Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference.
{
  "record": {
    "id": "ATTACK:enterprise:T1059.001",
    "title": "PowerShell",
    "type": "Subtechnique",
    "source_url": "https://attack.mitre.org/techniques/T1059/001",
    "snapshot": "enterprise-attack-20.0.json",
    "status": "active",
    "rights": "Source metadata only; source notices retained; no operational prose or payloads",
    "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
    "stix_id": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736",
    "external_id": "T1059.001",
    "domain": "enterprise",
    "created": "2020-03-09T13:48:55.078Z",
    "modified": "2026-09-18T13:23:14.419Z",
    "version": "1.6",
    "aliases": [

    ],
    "tactics": [
      "execution"
    ],
    "source_references": [
      {
        "source_name": "Microsoft PSfromCsharp APR 2014",
        "url": "https://blogs.msdn.microsoft.com/kebab/2014/04/28/executing-powershell-scripts-from-c/"
      },
      {
        "source_name": "SilentBreak Offensive PS Dec 2015",
        "url": "https://web.archive.org/web/20190508170150/https://silentbreaksecurity.com/powershell-jobs-without-powershell-exe/"
      },
      {
        "source_name": "Github PSAttack",
        "url": "https://github.com/Exploit-install/PSAttack-1"
      },
      {
        "source_name": "Powershell installation",
        "url": "https://learn.microsoft.com/en-us/powershell/scripting/install/install-powershell?view=powershell-7.6"
      },
      {
        "source_name": "TechNet PowerShell",
        "url": "https://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx"
      },
      {
        "source_name": "Sixdub PowerPick Jan 2016",
        "url": "https://web.archive.org/web/20160327101330/http://www.sixdub.net/?p=367"
      }
    ]
  },
  "assertions": [
    {
      "id": "enterprise:relationship--0068ee65-0945-4f69-ba81-163ffbc05e53",
      "subject": "ATTACK:enterprise:G0090",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0068ee65-0945-4f69-ba81-163ffbc05e53",
      "modified": "2026-07-31T20:48:52.322Z",
      "references": [
        {
          "source_name": "Lab52 WIRTE Apr 2019",
          "url": "https://lab52.io/blog/wirte-group-attacking-the-middle-east/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--00fe415d-9364-4d03-95ee-f1413d996c30",
      "subject": "ATTACK:enterprise:S1212",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--00fe415d-9364-4d03-95ee-f1413d996c30",
      "modified": "2026-04-29T14:23:05.904Z",
      "references": [
        {
          "source_name": "Group-IB RansomHub FEB 2025",
          "url": "https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--01563b41-e89b-4cd2-b018-ee57bf616396",
      "subject": "ATTACK:enterprise:G1044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--01563b41-e89b-4cd2-b018-ee57bf616396",
      "modified": "2026-07-31T18:48:15.938Z",
      "references": [
        {
          "source_name": "Mandiant APT42-charms",
          "url": "https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0345ec62-657e-4673-89a1-d17e85f5dab0",
      "subject": "ATTACK:enterprise:G1023",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0345ec62-657e-4673-89a1-d17e85f5dab0",
      "modified": "2026-07-31T18:48:16.614Z",
      "references": [
        {
          "source_name": "Mandiant Pulse Secure Update May 2021",
          "url": "https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0381e557-6c8d-45c5-b390-f7909f782d3f",
      "subject": "ATTACK:enterprise:C0047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0381e557-6c8d-45c5-b390-f7909f782d3f",
      "modified": "2026-07-31T18:47:19.061Z",
      "references": [
        {
          "source_name": "Recorded Future RedDelta 2025",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--04175eba-3f58-42ce-897b-1d483c4c12e0",
      "subject": "ATTACK:enterprise:C0025",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--04175eba-3f58-42ce-897b-1d483c4c12e0",
      "modified": "2026-07-31T21:05:25.495Z",
      "references": [
        {
          "source_name": "Dragos Crashoverride 2018",
          "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--06de29d8-365b-4072-a4bb-9d436763ea1e",
      "subject": "ATTACK:enterprise:G0108",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--06de29d8-365b-4072-a4bb-9d436763ea1e",
      "modified": "2026-07-31T18:48:02.589Z",
      "references": [
        {
          "source_name": "RedCanary Mockingbird May 2020",
          "url": "https://redcanary.com/blog/blue-mockingbird-cryptominer/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--07ef8045-6a01-4764-a351-a8a2ee2170f7",
      "subject": "ATTACK:enterprise:S1081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--07ef8045-6a01-4764-a351-a8a2ee2170f7",
      "modified": "2026-04-29T14:23:05.914Z",
      "references": [
        {
          "source_name": "Gigamon BADHATCH Jul 2019",
          "url": "https://blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/"
        },
        {
          "source_name": "BitDefender BADHATCH Mar 2021",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--095d2af9-dca4-4a7a-b22e-e37923e7c43c",
      "subject": "ATTACK:enterprise:S0363",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--095d2af9-dca4-4a7a-b22e-e37923e7c43c",
      "modified": "2026-04-29T14:23:05.916Z",
      "references": [
        {
          "source_name": "Github PowerShell Empire",
          "url": "https://github.com/PowerShellEmpire/Empire"
        },
        {
          "source_name": "NCSC Joint Report Public Tools",
          "url": "https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0b77fa58-6fd7-4002-955e-e3e1705d54c2",
      "subject": "ATTACK:enterprise:S0330",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0b77fa58-6fd7-4002-955e-e3e1705d54c2",
      "modified": "2026-04-29T14:23:05.919Z",
      "references": [
        {
          "source_name": "Talos Zeus Panda Nov 2017",
          "url": "https://blog.talosintelligence.com/2017/11/zeus-panda-campaign.html#More"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0b98618a-fca0-49e4-b611-b93bf8f9cd1e",
      "subject": "ATTACK:enterprise:S9001",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0b98618a-fca0-49e4-b611-b93bf8f9cd1e",
      "modified": "2026-04-29T14:23:05.919Z",
      "references": [
        {
          "source_name": "SophosGnGal_SystemBC_Dec2020",
          "url": "https://news.sophos.com/en-us/2020/12/16/systembc/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0b9a6189-858f-4f49-952a-21075b860dc6",
      "subject": "ATTACK:enterprise:S9050",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0b9a6189-858f-4f49-952a-21075b860dc6",
      "modified": "2026-09-11T19:50:46.342Z",
      "references": [
        {
          "source_name": "Logpoint_StealerMalwareFamilies_2024",
          "url": "https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0f50a4e4-6ceb-4ead-88ed-147592e0b398",
      "subject": "ATTACK:enterprise:G0087",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0f50a4e4-6ceb-4ead-88ed-147592e0b398",
      "modified": "2026-07-31T18:47:53.106Z",
      "references": [
        {
          "source_name": "BitDefender Chafer May 2020",
          "url": "https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"
        },
        {
          "source_name": "Symantec Chafer February 2018",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--110690db-fd9b-425a-9269-ec082f0af3f9",
      "subject": "ATTACK:enterprise:G0059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--110690db-fd9b-425a-9269-ec082f0af3f9",
      "modified": "2026-07-31T18:48:28.087Z",
      "references": [
        {
          "source_name": "DFIR Phosphorus November 2021",
          "url": "https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"
        },
        {
          "source_name": "DFIR Report APT35 ProxyShell March 2022",
          "url": "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"
        },
        {
          "source_name": "Unit 42 Magic Hound Feb 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"
        },
        {
          "source_name": "FireEye APT35 2018",
          "url": "https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"
        },
        {
          "source_name": "Microsoft Iranian Threat Actor Trends November 2021",
          "url": "https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--11475791-a127-476d-acaa-905e2397be5f",
      "subject": "ATTACK:enterprise:S0650",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--11475791-a127-476d-acaa-905e2397be5f",
      "modified": "2026-04-29T14:23:05.927Z",
      "references": [
        {
          "source_name": "Group IB Ransomware September 2020",
          "url": "https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1219cbd2-26b8-4a2e-bbf1-477afc396203",
      "subject": "ATTACK:enterprise:G0073",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1219cbd2-26b8-4a2e-bbf1-477afc396203",
      "modified": "2026-07-31T18:48:30.502Z",
      "references": [
        {
          "source_name": "FireEye APT19",
          "url": "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1628f41f-4941-40d7-a11c-1f345925ab6e",
      "subject": "ATTACK:enterprise:S0622",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1628f41f-4941-40d7-a11c-1f345925ab6e",
      "modified": "2026-04-29T14:23:05.934Z",
      "references": [
        {
          "source_name": "Malwarebytes Kimsuky June 2021",
          "url": "https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--16e90509-5ea2-48ff-8e09-686dcfddbb3b",
      "subject": "ATTACK:enterprise:G0007",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--16e90509-5ea2-48ff-8e09-686dcfddbb3b",
      "modified": "2026-07-31T20:48:44.425Z",
      "references": [
        {
          "source_name": "Palo Alto Sofacy 06-2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"
        },
        {
          "source_name": "TrendMicro Pawn Storm Dec 2020",
          "url": "https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"
        },
        {
          "source_name": "Cybersecurity Advisory GRU Brute Force Campaign July 2021",
          "url": "https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--181575ee-d601-4681-8568-1904917e2c15",
      "subject": "ATTACK:enterprise:S1141",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--181575ee-d601-4681-8568-1904917e2c15",
      "modified": "2026-04-29T14:23:05.937Z",
      "references": [
        {
          "source_name": "ESET Turla Lunar toolset May 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1aaecef9-d21a-420c-a6c0-53cca7a5e5d8",
      "subject": "ATTACK:enterprise:G0096",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1aaecef9-d21a-420c-a6c0-53cca7a5e5d8",
      "modified": "2026-07-31T20:48:26.825Z",
      "references": [
        {
          "source_name": "FireEye APT41 Aug 2019",
          "url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
        },
        {
          "source_name": "FireEye APT41 March 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1ad06cf0-26dd-4020-b57b-f26e83ae1875",
      "subject": "ATTACK:enterprise:S1202",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1ad06cf0-26dd-4020-b57b-f26e83ae1875",
      "modified": "2026-04-29T14:23:05.941Z",
      "references": [
        {
          "source_name": "Joint Cybersecurity Advisory LockBit 3.0 MAR 2023",
          "url": "https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1b6f1db5-a16b-4bfa-aab0-9109abec30c2",
      "subject": "ATTACK:enterprise:S1140",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1b6f1db5-a16b-4bfa-aab0-9109abec30c2",
      "modified": "2026-04-29T14:23:05.942Z",
      "references": [
        {
          "source_name": "Google TAG COLDRIVER January 2024",
          "url": "https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1d8fedc7-e139-4806-9904-3cc2bf8b9334",
      "subject": "ATTACK:enterprise:G0034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1d8fedc7-e139-4806-9904-3cc2bf8b9334",
      "modified": "2026-07-31T20:48:32.673Z",
      "references": [
        {
          "source_name": "Dragos Crashoverride 2018",
          "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
        },
        {
          "source_name": "US District Court Indictment GRU Unit 74455 October 2020",
          "url": "https://www.justice.gov/opa/press-release/file/1328521/download"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1fe15306-2903-4eaf-bf77-dbf80bd23809",
      "subject": "ATTACK:enterprise:S1155",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1fe15306-2903-4eaf-bf77-dbf80bd23809",
      "modified": "2026-04-29T14:23:05.948Z",
      "references": [
        {
          "source_name": "Github Covenant",
          "url": "https://github.com/cobbr/Covenant"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--200c0e0f-f4d6-4271-9963-e8487ea8f065",
