACK:enterprise:C0057","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c376fa52-2641-4c12-bd08-ad020d3f5306","modified":"2026-07-31T18:47:22.684Z","references":[{"source_name":"Mandiant 3cx UNC4736 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ca429946-3c81-4773-8254-108dbdbb9da9","subject":"ATTACK:enterprise:G0068","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ca429946-3c81-4773-8254-108dbdbb9da9","modified":"2026-07-31T18:48:27.962Z","references":[{"source_name":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cb02fb3b-8223-476f-90be-ab50e3432d0a","subject":"ATTACK:enterprise:S0596","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cb02fb3b-8223-476f-90be-ab50e3432d0a","modified":"2026-04-29T14:23:06.203Z","references":[{"source_name":"Kaspersky ShadowPad Aug 2017","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cc470da4-82b7-4efb-aa09-f3e7402291df","subject":"ATTACK:enterprise:S0240","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cc470da4-82b7-4efb-aa09-f3e7402291df","modified":"2026-04-29T14:23:06.204Z","references":[{"source_name":"Malwarebytes RokRAT VBA January 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cf36992b-49c7-4a4c-8fd0-30e23cd8d7b8","subject":"ATTACK:enterprise:T1055.004","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cf36992b-49c7-4a4c-8fd0-30e23cd8d7b8","modified":"2026-04-29T14:23:06.209Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cfe83f83-f0d8-4e17-a396-5571189910fa","subject":"ATTACK:enterprise:G0047","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cfe83f83-f0d8-4e17-a396-5571189910fa","modified":"2026-07-31T18:47:48.026Z","references":[{"source_name":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d0cc4ab9-e211-4824-af74-7d88699731a2","subject":"ATTACK:enterprise:S0376","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d0cc4ab9-e211-4824-af74-7d88699731a2","modified":"2026-04-29T14:23:06.211Z","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d58f4ef7-4d27-48ba-989d-06b835edae9a","subject":"ATTACK:enterprise:G1043","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d58f4ef7-4d27-48ba-989d-06b835edae9a","modified":"2026-07-31T18:47:36.519Z","references":[{"source_name":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"Symantec BlackByte 2022","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d802c27b-b5b1-4bd6-8c23-858ab395afaf","subject":"ATTACK:enterprise:S9019","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d802c27b-b5b1-4bd6-8c23-858ab395afaf","modified":"2026-04-29T14:23:06.220Z","references":[{"source_name":"Zscaler PureCrypter JUN 2022","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d83274f8-ac2b-4416-9fae-97f569dbcef2","subject":"ATTACK:enterprise:S0084","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d83274f8-ac2b-4416-9fae-97f569dbcef2","modified":"2026-04-29T14:23:06.220Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d9c19c4a-a2e3-41f9-b508-d0d008c08993","subject":"ATTACK:enterprise:S0024","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d9c19c4a-a2e3-41f9-b508-d0d008c08993","modified":"2026-04-29T14:23:06.222Z","references":[{"source_name":"Malwarebytes Dyreza November 2015","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--da44c85c-914b-41e0-aef7-68cd3c1faea1","subject":"ATTACK:enterprise:S0044","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--da44c85c-914b-41e0-aef7-68cd3c1faea1","modified":"2026-04-29T14:23:06.223Z","references":[{"source_name":"F-Secure Sofacy 2015","url":"https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasploit-code/"},{"source_name":"Unit 42 Sofacy Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dbcbedb9-5527-4ab9-97e7-1ed65571aee9","subject":"ATTACK:enterprise:S0664","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dbcbedb9-5527-4ab9-97e7-1ed65571aee9","modified":"2026-04-29T14:23:06.225Z","references":[{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dc309013-0487-47fa-b514-71e18344a2db","subject":"ATTACK:enterprise:S0266","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dc309013-0487-47fa-b514-71e18344a2db","modified":"2026-04-29T14:23:06.226Z","references":[{"source_name":"Joe Sec Trickbot","url":"https://www.joesecurity.org/blog/498839998833561473"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dc78facd-a71c-45d8-bf93-67effda51dfa","subject":"ATTACK:enterprise:S9021","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dc78facd-a71c-45d8-bf93-67effda51dfa","modified":"2026-04-29T14:23:06.226Z","references":[{"source_name":"Kaspersky LODEINFO OCT 2022","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--de8cda8f-cb21-4cd9-9ce8-a2f100f723a6","subject":"ATTACK:enterprise:S1050","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--de8cda8f-cb21-4cd9-9ce8-a2f100f723a6","modified":"2026-04-29T14:23:06.229Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e0c1c9b9-b36e-4157-8dc1-26cd9ae25193","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e0c1c9b9-b36e-4157-8dc1-26cd9ae25193","modified":"2026-07-31T20:48:27.596Z","references":[{"source_name":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e7baabf7-9300-432d-aa78-000ac099d4d3","subject":"ATTACK:enterprise:S0176","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e7baabf7-9300-432d-aa78-000ac099d4d3","modified":"2026-04-29T14:23:06.240Z","references":[{"source_name":"Microsoft SIR Vol 21","url":"http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e88d0a1d-9861-4260-b030-dd80e81d179a","subject":"ATTACK:enterprise:S0554","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e88d0a1d-9861-4260-b030-dd80e81d179a","modified":"2026-04-29T14:23:06.242Z","references":[{"source_name":"Cyble Egregor Oct 2020","url":"https://cybleinc.com/2020/10/31/egregor-ransomware-a-deep-dive-into-its-activities-and-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ed7582ee-c131-4525-8e69-26e9e5646328","subject":"ATTACK:enterprise:S1059","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ed7582ee-c131-4525-8e69-26e9e5646328","modified":"2026-04-29T14:23:06.248Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--edb47407-d848-4b72-abe6-9815aeaaaf37","subject":"ATTACK:enterprise:C0028","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--edb47407-d848-4b72-abe6-9815aeaaaf37","modified":"2026-08-04T20:48:45.192Z","references":[{"source_name":"Booz Allen Hamilton","url":"https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f3055d9f-986e-4202-bb13-c956069bb43f","subject":"ATTACK:enterprise:G0010","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f3055d9f-986e-4202-bb13-c956069bb43f","modified":"2026-07-31T18:48:04.420Z","references":[{"source_name":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f42ce74c-c70a-4c85-a3db-c4cc5f9399c8","subject":"ATTACK:enterprise:C0046","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f42ce74c-c70a-4c85-a3db-c4cc5f9399c8","modified":"2026-07-31T18:47:29.305Z","references":[{"source_name":"Cisco ArcaneDoor 2024","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f657c643-91c1-4e9f-a8dd-eccdee1e8374","subject":"ATTACK:enterprise:S1181","predicate":"uses","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f657c643-91c1-4e9f-a8dd-eccdee1e8374","modified":"2026-04-29T14:23:06.260Z","references":[{"source_name":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fc26d209-c7fb-4d59-82da-0be7c72c651d","subject":"ATTACK:enterprise:T1055.002","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1055","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fc26d209-c7fb-4d59-82da-0be7c72c651d","modified":"2026-04-29T14:23:06.267Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}