      "subject": "ATTACK:enterprise:C0051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--200c0e0f-f4d6-4271-9963-e8487ea8f065",
      "modified": "2026-07-31T21:11:45.983Z",
      "references": [
        {
          "source_name": "Nearest Neighbor Volexity",
          "url": "https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--20139f78-9319-4a34-8b10-8a81dd2b763f",
      "subject": "ATTACK:enterprise:G1055",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--20139f78-9319-4a34-8b10-8a81dd2b763f",
      "modified": "2026-07-31T18:48:25.324Z",
      "references": [
        {
          "source_name": "DOJ FBI Handala Hack March 2026",
          "url": "https://www.justice.gov/opa/media/1431956/dl?inline"
        },
        {
          "source_name": "FBI IC3 Flash VOID MANTICORE Handala Hack March 2026",
          "url": "https://www.ic3.gov/CSA/2026/260320.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--23bd8751-1083-4c0b-8ec1-b5f637c5fbc7",
      "subject": "ATTACK:enterprise:S0496",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--23bd8751-1083-4c0b-8ec1-b5f637c5fbc7",
      "modified": "2026-04-29T14:23:05.954Z",
      "references": [
        {
          "source_name": "Secureworks GandCrab and REvil September 2019",
          "url": "https://www.secureworks.com/blog/revil-the-gandcrab-connection"
        },
        {
          "source_name": "Talos Sodinokibi April 2019",
          "url": "https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html"
        },
        {
          "source_name": "Intel 471 REvil March 2020",
          "url": "https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"
        },
        {
          "source_name": "Group IB Ransomware May 2020",
          "url": "https://www.group-ib.com/whitepapers/ransomware-uncovered.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--277532f0-8f01-4b9d-b59a-3c993f5e528d",
      "subject": "ATTACK:enterprise:G1019",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--277532f0-8f01-4b9d-b59a-3c993f5e528d",
      "modified": "2026-07-31T20:48:38.782Z",
      "references": [
        {
          "source_name": "MoustachedBouncer ESET August 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2cd5235f-1f0b-4f58-a931-d3b940b62cbf",
      "subject": "ATTACK:enterprise:S0534",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2cd5235f-1f0b-4f58-a931-d3b940b62cbf",
      "modified": "2026-04-29T14:23:05.965Z",
      "references": [
        {
          "source_name": "NCC Group Team9 June 2020",
          "url": "https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"
        },
        {
          "source_name": "CrowdStrike Wizard Spider October 2020",
          "url": "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2ed4e002-fe79-4ea9-94e6-d05d1c5358a9",
      "subject": "ATTACK:enterprise:C0034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2ed4e002-fe79-4ea9-94e6-d05d1c5358a9",
      "modified": "2026-07-31T21:11:05.195Z",
      "references": [
        {
          "source_name": "Mandiant-Sandworm-Ukraine-2022",
          "url": "https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2f68f61d-07e1-4181-a26c-93433f9f0db7",
      "subject": "ATTACK:enterprise:G0052",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2f68f61d-07e1-4181-a26c-93433f9f0db7",
      "modified": "2026-07-31T18:48:22.948Z",
      "references": [
        {
          "source_name": "ClearSky Wilted Tulip July 2017",
          "url": "http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--30e5b5fc-192a-4a25-8f9a-9b4f43c18a8f",
      "subject": "ATTACK:enterprise:S1201",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--30e5b5fc-192a-4a25-8f9a-9b4f43c18a8f",
      "modified": "2026-04-29T14:23:05.979Z",
      "references": [
        {
          "source_name": "Zscaler Kimsuky TRANSLATEXT",
          "url": "https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--31728aa8-de3d-4edd-8c39-3d9d3091341a",
      "subject": "ATTACK:enterprise:S1065",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--31728aa8-de3d-4edd-8c39-3d9d3091341a",
      "modified": "2026-04-29T14:23:05.981Z",
      "references": [
        {
          "source_name": "MalwareBytes WoodyRAT Aug 2022",
          "url": "https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--328636ab-7265-4212-96d4-4ebf2e6a65db",
      "subject": "ATTACK:enterprise:S0192",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--328636ab-7265-4212-96d4-4ebf2e6a65db",
      "modified": "2026-04-29T14:23:05.985Z",
      "references": [
        {
          "source_name": "GitHub Pupy",
          "url": "https://github.com/n1nj4sec/pupy"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--32be4e3c-fa7f-4ec5-abee-2ed631d0494a",
      "subject": "ATTACK:enterprise:S0514",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--32be4e3c-fa7f-4ec5-abee-2ed631d0494a",
      "modified": "2026-04-29T14:23:05.985Z",
      "references": [
        {
          "source_name": "PWC WellMess July 2020",
          "url": "https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"
        },
        {
          "source_name": "CISA WellMess July 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--33bba084-3681-4955-861d-2ff6fe02ad9b",
      "subject": "ATTACK:enterprise:G0076",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--33bba084-3681-4955-861d-2ff6fe02ad9b",
      "modified": "2026-07-31T18:48:22.045Z",
      "references": [
        {
          "source_name": "Symantec Thrip June 2018",
          "url": "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--37224c2a-26a2-40cd-bcf1-a3f309c0fc63",
      "subject": "ATTACK:enterprise:G1053",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--37224c2a-26a2-40cd-bcf1-a3f309c0fc63",
      "modified": "2026-07-31T18:48:03.591Z",
      "references": [
        {
          "source_name": "Microsoft Storm-501 Sabbath Ransomware Embargo September 2024",
          "url": "https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"
        },
        {
          "source_name": "Microsoft Storm-0501 Embargo Ransomware August 2025",
          "url": "https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--375253bd-1832-4177-a1b1-92b42a6a599b",
      "subject": "ATTACK:enterprise:S0689",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--375253bd-1832-4177-a1b1-92b42a6a599b",
      "modified": "2026-04-29T14:23:05.995Z",
      "references": [
        {
          "source_name": "Cisco Ukraine Wipers January 2022",
          "url": "https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html"
        },
        {
          "source_name": "Unit 42 WhisperGate January 2022",
          "url": "https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/#whispergate-malware-family"
        },
        {
          "source_name": "Medium S2W WhisperGate January 2022",
          "url": "https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--392ae34f-3fb7-444b-a5cc-3a1ddcaa96a6",
      "subject": "ATTACK:enterprise:S0393",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--392ae34f-3fb7-444b-a5cc-3a1ddcaa96a6",
      "modified": "2026-04-29T14:23:05.998Z",
      "references": [
        {
          "source_name": "ESET Turla PowerShell May 2019",
          "url": "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--398a5e5a-b624-4992-b26c-2abb37c9c2db",
      "subject": "ATTACK:enterprise:S0389",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--398a5e5a-b624-4992-b26c-2abb37c9c2db",
      "modified": "2026-04-29T14:23:05.999Z",
      "references": [
        {
          "source_name": "Carbon Black JCry May 2019",
          "url": "https://www.carbonblack.com/2019/05/14/cb-tau-threat-intelligence-notification-jcry-ransomware-pretends-to-be-adobe-flash-player-update-installer/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3a26d78f-e0cb-4a58-8d84-6d867b32f279",
      "subject": "ATTACK:enterprise:S0266",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3a26d78f-e0cb-4a58-8d84-6d867b32f279",
      "modified": "2026-04-29T14:23:06.000Z",
      "references": [
        {
          "source_name": "Bitdefender Trickbot VNC module Whitepaper 2021",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/399/Bitdefender-PR-Whitepaper-Trickbot-creat5515-en-EN.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3aee51e9-9dad-44da-ad48-b2ca7afdeefd",
      "subject": "ATTACK:enterprise:G1046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3aee51e9-9dad-44da-ad48-b2ca7afdeefd",
      "modified": "2026-07-31T18:47:47.852Z",
      "references": [
        {
          "source_name": "rapid7-email-bombing",
          "url": "https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3b02e08d-f6fe-4d7b-907d-e8c6534f9a98",
      "subject": "ATTACK:enterprise:G1016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3b02e08d-f6fe-4d7b-907d-e8c6534f9a98",
      "modified": "2026-07-31T18:48:30.503Z",
      "references": [
        {
          "source_name": "Mandiant FIN13 Aug 2022",
          "url": "https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3bb5ea0a-5136-462d-a74d-1b7369c7cdb3",
      "subject": "ATTACK:enterprise:S9039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3bb5ea0a-5136-462d-a74d-1b7369c7cdb3",
      "modified": "2026-04-29T14:23:06.004Z",
      "references": [
        {
          "source_name": "CERT Polska",
          "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3ed930d6-ab79-4642-8320-2ed59d899b6d",
      "subject": "ATTACK:enterprise:G0078",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3ed930d6-ab79-4642-8320-2ed59d899b6d",
      "modified": "2026-07-31T18:47:42.583Z",
      "references": [
        {
          "source_name": "Unit 42 Gorgon Group Aug 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3f2f8ae7-0690-4987-a00c-6b234b938fef",
      "subject": "ATTACK:enterprise:S0553",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3f2f8ae7-0690-4987-a00c-6b234b938fef",
      "modified": "2026-04-29T14:23:06.011Z",
      "references": [
        {
          "source_name": "Cybereason Molerats Dec 2020",
          "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3fabf752-3732-4958-9b2c-e9a2e1ebbd0f",
      "subject": "ATTACK:enterprise:G1040",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3fabf752-3732-4958-9b2c-e9a2e1ebbd0f",
      "modified": "2026-07-31T18:48:25.625Z",
      "references": [
        {
          "source_name": "Trend Micro Ransomware Spotlight Play July 2023",
          "url": "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--424f1b60-9dbb-4022-8789-5338c7e1caa0",
      "subject": "ATTACK:enterprise:S1129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--424f1b60-9dbb-4022-8789-5338c7e1caa0",
      "modified": "2026-04-29T14:23:06.015Z",
      "references": [
        {
          "source_name": "CISA Akira Ransomware APR 2024",
          "url": "https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf"
        },
        {
          "source_name": "Kersten Akira 2023",
          "url": "https://www.trellix.com/blogs/research/akira-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--431f7f45-8955-48d3-948a-891ed2a59c3f",
      "subject": "ATTACK:enterprise:C0022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--431f7f45-8955-48d3-948a-891ed2a59c3f",
      "modified": "2026-07-31T21:14:22.541Z",
      "references": [
        {
          "source_name": "ESET Lazarus Jun 2020",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--43ec2047-44fb-49a5-b24a-9edcb5378e5c",
      "subject": "ATTACK:enterprise:S0673",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--43ec2047-44fb-49a5-b24a-9edcb5378e5c",
      "modified": "2026-04-29T14:23:06.018Z",
      "references": [
        {
          "source_name": "Prevailion DarkWatchman 2021",
          "url": "https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--447f5271-30fc-4d12-8b60-b0af862b9b03",
      "subject": "ATTACK:enterprise:S1117",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--447f5271-30fc-4d12-8b60-b0af862b9b03",
      "modified": "2026-04-29T14:23:06.019Z",
      "references": [
        {
          "source_name": "Volexity Ivanti Zero-Day Exploitation January 2024",
          "url": "https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--47747638-0f8d-4735-b16d-b52861dec73f",
      "subject": "ATTACK:enterprise:S0441",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--47747638-0f8d-4735-b16d-b52861dec73f",
      "modified": "2026-04-29T14:23:06.023Z",
      "references": [
        {
          "source_name": "Unit 42 Inception November 2018",
          "url": "https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4856de0a-2635-4081-97a8-3f15593c2aa5",
      "subject": "ATTACK:enterprise:G0046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4856de0a-2635-4081-97a8-3f15593c2aa5",
      "modified": "2026-07-31T20:48:31.863Z",
      "references": [
        {
          "source_name": "BlackBerry_FIN7_April2024",
          "url": "https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"
        },
        {
          "source_name": "Mandiant FIN7 Apr 2022",
          "url": "https://www.mandiant.com/resources/evolution-of-fin7"
        },
        {
          "source_name": "FireEye FIN7 April 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
        },
        {
          "source_name": "Gemini_FIN7_Jan2022",
          "url": "https://geminiadvisory.io/fin7-flash-drives-spread-remote-access-trojan/"
        },
        {
          "source_name": "Morphisec FIN7 June 2017",
          "url": "http://blog.morphisec.com/fin7-attacks-restaurant-industry"
        },
        {
          "source_name": "FBI Flash FIN7 USB",
          "url": "https://therecord.media/fbi-fin7-hackers-target-us-companies-with-badusb-devices-to-install-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--487f677f-4525-4a02-ac95-2a83e4a4bf7b",
      "subject": "ATTACK:enterprise:S0680",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--487f677f-4525-4a02-ac95-2a83e4a4bf7b",
      "modified": "2026-04-29T14:23:06.024Z",
      "references": [
        {
          "source_name": "Kaspersky WIRTE November 2021",
          "url": "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4bf29716-d465-431c-9c45-f2b7a213cdec",
      "subject": "ATTACK:enterprise:G1039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4bf29716-d465-431c-9c45-f2b7a213cdec",
      "modified": "2026-07-31T18:48:06.094Z",
      "references": [
        {
          "source_name": "group-ib_redcurl1",
          "url": "https://www.group-ib.com/resources/research-hub/red-curl/"
        },
        {
          "source_name": "group-ib_redcurl2",
          "url": "https://www.group-ib.com/resources/research-hub/red-curl-2/"
        },
        {
          "source_name": "trendmicro_redcurl",
          "url": "https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4c13f346-bdd9-4759-b1a8-1f3a38c6055b",
      "subject": "ATTACK:enterprise:S1060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4c13f346-bdd9-4759-b1a8-1f3a38c6055b",
      "modified": "2026-04-29T14:23:06.029Z",
      "references": [
        {
          "source_name": "SentinelLabs Metador Technical Appendix Sept 2022",
          "url": "https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4d173123-f1ff-45c8-9196-84678e6c5130",
      "subject": "ATTACK:enterprise:S1196",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4d173123-f1ff-45c8-9196-84678e6c5130",
      "modified": "2026-04-29T14:23:06.030Z",
      "references": [
        {
          "source_name": "S2W Troll Stealer 2024",
          "url": "https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4dea60e2-5339-4aed-b9a8-5ebf6af2f431",
      "subject": "ATTACK:enterprise:C0001",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4dea60e2-5339-4aed-b9a8-5ebf6af2f431",
      "modified": "2026-07-31T18:47:19.007Z",
      "references": [
        {
          "source_name": "Talos Frankenstein June 2019",
          "url": "https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4fcdf0b6-23c7-406c-95ba-b335b05642e5",
      "subject": "ATTACK:enterprise:G0139",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4fcdf0b6-23c7-406c-95ba-b335b05642e5",
      "modified": "2026-07-31T18:47:49.386Z",
      "references": [
        {
          "source_name": "ATT TeamTNT Chimaera September 2020",
          "url": "https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4fde23ab-b8db-4275-ac37-37e608cb00b0",
      "subject": "ATTACK:enterprise:G0049",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4fde23ab-b8db-4275-ac37-37e608cb00b0",
      "modified": "2026-07-31T20:48:35.447Z",
      "references": [
        {
          "source_name": "Trend Micro Earth Simnavaz October 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"
        },
        {
          "source_name": "OilRig New Delivery Oct 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"
        },
        {
          "source_name": "Crowdstrike Helix Kitten Nov 2018",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"
        },
        {
          "source_name": "FireEye APT34 Dec 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--500c36bc-9f08-404c-9aa6-38680c529ced",
      "subject": "ATTACK:enterprise:S0198",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--500c36bc-9f08-404c-9aa6-38680c529ced",
      "modified": "2026-04-29T14:23:06.035Z",
      "references": [
        {
          "source_name": "FireEye NETWIRE March 2019",
          "url": "https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--52358511-3339-4a85-a389-f336aa43d3fc",
      "subject": "ATTACK:enterprise:S1178",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--52358511-3339-4a85-a389-f336aa43d3fc",
      "modified": "2026-04-29T14:23:06.037Z",
      "references": [
        {
          "source_name": "Kaspersky ShrinkLocker 2024",
          "url": "https://securelist.com/ransomware-abuses-bitlocker/112643/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5238d74f-8d6c-420f-a521-f68937934842",
      "subject": "ATTACK:enterprise:S0685",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5238d74f-8d6c-420f-a521-f68937934842",
      "modified": "2026-04-29T14:23:06.037Z",
      "references": [
        {
          "source_name": "Microsoft Actinium February 2022",
          "url": "https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5420c4d7-41ff-40d0-9225-05ba7dfe48f3",
      "subject": "ATTACK:enterprise:S1229",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5420c4d7-41ff-40d0-9225-05ba7dfe48f3",
      "modified": "2026-04-29T14:23:06.040Z",
      "references": [
        {
          "source_name": "Immersive Labs Havoc C2 APR 2024",
          "url": "https://www.immersivelabs.com/resources/blog/havoc-c2-framework-a-defensive-operators-guide"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--54fad432-5890-4a82-b1c3-83c54ad773ff",
      "subject": "ATTACK:enterprise:S1138",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--54fad432-5890-4a82-b1c3-83c54ad773ff",
      "modified": "2026-04-29T14:23:06.041Z",
      "references": [
        {
          "source_name": "SentinelOne Gootloader June 2021",
          "url": "https://www.sentinelone.com/labs/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets/"
        },
        {
          "source_name": "Sophos Gootloader",
          "url": "https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--570da7ec-2d72-4e1b-9f30-f0e1a10085bf",
      "subject": "ATTACK:enterprise:S0371",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--570da7ec-2d72-4e1b-9f30-f0e1a10085bf",
      "modified": "2026-04-29T14:23:06.044Z",
      "references": [
        {
          "source_name": "FireEye APT33 Guardrail",
          "url": "https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--58a77e0d-8848-47a8-b743-e69aced6b50b",
      "subject": "ATTACK:enterprise:S1183",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--58a77e0d-8848-47a8-b743-e69aced6b50b",
      "modified": "2026-04-29T14:23:06.046Z",
      "references": [
        {
          "source_name": "IBM StrelaStealer 2024",
          "url": "https://securityintelligence.com/x-force/strela-stealer-todays-invoice-tomorrows-phish/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--58c28a92-b3ed-41de-841d-8b8d1ad142be",
      "subject": "ATTACK:enterprise:S0256",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--58c28a92-b3ed-41de-841d-8b8d1ad142be",
      "modified": "2026-04-29T14:23:06.046Z",
      "references": [
        {
          "source_name": "ESET Turla Mosquito Jan 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5a54aabe-e485-4a01-b284-cb080b11582b",
      "subject": "ATTACK:enterprise:S0499",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5a54aabe-e485-4a01-b284-cb080b11582b",
      "modified": "2026-04-29T14:23:06.048Z",
      "references": [
        {
          "source_name": "FireEye Hancitor",
          "url": "https://www.fireeye.com/blog/threat-research/2016/09/hancitor_aka_chanit.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5a580cd0-19f1-41d6-865b-786a41081a7e",
      "subject": "ATTACK:enterprise:M1042",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5a580cd0-19f1-41d6-865b-786a41081a7e",
      "modified": "2026-04-29T14:23:06.048Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5ac99030-a310-4607-bce1-490bf63639a7",
      "subject": "ATTACK:enterprise:S9051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5ac99030-a310-4607-bce1-490bf63639a7",
      "modified": "2026-09-30T20:39:07.370Z",
      "references": [
        {
          "source_name": "CarveyODonnellWelchHuntress_TheGentlemen_May2026",
          "url": "https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps"
        },
        {
          "source_name": "CheckPointResearch_TheGentlemen_April2026",
          "url": "https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"
        },
        {
          "source_name": "MSTI_GentelmenRansomware_May2026",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"
        },
        {
          "source_name": "TrendAI_TheGentlemen_Sept2025",
          "url": "https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5b2457a6-a2b8-4809-a2a0-68d1c74bbb9b",
      "subject": "ATTACK:enterprise:G0100",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5b2457a6-a2b8-4809-a2a0-68d1c74bbb9b",
      "modified": "2026-07-31T18:48:25.119Z",
      "references": [
        {
          "source_name": "Unit 42 Inception November 2018",
          "url": "https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"
        },
        {
          "source_name": "Kaspersky Cloud Atlas December 2014",
          "url": "https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5b62e906-a48a-4897-82cf-49a947782780",
      "subject": "ATTACK:enterprise:S0625",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5b62e906-a48a-4897-82cf-49a947782780",
      "modified": "2026-04-29T14:23:06.050Z",
      "references": [
        {
          "source_name": "McAfee Cuba April 2021",
          "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5b69fc3c-1bf7-4092-be94-755790ccf41f",
      "subject": "ATTACK:enterprise:S0170",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5b69fc3c-1bf7-4092-be94-755790ccf41f",
      "modified": "2026-04-29T14:23:06.050Z",
      "references": [
        {
          "source_name": "Palo Alto OilRig May 2016",
          "url": "http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5cb2c8db-bd76-4a39-be55-6de6864cb129",
      "subject": "ATTACK:enterprise:S0613",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5cb2c8db-bd76-4a39-be55-6de6864cb129",
      "modified": "2026-04-29T14:23:06.052Z",
      "references": [
        {
          "source_name": "BlackBerry CostaRicto November 2020",
          "url": "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5db4c540-d95b-4a38-9d05-c21d7c85c9b1",
      "subject": "ATTACK:enterprise:S0583",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5db4c540-d95b-4a38-9d05-c21d7c85c9b1",
      "modified": "2026-04-29T14:23:06.053Z",
      "references": [
        {
          "source_name": "CERT-FR PYSA April 2020",
          "url": "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-003.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5df525ae-d983-4fde-ac10-b07a820d9046",
      "subject": "ATTACK:enterprise:G0032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5df525ae-d983-4fde-ac10-b07a820d9046",
      "modified": "2026-07-31T20:48:46.739Z",
      "references": [
        {
          "source_name": "Google TAG Lazarus Jan 2021",
          "url": "https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5eabbcb7-3672-4518-9e2e-2a5a8e3120fa",
      "subject": "ATTACK:enterprise:S0546",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5eabbcb7-3672-4518-9e2e-2a5a8e3120fa",
      "modified": "2026-04-29T14:23:06.054Z",
      "references": [
        {
          "source_name": "Cybereason Molerats Dec 2020",
          "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"
        },
        {
          "source_name": "BleepingComputer Molerats Dec 2020",
          "url": "https://www.bleepingcomputer.com/news/security/hacking-group-s-new-malware-abuses-google-and-facebook-services/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5f00edf9-fcfc-4514-8d06-bc69f91f9260",
      "subject": "ATTACK:enterprise:G0050",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5f00edf9-fcfc-4514-8d06-bc69f91f9260",
      "modified": "2026-07-31T18:47:44.556Z",
      "references": [
        {
          "source_name": "FireEye APT32 May 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"
        },
        {
          "source_name": "Cybereason Oceanlotus May 2017",
          "url": "https://www.cybereason.com/blog/operation-cobalt-kitty-apt"
        },
        {
          "source_name": "Cybereason Cobalt Kitty 2017",
          "url": "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6337cf38-4b52-4e3d-a63e-670e077ec52f",
      "subject": "ATTACK:enterprise:G0114",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6337cf38-4b52-4e3d-a63e-670e077ec52f",
      "modified": "2026-07-31T20:48:41.322Z",
      "references": [
        {
          "source_name": "Cycraft Chimera April 2020",
          "url": "https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"
        },
        {
          "source_name": "NCC Group Chimera January 2021",
          "url": "https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--635e93f3-ba76-43c5-961e-8464d4c257c3",
      "subject": "ATTACK:enterprise:S0250",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--635e93f3-ba76-43c5-961e-8464d4c257c3",
      "modified": "2026-04-29T14:23:06.060Z",
      "references": [
        {
          "source_name": "MalwareBytes LazyScripter Feb 2021",
          "url": "https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--68019421-95db-4416-879d-bb68c063dd78",
      "subject": "ATTACK:enterprise:G1017",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--68019421-95db-4416-879d-bb68c063dd78",
      "modified": "2026-07-31T18:47:40.590Z",
      "references": [
        {
          "source_name": "CISA AA24-038A PRC Critical Infrastructure February 2024",
          "url": "https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"
        },
        {
          "source_name": "Microsoft Volt Typhoon May 2023",
          "url": "https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"
        },
        {
          "source_name": "Joint Cybersecurity Advisory Volt Typhoon June 2023",
          "url": "https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6809f70c-63a2-415d-8c64-66784fd80caf",
      "subject": "ATTACK:enterprise:S0385",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6809f70c-63a2-415d-8c64-66784fd80caf",
      "modified": "2026-04-29T14:23:06.066Z",
      "references": [
        {
          "source_name": "Trend Micro njRAT 2018",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--68a9e6aa-c9c1-48b8-afb8-4f8eb68b0ea0",
      "subject": "ATTACK:enterprise:C0058",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--68a9e6aa-c9c1-48b8-afb8-4f8eb68b0ea0",
      "modified": "2026-07-31T18:47:18.345Z",
      "references": [
        {
          "source_name": "Eye Research ToolShell JUL 2025",
          "url": "https://research.eye.security/sharepoint-under-siege/"
        },
        {
          "source_name": "SentinelOne ToolShell JUL 2025",
          "url": "https://www.sentinelone.com/blog/sharepoint-toolshell-zero-day-exploited-in-the-wild-targets-enterprise-servers/"
        },
        {
          "source_name": "Microsoft SharePoint Exploit JUL 2025",
          "url": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603"
        },
        {
          "source_name": "Palo Alto SharePoint Vulnerabilities JUL 2025",
          "url": "https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--68aa9b71-e2a2-4beb-87ee-f1a5d016b2dc",
      "subject": "ATTACK:enterprise:S0633",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--68aa9b71-e2a2-4beb-87ee-f1a5d016b2dc",
      "modified": "2026-04-29T14:23:06.067Z",
      "references": [
        {
          "source_name": "Cybereason Sliver Undated",
          "url": "https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--69422dae-3bc2-41a9-bfc8-6ef431f807c6",
      "subject": "ATTACK:enterprise:S0381",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--69422dae-3bc2-41a9-bfc8-6ef431f807c6",
      "modified": "2026-04-29T14:23:06.068Z",
      "references": [
        {
          "source_name": "Korean FSI TA505 2020",
          "url": "https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6c740f17-8419-4ee0-95ee-71b4ef5ab35b",
      "subject": "ATTACK:enterprise:G1031",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6c740f17-8419-4ee0-95ee-71b4ef5ab35b",
      "modified": "2026-07-31T18:48:00.371Z",
      "references": [
        {
          "source_name": "Palo Alto Unit 42 OutSteel SaintBot February 2022 ",
          "url": "https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6da35448-bec3-44cd-8596-2ded87b6fcaa",
      "subject": "ATTACK:enterprise:S1149",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6da35448-bec3-44cd-8596-2ded87b6fcaa",
      "modified": "2026-04-29T14:23:06.074Z",
      "references": [
        {
          "source_name": "Mandiant ROADSWEEP August 2022",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6e2b1acc-87b5-4947-a933-b376d48b126a",
      "subject": "ATTACK:enterprise:G1006",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6e2b1acc-87b5-4947-a933-b376d48b126a",
      "modified": "2026-07-31T20:48:48.232Z",
      "references": [
        {
          "source_name": "TrendMicro EarthLusca 2022",
          "url": "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6e6828ca-7567-4302-8ed7-fa5821dc5bbc",
      "subject": "ATTACK:enterprise:G0027",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6e6828ca-7567-4302-8ed7-fa5821dc5bbc",
      "modified": "2026-07-31T18:48:29.100Z",
      "references": [
        {
          "source_name": "SecureWorks BRONZE UNION June 2017",
          "url": "https://www.secureworks.com/research/bronze-union"
        },
        {
          "source_name": "Trend Micro DRBControl February 2020",
          "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6f6803c2-ab49-4c74-b0fe-262276e85d3e",
      "subject": "ATTACK:enterprise:G1018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6f6803c2-ab49-4c74-b0fe-262276e85d3e",
      "modified": "2026-07-31T18:47:55.360Z",
      "references": [
        {
          "source_name": "Proofpoint TA2541 February 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6fdc3210-9754-4157-b386-8fcd680e732c",
      "subject": "ATTACK:enterprise:G0009",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6fdc3210-9754-4157-b386-8fcd680e732c",
      "modified": "2026-07-31T18:48:12.717Z",
      "references": [
        {
          "source_name": "Alperovitch 2014",
          "url": "https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7005793f-b8da-49c5-8985-9d4476c3faaf",
      "subject": "ATTACK:enterprise:G0119",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7005793f-b8da-49c5-8985-9d4476c3faaf",
      "modified": "2026-07-31T18:47:35.453Z",
      "references": [
        {
          "source_name": "Crowdstrike Indrik November 2018",
          "url": "https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"
        },
        {
          "source_name": "Symantec WastedLocker June 2020",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--70d1a246-4ff2-452d-babf-ed47bccbf1c4",
      "subject": "ATTACK:enterprise:G0080",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--70d1a246-4ff2-452d-babf-ed47bccbf1c4",
      "modified": "2026-07-31T18:48:23.019Z",
      "references": [
        {
          "source_name": "TrendMicro Cobalt Group Nov 2017",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/"
        },
        {
          "source_name": "RiskIQ Cobalt Jan 2018",
          "url": "https://web.archive.org/web/20190508170147/https://www.riskiq.com/blog/labs/cobalt-group-spear-phishing-russian-banks/"
        },
        {
          "source_name": "Group IB Cobalt Aug 2017",
          "url": "https://www.group-ib.com/blog/cobalt"
        },
        {
          "source_name": "PTSecurity Cobalt Dec 2016",
          "url": "https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"
        },
        {
          "source_name": "PTSecurity Cobalt Group Aug 2017",
          "url": "https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"
        },
        {
          "source_name": "Talos Cobalt Group July 2018",
          "url": "https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--71ae6f80-3d5c-4d61-8995-5844f9f592ed",
      "subject": "ATTACK:enterprise:G0065",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--71ae6f80-3d5c-4d61-8995-5844f9f592ed",
      "modified": "2026-07-31T20:48:38.224Z",
      "references": [
        {
          "source_name": "Accenture MUDCARP March 2019",
          "url": "https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"
        },
        {
          "source_name": "Proofpoint Leviathan Oct 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"
        },
        {
          "source_name": "CISA AA21-200A APT40 July 2021",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa21-200a"
        },
        {
          "source_name": "FireEye Periscope March 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--72a66d47-2b0e-42ce-989f-1010cbd1cd82",
      "subject": "ATTACK:enterprise:S1111",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--72a66d47-2b0e-42ce-989f-1010cbd1cd82",
      "modified": "2026-04-29T14:23:06.082Z",
      "references": [
        {
          "source_name": "Rapid7 BlackBasta 2024",
          "url": "https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7396dd25-432c-4285-8149-1237b1273a53",
      "subject": "ATTACK:enterprise:S0154",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7396dd25-432c-4285-8149-1237b1273a53",
      "modified": "2026-04-29T14:23:06.083Z",
      "references": [
        {
          "source_name": "Cobalt Strike TTPs Dec 2017",
          "url": "https://web.archive.org/web/20210924171429/https://www.cobaltstrike.com/downloads/reports/tacticstechniquesandprocedures.pdf"
        },
        {
          "source_name": "Cyberreason Anchor December 2019",
          "url": "https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"
        },
        {
          "source_name": "Talos Cobalt Strike September 2020",
          "url": "https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"
        },
        {
          "source_name": "CobaltStrike Daddy May 2017",
          "url": "https://web.archive.org/web/20171009220105/https://blog.cobaltstrike.com/2017/05/23/cobalt-strike-3-8-whos-your-daddy/"
        },
        {
          "source_name": "cobaltstrike manual",
          "url": "https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"
        },
        {
          "source_name": "Cobalt Strike Manual 4.3 November 2020",
          "url": "https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--73baa214-fbe6-477e-9beb-d1a08a6d117f",
      "subject": "ATTACK:enterprise:G0102",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--73baa214-fbe6-477e-9beb-d1a08a6d117f",
      "modified": "2026-07-31T20:48:50.285Z",
      "references": [
        {
          "source_name": "Red Canary Hospital Thwarted Ryuk October 2020",
          "url": "https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/"
        },
        {
          "source_name": "DHS/CISA Ransomware Targeting Healthcare October 2020",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"
        },
        {
          "source_name": "CrowdStrike Grim Spider May 2019",
          "url": "https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"
        },
        {
          "source_name": "FireEye KEGTAP SINGLEMALT October 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"
        },
        {
          "source_name": "Mandiant FIN12 Oct 2021",
          "url": "https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7425e191-ec5c-40ec-ab5f-fb99d6064422",
      "subject": "ATTACK:enterprise:S0356",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7425e191-ec5c-40ec-ab5f-fb99d6064422",
      "modified": "2026-04-29T14:23:06.084Z",
      "references": [
        {
          "source_name": "Talos Konni May 2017",
          "url": "https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"
        },
        {
          "source_name": "Malwarebytes Konni Aug 2021",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--749b0a26-fbf8-4858-a545-5faca77adead",
      "subject": "ATTACK:enterprise:S0273",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--749b0a26-fbf8-4858-a545-5faca77adead",
      "modified": "2026-04-29T14:23:06.085Z",
      "references": [
        {
          "source_name": "TrendMicro Patchwork Dec 2017",
          "url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--758cbc32-6b33-4012-8622-cd7d218a799c",
      "subject": "ATTACK:enterprise:M1049",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--758cbc32-6b33-4012-8622-cd7d218a799c",
      "modified": "2026-04-29T14:23:06.086Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--76c260cd-7cc8-4333-a253-e19b953c8291",
      "subject": "ATTACK:enterprise:C0018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--76c260cd-7cc8-4333-a253-e19b953c8291",
      "modified": "2026-07-31T18:47:23.140Z",
      "references": [
        {
          "source_name": "Costa AvosLocker May 2022",
          "url": "https://www.linkedin.com/pulse/raas-avoslocker-incident-response-analysis-fl%C3%A1vio-costa?trk=articles_directory"
        },
        {
          "source_name": "Cisco Talos Avos Jun 2022",
          "url": "https://blog.talosintelligence.com/avoslocker-new-arsenal/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--76d0c7c0-a49e-45af-b734-a8cae9243ca5",
      "subject": "ATTACK:enterprise:S1132",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--76d0c7c0-a49e-45af-b734-a8cae9243ca5",
      "modified": "2026-04-29T14:23:06.088Z",
      "references": [
        {
          "source_name": "SentinelOne Agrius 2021",
          "url": "https://assets.sentinelone.com/sentinellabs/evol-agrius"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--78119003-ea2c-4921-aab8-df04f3e9dfe2",
      "subject": "ATTACK:enterprise:C0044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--78119003-ea2c-4921-aab8-df04f3e9dfe2",
      "modified": "2026-07-31T21:13:47.672Z",
      "references": [
        {
          "source_name": "ESET OilRig Campaigns Sep 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7b458295-8e67-4f1f-acde-3316ae2e061e",
      "subject": "ATTACK:enterprise:S0367",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7b458295-8e67-4f1f-acde-3316ae2e061e",
      "modified": "2026-04-29T14:23:06.094Z",
      "references": [
        {
          "source_name": "Symantec Emotet Jul 2018",
          "url": "https://www.symantec.com/blogs/threat-intelligence/evolution-emotet-trojan-distributor"
        },
        {
          "source_name": "Trend Micro Emotet Jan 2019",
          "url": "https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf"
        },
        {
          "source_name": "Picus Emotet Dec 2018",
          "url": "https://www.picussecurity.com/blog/the-christmas-card-you-never-wanted-a-new-wave-of-emotet-is-back-to-wreak-havoc.html"
        },
        {
          "source_name": "Red Canary Emotet Feb 2019",
          "url": "https://redcanary.com/blog/stopping-emotet-before-it-moves-laterally/"
        },
        {
          "source_name": "Carbon Black Emotet Apr 2019",
          "url": "https://www.carbonblack.com/2019/04/24/cb-tau-threat-intelligence-notification-emotet-utilizing-wmi-to-launch-powershell-encoded-code/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7bd50f5d-26d2-45b5-a09d-6e775efa944a",
      "subject": "ATTACK:enterprise:G1024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7bd50f5d-26d2-45b5-a09d-6e775efa944a",
      "modified": "2026-07-31T18:47:55.188Z",
      "references": [
        {
          "source_name": "Cisco Akira Ransomware OCT 2024",
          "url": "https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7f78df2e-e6e9-43f1-815b-58e4a10fc594",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7f78df2e-e6e9-43f1-815b-58e4a10fc594",
      "modified": "2026-07-31T18:48:08.302Z",
      "references": [
        {
          "source_name": "Mandiant No Easy Breach",
          "url": "https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"
        },
        {
          "source_name": "ESET T3 Threat Report 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        },
        {
          "source_name": "Symantec Seaduke 2015",
          "url": "https://web.archive.org/web/20150717011546/http://www.symantec.com/connect/blogs/forkmeiamfamous-seaduke-latest-weapon-duke-armory"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--80bd9e02-dee9-48e9-9a75-a64ac58eefad",
      "subject": "ATTACK:enterprise:S1018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--80bd9e02-dee9-48e9-9a75-a64ac58eefad",
      "modified": "2026-04-29T14:23:06.101Z",
      "references": [
        {
          "source_name": "Palo Alto Unit 42 OutSteel SaintBot February 2022 ",
          "url": "https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--833573a6-9532-4e0d-805e-7531ab1f9475",
      "subject": "ATTACK:enterprise:S9036",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--833573a6-9532-4e0d-805e-7531ab1f9475",
      "modified": "2026-04-29T14:23:06.105Z",
      "references": [
        {
          "source_name": "ESET_MuddyWater_Dec2025",
          "url": "https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8432770c-a920-43dc-855c-216320a70a88",
      "subject": "ATTACK:enterprise:S0670",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8432770c-a920-43dc-855c-216320a70a88",
      "modified": "2026-04-29T14:23:06.106Z",
      "references": [
        {
          "source_name": "Check Point Warzone Feb 2020",
          "url": "https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"
        },
        {
          "source_name": "Uptycs Warzone UAC Bypass November 2020",
          "url": "https://www.uptycs.com/blog/warzone-rat-comes-with-uac-bypass-technique"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--851b7548-1ba4-402d-ae31-8336fa3ae47d",
      "subject": "ATTACK:enterprise:S0511",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--851b7548-1ba4-402d-ae31-8336fa3ae47d",
      "modified": "2026-04-29T14:23:06.107Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8698cc92-79ad-46c4-9cb8-30ef87a8d760",
      "subject": "ATTACK:enterprise:G0093",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8698cc92-79ad-46c4-9cb8-30ef87a8d760",
      "modified": "2026-07-31T18:47:37.347Z",
      "references": [
        {
          "source_name": "Cybereason Soft Cell June 2019",
          "url": "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--872a8c48-765c-446e-a321-9a80116f8599",
      "subject": "ATTACK:enterprise:S0674",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--872a8c48-765c-446e-a321-9a80116f8599",
      "modified": "2026-04-29T14:23:06.110Z",
      "references": [
        {
          "source_name": "Check Point APT35 CharmPower January 2022",
          "url": "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--87911fd7-8058-4d6f-99d0-68021a94357e",
      "subject": "ATTACK:enterprise:S0688",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--87911fd7-8058-4d6f-99d0-68021a94357e",
      "modified": "2026-04-29T14:23:06.110Z",
      "references": [
        {
          "source_name": "Check Point Meteor Aug 2021",
          "url": "https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8835056d-c12a-4036-9028-7b8d867f2d79",
      "subject": "ATTACK:enterprise:S0692",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8835056d-c12a-4036-9028-7b8d867f2d79",
      "modified": "2026-04-29T14:23:06.111Z",
      "references": [
        {
          "source_name": "GitHub SILENTTRINITY Modules July 2019",
          "url": "https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--89424d69-a426-4f76-9e7f-7b2dabe459be",
      "subject": "ATTACK:enterprise:S0145",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--89424d69-a426-4f76-9e7f-7b2dabe459be",
      "modified": "2026-04-29T14:23:06.112Z",
      "references": [
        {
          "source_name": "Cisco DNSMessenger March 2017",
          "url": "http://blog.talosintelligence.com/2017/03/dnsmessenger.html"
        },
        {
          "source_name": "FireEye FIN7 March 2017",
          "url": "https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8982affe-fe2b-40c8-8b0c-e539687f4124",
      "subject": "ATTACK:enterprise:S0382",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8982affe-fe2b-40c8-8b0c-e539687f4124",
      "modified": "2026-04-29T14:23:06.113Z",
      "references": [
        {
          "source_name": "Trend Micro TA505 June 2019",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8a8068fb-7cf9-4ab6-92a7-e8b3ecdf578d",
      "subject": "ATTACK:enterprise:S0341",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8a8068fb-7cf9-4ab6-92a7-e8b3ecdf578d",
      "modified": "2026-04-29T14:23:06.114Z",
      "references": [
        {
          "source_name": "Unit42 Xbash Sept 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8b368877-93b8-4ea9-84ef-84232412982f",
      "subject": "ATTACK:enterprise:S0386",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8b368877-93b8-4ea9-84ef-84232412982f",
      "modified": "2026-04-29T14:23:06.115Z",
      "references": [
        {
          "source_name": "Bromium Ursnif Mar 2017",
          "url": "https://www.bromium.com/how-ursnif-evades-detection/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8d0b1911-1443-4821-b2a3-c0c21306083c",
      "subject": "ATTACK:enterprise:G1003",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8d0b1911-1443-4821-b2a3-c0c21306083c",
      "modified": "2026-07-31T18:48:13.261Z",
      "references": [
        {
          "source_name": "CISA GRU29155 2024",
          "url": "https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8d5d9206-a213-465d-b384-6152eb2796a0",
      "subject": "ATTACK:enterprise:S0150",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8d5d9206-a213-465d-b384-6152eb2796a0",
      "modified": "2026-04-29T14:23:06.118Z",
      "references": [
        {
          "source_name": "FireEye POSHSPY April 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8d80e239-9a55-4d03-abfe-8522a8b29313",
      "subject": "ATTACK:enterprise:G1034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8d80e239-9a55-4d03-abfe-8522a8b29313",
      "modified": "2026-07-31T18:48:27.042Z",
      "references": [
        {
          "source_name": "Symantec Daggerfly 2023",
          "url": "https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8dbcee86-c9db-4ae3-ba16-29056a8a1593",
      "subject": "ATTACK:enterprise:S0196",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8dbcee86-c9db-4ae3-ba16-29056a8a1593",
      "modified": "2026-04-29T14:23:06.118Z",
      "references": [
        {
          "source_name": "Morphisec ShellTea June 2019",
          "url": "http://blog.morphisec.com/security-alert-fin8-is-back"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8e324a04-e543-4eed-bf21-cdf446d8f8f6",
      "subject": "ATTACK:enterprise:S0450",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8e324a04-e543-4eed-bf21-cdf446d8f8f6",
      "modified": "2026-04-29T14:23:06.119Z",
      "references": [
        {
          "source_name": "TrendMicro POWERSTATS V3 June 2019",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8fba0fad-b83d-4252-b7ef-c4d1b3529cba",
      "subject": "ATTACK:enterprise:S0591",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8fba0fad-b83d-4252-b7ef-c4d1b3529cba",
      "modified": "2026-04-29T14:23:06.121Z",
      "references": [
        {
          "source_name": "Anomali Static Kitten February 2021",
          "url": "https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8fc79376-2f71-4ca1-8177-a96dea11f8c7",
      "subject": "ATTACK:enterprise:M1045",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8fc79376-2f71-4ca1-8177-a96dea11f8c7",
      "modified": "2026-04-29T14:23:06.121Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--911c0e63-10bc-4fbd-b7b7-0a9e318bb4f1",
      "subject": "ATTACK:enterprise:S0223",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--911c0e63-10bc-4fbd-b7b7-0a9e318bb4f1",
      "modified": "2026-04-29T14:23:06.123Z",
      "references": [
        {
          "source_name": "ClearSky MuddyWater Nov 2018",
          "url": "https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"
        },
        {
          "source_name": "DHS CISA AA22-055A MuddyWater February 2022",
          "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
        },
        {
          "source_name": "Unit 42 MuddyWater Nov 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/"
        },
        {
          "source_name": "TrendMicro POWERSTATS V3 June 2019",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9284080a-98cb-46d7-80b3-775a89d5bdfa",
      "subject": "ATTACK:enterprise:S1070",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9284080a-98cb-46d7-80b3-775a89d5bdfa",
      "modified": "2026-04-29T14:23:06.125Z",
      "references": [
        {
          "source_name": "Trend Micro Black Basta May 2022",
          "url": "https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html"
        },
        {
          "source_name": "NCC Group Black Basta June 2022",
          "url": "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/"
        },
        {
          "source_name": "Trend Micro Black Basta Spotlight September 2022",
          "url": "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbasta"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--93c02dec-e63e-4437-809c-dc99e82d177d",
      "subject": "ATTACK:enterprise:S0491",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--93c02dec-e63e-4437-809c-dc99e82d177d",
      "modified": "2026-09-03T14:50:23.999Z",
      "references": [
        {
          "source_name": "Talos Promethium June 2020",
          "url": "https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--949cf89d-6d65-4459-83e7-dc826ae9c894",
      "subject": "ATTACK:enterprise:C0024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--949cf89d-6d65-4459-83e7-dc826ae9c894",
      "modified": "2026-07-31T18:47:27.020Z",
      "references": [
        {
          "source_name": "Volexity SolarWinds",
          "url": "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/"
        },
        {
          "source_name": "CrowdStrike StellarParticle January 2022",
          "url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"
        },
        {
          "source_name": "Microsoft Analyzing Solorigate Dec 2020",
          "url": "https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--97ea3b82-58ba-4a3e-8e6d-367755f83fa6",
      "subject": "ATTACK:enterprise:G0037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--97ea3b82-58ba-4a3e-8e6d-367755f83fa6",
      "modified": "2026-07-31T20:48:30.956Z",
      "references": [
        {
          "source_name": "FireEye FIN6 April 2016",
          "url": "https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"
        },
        {
          "source_name": "FireEye FIN6 Apr 2019",
          "url": "https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"
        },
        {
          "source_name": "Visa FIN6 Feb 2019",
          "url": "https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--98e2f79a-e394-4d26-a82e-a15c235d28dd",
      "subject": "ATTACK:enterprise:G1051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--98e2f79a-e394-4d26-a82e-a15c235d28dd",
      "modified": "2026-07-31T18:48:10.828Z",
      "references": [
        {
          "source_name": "Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024",
          "url": "https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"
        },
        {
          "source_name": "Check Point Medusa Ransomware April 2025",
          "url": "https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/medusa-ransomware-group/"
        },
        {
          "source_name": "CISA Medusa Group Medusa Ransomware March 2025",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"
        },
        {
          "source_name": "Intel471 Medusa Ransomware May 2025",
          "url": "https://www.intel471.com/blog/threat-hunting-case-study-medusa-ransomware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--998ad8ac-9929-4360-92c8-63efb1a81d78",
      "subject": "ATTACK:enterprise:S0457",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--998ad8ac-9929-4360-92c8-63efb1a81d78",
      "modified": "2026-04-29T14:23:06.134Z",
      "references": [
        {
          "source_name": "TrendMicro Netwalker May 2020",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/"
        },
        {
          "source_name": "Sophos Netwalker May 2020",
          "url": "https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9d239ea5-b191-4e30-9d0c-fd5ee69e621d",
      "subject": "ATTACK:enterprise:S0681",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9d239ea5-b191-4e30-9d0c-fd5ee69e621d",
      "modified": "2026-04-29T14:23:06.139Z",
      "references": [
        {
          "source_name": "BiZone Lizar May 2021",
          "url": "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9e0a0a20-e78f-491b-b828-934525bf160b",
      "subject": "ATTACK:enterprise:G1001",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9e0a0a20-e78f-491b-b828-934525bf160b",
      "modified": "2026-07-31T20:48:51.837Z",
      "references": [
        {
          "source_name": "Kaspersky APT Trends Q1 April 2021",
          "url": "https://securelist.com/apt-trends-report-q1-2021/101967"
        },
        {
          "source_name": "Kaspersky Lyceum October 2021",
          "url": "https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"
        },
        {
          "source_name": "SecureWorks August 2019",
          "url": "https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9ee8a8fb-798e-4fa0-9ae0-ab96e75c9f4e",
      "subject": "ATTACK:enterprise:G0140",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9ee8a8fb-798e-4fa0-9ae0-ab96e75c9f4e",
      "modified": "2026-07-31T18:48:13.556Z",
      "references": [
        {
          "source_name": "MalwareBytes LazyScripter Feb 2021",
          "url": "https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9eedce39-c414-4953-9402-f80b725d003c",
      "subject": "ATTACK:enterprise:S1151",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9eedce39-c414-4953-9402-f80b725d003c",
      "modified": "2026-06-13T12:16:48.767Z",
      "references": [
        {
          "source_name": "IBM ZeroCleare Wiper December 2019",
          "url": "https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9ffbd639-bdd2-48f1-b9a6-dd5a63f70960",
      "subject": "ATTACK:enterprise:G1043",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9ffbd639-bdd2-48f1-b9a6-dd5a63f70960",
      "modified": "2026-07-31T18:47:36.327Z",
      "references": [
        {
          "source_name": "Microsoft BlackByte 2023",
          "url": "https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"
        },
        {
          "source_name": "FBI BlackByte 2022",
          "url": "https://www.ic3.gov/CSA/2022/220211.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a08b1776-efe3-4304-9dba-dc977fc934cd",
      "subject": "ATTACK:enterprise:S0679",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a08b1776-efe3-4304-9dba-dc977fc934cd",
      "modified": "2026-04-29T14:23:06.144Z",
      "references": [
        {
          "source_name": "Kaspersky WIRTE November 2021",
          "url": "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a0966525-4eba-46ce-b61a-53f7920a63fb",
      "subject": "ATTACK:enterprise:C0064",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a0966525-4eba-46ce-b61a-53f7920a63fb",
      "modified": "2026-09-23T21:54:37.586Z",
      "references": [
        {
          "source_name": "AI-Mexico-Govt-Breach",
          "url": "https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a1625ff1-af65-4dbb-b192-3c462fae1acf",
      "subject": "ATTACK:enterprise:G0125",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a1625ff1-af65-4dbb-b192-3c462fae1acf",
      "modified": "2026-07-31T18:47:44.626Z",
      "references": [
        {
          "source_name": "Microsoft HAFNIUM March 2020",
          "url": "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
        },
        {
          "source_name": "Volexity Exchange Marauder March 2021",
          "url": "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a3eca9d0-bc4b-48a8-801d-9aaa757bfe72",
      "subject": "ATTACK:enterprise:S0037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a3eca9d0-bc4b-48a8-801d-9aaa757bfe72",
      "modified": "2026-04-29T14:23:06.148Z",
      "references": [
        {
          "source_name": "FireEye APT29",
          "url": "https://services.google.com/fh/files/misc/rpt-apt29-hammertoss-stealthy-tactics-define-en.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a55c163c-3eb8-47a2-8ad1-3a667b4ac129",
      "subject": "ATTACK:enterprise:G0121",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a55c163c-3eb8-47a2-8ad1-3a667b4ac129",
      "modified": "2026-07-31T18:47:51.973Z",
      "references": [
        {
          "source_name": "ATT Sidewinder January 2021",
          "url": "https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a5888362-00f3-4c9e-98ee-048aee5169e1",
      "subject": "ATTACK:enterprise:G0051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a5888362-00f3-4c9e-98ee-048aee5169e1",
      "modified": "2026-07-31T18:48:28.858Z",
      "references": [
        {
          "source_name": "FireEye FIN10 June 2017",
          "url": "https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"
        },
        {
          "source_name": "Github PowerShell Empire",
          "url": "https://github.com/PowerShellEmpire/Empire"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a62885f2-38a3-4030-b28d-bff5b3d692df",
      "subject": "ATTACK:enterprise:S0521",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a62885f2-38a3-4030-b28d-bff5b3d692df",
      "modified": "2026-04-29T14:23:06.151Z",
      "references": [
        {
          "source_name": "CrowdStrike BloodHound April 2018",
          "url": "https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a7fb30f9-eb52-4706-958a-4cabe0e68e12",
      "subject": "ATTACK:enterprise:S1046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a7fb30f9-eb52-4706-958a-4cabe0e68e12",
      "modified": "2026-04-29T14:23:06.154Z",
      "references": [
        {
          "source_name": "DHS CISA AA22-055A MuddyWater February 2022",
          "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a8a65990-8385-440b-8733-940a69b05f4e",
      "subject": "ATTACK:enterprise:S0517",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a8a65990-8385-440b-8733-940a69b05f4e",
      "modified": "2026-04-29T14:23:06.155Z",
      "references": [
        {
          "source_name": "Trustwave Pillowmint June 2020",
          "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a8fb34b2-3de0-4ffa-a793-9f4cefa02ff9",
      "subject": "ATTACK:enterprise:S1058",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a8fb34b2-3de0-4ffa-a793-9f4cefa02ff9",
      "modified": "2026-04-29T14:23:06.155Z",
      "references": [
        {
          "source_name": "Microsoft Prestige ransomware October 2022",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ab0632b1-c417-43aa-91ad-b0773f0fd1ce",
      "subject": "ATTACK:enterprise:S9034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ab0632b1-c417-43aa-91ad-b0773f0fd1ce",
      "modified": "2026-04-29T14:23:06.158Z",
      "references": [
        {
          "source_name": "CAL_MuddyWater_Mar2026",
          "url": "https://ctrlaltintel.com/research/MuddyWater/"
        },
        {
          "source_name": "SecureListUbiedo_Tsundere_Nov2025",
          "url": "https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ab7ec393-b1b1-4772-80d6-fd1d895ea39a",
      "subject": "ATTACK:enterprise:S1213",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ab7ec393-b1b1-4772-80d6-fd1d895ea39a",
      "modified": "2026-04-29T14:23:06.158Z",
      "references": [
        {
          "source_name": "Fortinet LummaStealer 2024",
          "url": "https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube"
        },
        {
          "source_name": "Cybereason LumaStealer Undated",
          "url": "https://www.cybereason.com/blog/threat-analysis-rise-of-lummastealer"
        },
        {
          "source_name": "Netskope LummaStealer 2025",
          "url": "https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection"
        },
        {
          "source_name": "Qualys LummaStealer 2024",
          "url": "https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ac048ca9-efc6-46fd-90fe-b9d2a641f037",
      "subject": "ATTACK:enterprise:G0084",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ac048ca9-efc6-46fd-90fe-b9d2a641f037",
      "modified": "2026-07-31T18:47:47.718Z",
      "references": [
        {
          "source_name": "Symantec Gallmaker Oct 2018",
          "url": "https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ad825dd4-a26c-4468-8c11-91124ef9042d",
      "subject": "ATTACK:enterprise:S0354",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ad825dd4-a26c-4468-8c11-91124ef9042d",
      "modified": "2026-04-29T14:23:06.161Z",
      "references": [
        {
          "source_name": "Cybereason Cobalt Kitty 2017",
          "url": "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ada9885f-276a-4f97-859d-1bb9f73b58c1",
      "subject": "ATTACK:enterprise:G0010",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ada9885f-276a-4f97-859d-1bb9f73b58c1",
      "modified": "2026-07-31T18:48:04.212Z",
      "references": [
        {
          "source_name": "ESET Turla Mosquito May 2018",
          "url": "https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/"
        },
        {
          "source_name": "ESET Turla PowerShell May 2019",
          "url": "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"
        },
        {
          "source_name": "Symantec Waterbug Jun 2019",
          "url": "https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--addc6473-9aa0-4c46-9e6a-2a58c47da0fe",
      "subject": "ATTACK:enterprise:S1023",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--addc6473-9aa0-4c46-9e6a-2a58c47da0fe",
      "modified": "2026-04-29T14:23:06.162Z",
      "references": [
        {
          "source_name": "Microsoft POLONIUM June 2022",
          "url": "https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--afafd676-1b44-44ae-ad9a-930c0df348bc",
      "subject": "ATTACK:enterprise:G0091",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--afafd676-1b44-44ae-ad9a-930c0df348bc",
      "modified": "2026-07-31T18:48:21.406Z",
      "references": [
        {
          "source_name": "Group IB Silence Sept 2018",
          "url": "https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."
        },
        {
          "source_name": "Cyber Forensicator Silence Jan 2019",
          "url": "https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b0913099-1f00-44d5-b3d6-13ee2c07553d",
      "subject": "ATTACK:enterprise:S9019",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b0913099-1f00-44d5-b3d6-13ee2c07553d",
      "modified": "2026-04-29T14:23:06.166Z",
      "references": [
        {
          "source_name": "Check Point Blind Eagle MAR 2025",
          "url": "https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"
        },
        {
          "source_name": "Zscaler PureCrypter JUN 2022",
          "url": "https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b1c4fbea-d3d4-4e9a-ab46-8683f2bde40b",
      "subject": "ATTACK:enterprise:S0379",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b1c4fbea-d3d4-4e9a-ab46-8683f2bde40b",
      "modified": "2026-04-29T14:23:06.168Z",
      "references": [
        {
          "source_name": "Cofense RevengeRAT Feb 2019",
          "url": "https://web.archive.org/web/20200428173819/https://cofense.com/upgrades-delivery-support-infrastructure-revenge-rat-malware-bigger-threat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b21c213b-9a73-4784-b123-a339d401b66e",
      "subject": "ATTACK:enterprise:S1032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b21c213b-9a73-4784-b123-a339d401b66e",
      "modified": "2026-04-29T14:23:06.168Z",
      "references": [
        {
          "source_name": "Checkpoint MosesStaff Nov 2021",
          "url": "https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b2562bd3-5f78-4bcb-a37b-cae2b415c629",
      "subject": "ATTACK:enterprise:G0021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b2562bd3-5f78-4bcb-a37b-cae2b415c629",
      "modified": "2026-07-31T18:48:23.819Z",
      "references": [
        {
          "source_name": "Kaspersky MoleRATs April 2019",
          "url": "https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b36ef70d-6691-4f3b-a1ca-08d4aadaac7e",
      "subject": "ATTACK:enterprise:S0234",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b36ef70d-6691-4f3b-a1ca-08d4aadaac7e",
      "modified": "2026-04-29T14:23:06.170Z",
      "references": [
        {
          "source_name": "CheckPoint Bandook Nov 2020",
          "url": "https://research.checkpoint.com/2020/bandook-signed-delivered/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b41c3406-5ffb-4e92-ab0a-bc62da337eb9",
      "subject": "ATTACK:enterprise:G1022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b41c3406-5ffb-4e92-ab0a-bc62da337eb9",
      "modified": "2026-07-31T18:48:14.337Z",
      "references": [
        {
          "source_name": "Kaspersky ToddyCat Check Logs October 2023",
          "url": "https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b4c5b1ac-a2bd-4440-82bd-2de419ee1517",
      "subject": "ATTACK:enterprise:C0030",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b4c5b1ac-a2bd-4440-82bd-2de419ee1517",
      "modified": "2026-07-31T20:48:14.258Z",
      "references": [
        {
          "source_name": "FireEye TEMP.Veles 2018",
          "url": "https://web.archive.org/web/20190202205824/https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b4c7e12f-6921-4007-ab15-595969bf9eca",
      "subject": "ATTACK:enterprise:S0184",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b4c7e12f-6921-4007-ab15-595969bf9eca",
      "modified": "2026-04-29T14:23:06.172Z",
      "references": [
        {
          "source_name": "FireEye APT34 Dec 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b58f6de7-94a3-4d01-8bb6-491bf125095b",
      "subject": "ATTACK:enterprise:G1048",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b58f6de7-94a3-4d01-8bb6-491bf125095b",
      "modified": "2026-07-31T18:47:54.111Z",
      "references": [
        {
          "source_name": "Google Cloud Threat Intelligence ESXi VIBs 2022",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b7dc0db4-b1fb-4235-8b49-0792e7019377",
      "subject": "ATTACK:enterprise:T1059.001",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1059",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b7dc0db4-b1fb-4235-8b49-0792e7019377",
      "modified": "2026-04-29T14:23:06.176Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b8f4abe0-5d13-426e-b8c8-c709c93c91ae",
      "subject": "ATTACK:enterprise:C0032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b8f4abe0-5d13-426e-b8c8-c709c93c91ae",
      "modified": "2026-07-31T18:47:26.042Z",
      "references": [
        {
          "source_name": "FireEye TRITON 2019",
          "url": "https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b8f7512e-b0fe-4d27-ba63-bb99443d1b8c",
      "subject": "ATTACK:enterprise:S0387",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b8f7512e-b0fe-4d27-ba63-bb99443d1b8c",
      "modified": "2026-04-29T14:23:06.178Z",
      "references": [
        {
          "source_name": "PWC KeyBoys Feb 2017",
          "url": "https://web.archive.org/web/20211129064701/https://www.pwc.co.uk/issues/cyber-security-services/research/the-keyboys-are-back-in-town.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ba1b953d-08ce-4b4b-924e-92556cdf1d90",
      "subject": "ATTACK:enterprise:G0022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ba1b953d-08ce-4b4b-924e-92556cdf1d90",
      "modified": "2026-07-31T18:47:38.162Z",
      "references": [
        {
          "source_name": "FireEye Operation Double Tap",
          "url": "https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bacf9dbb-7f22-4c72-8880-c6fc9fcf01ad",
      "subject": "ATTACK:enterprise:S1024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bacf9dbb-7f22-4c72-8880-c6fc9fcf01ad",
      "modified": "2026-04-29T14:23:06.180Z",
      "references": [
        {
          "source_name": "Microsoft POLONIUM June 2022",
          "url": "https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bdac1391-310e-4511-b272-b80924166723",
      "subject": "ATTACK:enterprise:S0126",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bdac1391-310e-4511-b272-b80924166723",
      "modified": "2026-04-29T14:23:06.185Z",
      "references": [
        {
          "source_name": "ESET ComRAT May 2020",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"
        },
        {
          "source_name": "CISA ComRAT Oct 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bec1b07a-6a67-469e-8b87-246e950d86b2",
      "subject": "ATTACK:enterprise:S0695",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bec1b07a-6a67-469e-8b87-246e950d86b2",
      "modified": "2026-04-29T14:23:06.186Z",
      "references": [
        {
          "source_name": "Donut Github",
          "url": "https://github.com/TheWover/donut"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bfdffca9-6418-486d-833f-84f3920fcb71",
      "subject": "ATTACK:enterprise:S0151",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bfdffca9-6418-486d-833f-84f3920fcb71",
      "modified": "2026-04-29T14:23:06.188Z",
      "references": [
        {
          "source_name": "FireEye FIN7 April 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bff00753-95ef-4a13-96fa-963365520573",
      "subject": "ATTACK:enterprise:G0105",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bff00753-95ef-4a13-96fa-963365520573",
      "modified": "2026-07-31T18:48:05.259Z",
      "references": [
        {
          "source_name": "Securelist DarkVishnya Dec 2018",
          "url": "https://securelist.com/darkvishnya/89169/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c001d2e1-0aa6-40ce-871e-5966199587cd",
      "subject": "ATTACK:enterprise:S1012",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c001d2e1-0aa6-40ce-871e-5966199587cd",
      "modified": "2026-04-29T14:23:06.188Z",
      "references": [
        {
          "source_name": "Cybereason PowerLess February 2022",
          "url": "https://www.cybereason.com/blog/research/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c08f55ca-366b-4554-879b-1b19042f9be8",
      "subject": "ATTACK:enterprise:G0062",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c08f55ca-366b-4554-879b-1b19042f9be8",
      "modified": "2026-07-31T18:47:58.914Z",
      "references": [
        {
          "source_name": "Proofpoint TA459 April 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c14a954c-5d6d-4f29-8542-934e0fa5e9d3",
      "subject": "ATTACK:enterprise:G0047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c14a954c-5d6d-4f29-8542-934e0fa5e9d3",
      "modified": "2026-07-31T18:47:47.947Z",
      "references": [
        {
          "source_name": "Microsoft Actinium February 2022",
          "url": "https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"
        },
        {
          "source_name": "ESET Gamaredon Sept2024",
          "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"
        },
        {
          "source_name": "SymantecCarbonBlack_ShuckwormUSB_Apr2025",
          "url": "https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"
        },
        {
          "source_name": "VenereCiscoTalos_Gamaredon_Mar2025",
          "url": "https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c2379d5f-4d8d-4eaa-b966-bf31b227f5e3",
      "subject": "ATTACK:enterprise:G0094",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c2379d5f-4d8d-4eaa-b966-bf31b227f5e3",
      "modified": "2026-07-31T20:48:25.431Z",
      "references": [
        {
          "source_name": "EST Kimsuky April 2019",
          "url": "https://blog.alyac.co.kr/2234"
        },
        {
          "source_name": "Talos Kimsuky Nov 2021",
          "url": "https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"
        },
        {
          "source_name": "CISA AA20-301A Kimsuky",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-301a"
        },
        {
          "source_name": "Securonix Kimsuky February 2025",
          "url": "https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"
        },
        {
          "source_name": "KISA Operation Muzabi",
          "url": "https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"
        },
        {
          "source_name": "Mandiant APT43 March 2024",
          "url": "https://services.google.com/fh/files/misc/apt43-report-en.pdf"
        },
        {
          "source_name": "NaumaanProofpoint_GlobalClickFix_April2025",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"
        },
        {
          "source_name": "Aryaka Kimsuky July 2025",
          "url": "https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c2745621-0b03-4b9d-b2f7-4e3b80487f87",
      "subject": "ATTACK:enterprise:C0014",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c2745621-0b03-4b9d-b2f7-4e3b80487f87",
      "modified": "2026-07-31T18:47:31.891Z",
      "references": [
        {
          "source_name": "FoxIT Wocao December 2019",
          "url": "https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c6adf690-07ad-4dbd-964b-0217ea2ce0fd",
      "subject": "ATTACK:enterprise:S0669",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c6adf690-07ad-4dbd-964b-0217ea2ce0fd",
      "modified": "2026-04-29T14:23:06.197Z",
      "references": [
        {
          "source_name": "MalwareBytes LazyScripter Feb 2021",
          "url": "https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c8bc8331-513b-40e1-a82b-67107d2babd4",
      "subject": "ATTACK:enterprise:C0021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c8bc8331-513b-40e1-a82b-67107d2babd4",
      "modified": "2026-07-31T18:47:24.614Z",
      "references": [
        {
          "source_name": "FireEye APT29 Nov 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html"
        },
        {
          "source_name": "Microsoft Unidentified Dec 2018",
          "url": "https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ca484dbf-aa28-4d7e-90bb-b60723ff70b1",
      "subject": "ATTACK:enterprise:G0092",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ca484dbf-aa28-4d7e-90bb-b60723ff70b1",
      "modified": "2026-07-31T18:48:05.831Z",
      "references": [
        {
          "source_name": "Proofpoint TA505 Sep 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"
        },
        {
          "source_name": "ProofPoint SettingContent-ms July 2018",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ta505-abusing-settingcontent-ms-within-pdf-files-distribute-flawedammyy-rat"
        },
        {
          "source_name": "Cybereason TA505 April 2019",
          "url": "https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware"
        },
        {
          "source_name": "Deep Instinct TA505 Apr 2019",
          "url": "https://www.deepinstinct.com/blog/new-servhelper-variant-employs-excel-4-0-macro-to-drop-signed-payload"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cab0f984-4f65-4250-bf4d-36b8250dcba0",
      "subject": "ATTACK:enterprise:S1244",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cab0f984-4f65-4250-bf4d-36b8250dcba0",
      "modified": "2026-04-29T14:23:06.202Z",
      "references": [
        {
          "source_name": "Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024",
          "url": "https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"
        },
        {
          "source_name": "Security Scorecard Medusa Ransomware January 2024",
          "url": "https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cafdf392-1a61-422f-80ca-4d0d088bd44a",
      "subject": "ATTACK:enterprise:S0447",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cafdf392-1a61-422f-80ca-4d0d088bd44a",
      "modified": "2026-04-29T14:23:06.202Z",
      "references": [
        {
          "source_name": "Talos Lokibot Jan 2021",
          "url": "https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cbb5c722-bc07-4f35-a8cd-d6e1acc839d5",
      "subject": "ATTACK:enterprise:S0512",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cbb5c722-bc07-4f35-a8cd-d6e1acc839d5",
      "modified": "2026-04-29T14:23:06.204Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cd001a55-ed41-4109-9090-41bebed9113a",
      "subject": "ATTACK:enterprise:G0061",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cd001a55-ed41-4109-9090-41bebed9113a",
      "modified": "2026-07-31T18:48:30.033Z",
      "references": [
        {
          "source_name": "FireEye Obfuscation June 2017",
          "url": "https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"
        },
        {
          "source_name": "FireEye Know Your Enemy FIN8 Aug 2016",
          "url": "https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"
        },
        {
          "source_name": "Bitdefender FIN8 July 2021",
          "url": "https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"
        },
        {
          "source_name": "Symantec FIN8 Jul 2023",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cd69ba48-b716-4278-b1a0-2efd3bd2d4de",
      "subject": "ATTACK:enterprise:G0064",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cd69ba48-b716-4278-b1a0-2efd3bd2d4de",
      "modified": "2026-07-31T20:48:53.237Z",
      "references": [
        {
          "source_name": "Symantec Elfin Mar 2019",
          "url": "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"
        },
        {
          "source_name": "Microsoft Holmium June 2020",
          "url": "https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cdf90f2f-5ea8-44a2-bd90-d607c5270a06",
      "subject": "ATTACK:enterprise:S9008",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cdf90f2f-5ea8-44a2-bd90-d607c5270a06",
      "modified": "2026-04-29T14:23:06.207Z",
      "references": [
        {
          "source_name": "Microsoft Shai-Hulud December 2025",
          "url": "https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ce8eb6bf-11cc-4d9f-a81a-57bd1422efb1",
      "subject": "ATTACK:enterprise:S0526",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ce8eb6bf-11cc-4d9f-a81a-57bd1422efb1",
      "modified": "2026-04-29T14:23:06.208Z",
      "references": [
        {
          "source_name": "Cybereason Kimsuky November 2020",
          "url": "https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cfdbe994-9056-421f-b400-c423be11a890",
      "subject": "ATTACK:enterprise:G1015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cfdbe994-9056-421f-b400-c423be11a890",
      "modified": "2026-07-31T20:48:34.476Z",
      "references": [
        {
          "source_name": "CrowdStrike Scattered Spider JUL 2025",
          "url": "https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d36e83a0-5370-4d78-862d-4dbe8921709d",
      "subject": "ATTACK:enterprise:G0060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d36e83a0-5370-4d78-862d-4dbe8921709d",
      "modified": "2026-07-31T18:48:10.918Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE BUTLER Oct 2017",
          "url": "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d37fac03-0b94-4794-b51a-e7db3d64294b",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d37fac03-0b94-4794-b51a-e7db3d64294b",
      "modified": "2026-07-31T18:47:53.425Z",
      "references": [
        {
          "source_name": "Anomali MUSTANG PANDA October 2019",
          "url": "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"
        },
        {
          "source_name": "Crowdstrike MUSTANG PANDA June 2018",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"
        },
        {
          "source_name": "Unit42 Chinese VSCode 06 September 2024",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d42a4f15-98c5-43df-9e25-7455a764070d",
      "subject": "ATTACK:enterprise:S0269",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d42a4f15-98c5-43df-9e25-7455a764070d",
      "modified": "2026-04-29T14:23:06.215Z",
      "references": [
        {
          "source_name": "Unit 42 QUADAGENT July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d434a3c1-8960-4d47-80fc-e3002c507d94",
      "subject": "ATTACK:enterprise:S0649",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d434a3c1-8960-4d47-80fc-e3002c507d94",
      "modified": "2026-04-29T14:23:06.215Z",
      "references": [
        {
          "source_name": "FireEye SMOKEDHAM June 2021",
          "url": "https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d4bf0c1a-d5cf-4d49-b0eb-4d347722ab63",
      "subject": "ATTACK:enterprise:S1039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d4bf0c1a-d5cf-4d49-b0eb-4d347722ab63",
      "modified": "2026-04-29T14:23:06.216Z",
      "references": [
        {
          "source_name": "Medium Ali Salem Bumblebee April 2022",
          "url": "https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d52caf16-afeb-4718-aca6-ff7bf5e8645d",
      "subject": "ATTACK:enterprise:S9032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d52caf16-afeb-4718-aca6-ff7bf5e8645d",
      "modified": "2026-04-29T14:23:06.217Z",
      "references": [
        {
          "source_name": "ESET_MuddyWater_Dec2025",
          "url": "https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d559a4f6-cb7f-49db-b95e-42748f3f6c63",
      "subject": "ATTACK:enterprise:C0038",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d559a4f6-cb7f-49db-b95e-42748f3f6c63",
      "modified": "2026-07-31T21:13:11.207Z",
      "references": [
        {
          "source_name": "CISA Iran Albanian Attacks September 2022",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a"
        },
        {
          "source_name": "Microsoft Albanian Government Attacks September 2022",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d6e43621-ca4a-475f-b81c-037a0878728b",
      "subject": "ATTACK:enterprise:G0040",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d6e43621-ca4a-475f-b81c-037a0878728b",
      "modified": "2026-07-31T20:48:26.457Z",
      "references": [
        {
          "source_name": "Cymmetria Patchwork",
          "url": "https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"
        },
        {
          "source_name": "TrendMicro Patchwork Dec 2017",
          "url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d850b604-f451-4f58-aa8e-6fb2e2a307d0",
      "subject": "ATTACK:enterprise:G0131",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d850b604-f451-4f58-aa8e-6fb2e2a307d0",
      "modified": "2026-07-31T18:48:18.988Z",
      "references": [
        {
          "source_name": "ESET Exchange Mar 2021",
          "url": "https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d8ead39e-aa9f-44a7-ac5d-1a9b3bb46431",
      "subject": "ATTACK:enterprise:S0488",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d8ead39e-aa9f-44a7-ac5d-1a9b3bb46431",
      "modified": "2026-04-29T14:23:06.221Z",
      "references": [
        {
          "source_name": "CME Github September 2018",
          "url": "https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d9cd7a48-0728-4e56-9c74-45baf45cf0ff",
      "subject": "ATTACK:enterprise:G0082",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d9cd7a48-0728-4e56-9c74-45baf45cf0ff",
      "modified": "2026-09-30T18:43:57.805Z",
      "references": [
        {
          "source_name": "CISA AA20-239A BeagleBoyz August 2020",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-239a"
        },
        {
          "source_name": "Microsoft Axios Compromise APR 2026",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"
        },
        {
          "source_name": "MIcrosoft Mastra npm Compromise JUN 2026",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--da3fc762-2ac5-4ab7-8c77-6df2f06b5680",
      "subject": "ATTACK:enterprise:G0079",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--da3fc762-2ac5-4ab7-8c77-6df2f06b5680",
      "modified": "2026-07-31T20:48:37.207Z",
      "references": [
        {
          "source_name": "Unit 42 DarkHydrus July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
        },
        {
          "source_name": "Unit 42 Playbook Dec 2017",
          "url": "https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dd584826-35e3-4c6f-8186-b5f5a9ea5229",
      "subject": "ATTACK:enterprise:C0036",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dd584826-35e3-4c6f-8186-b5f5a9ea5229",
      "modified": "2026-07-31T18:47:26.642Z",
      "references": [
        {
          "source_name": "Elastic Pikabot 2024",
          "url": "https://www.elastic.co/security-labs/pikabot-i-choose-you"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dd909ab4-9160-4194-9213-7478189936e0",
      "subject": "ATTACK:enterprise:G1012",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dd909ab4-9160-4194-9213-7478189936e0",
      "modified": "2026-07-31T18:47:51.579Z",
      "references": [
        {
          "source_name": "Symantec Tortoiseshell 2019",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--deec4c70-b8b5-420b-bdc7-88badae84456",
      "subject": "ATTACK:enterprise:G0115",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--deec4c70-b8b5-420b-bdc7-88badae84456",
      "modified": "2026-07-31T20:48:46.068Z",
      "references": [
        {
          "source_name": "Tetra Defense Sodinokibi March 2020",
          "url": "https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--df7d9316-0cf4-4f20-9169-f4952478cc60",
      "subject": "ATTACK:enterprise:S0660",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--df7d9316-0cf4-4f20-9169-f4952478cc60",
      "modified": "2026-04-29T14:23:06.230Z",
      "references": [
        {
          "source_name": "Trend Micro DRBControl February 2020",
          "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e104cf3c-a802-4e06-8abc-6293cea9492f",
      "subject": "ATTACK:enterprise:G0045",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e104cf3c-a802-4e06-8abc-6293cea9492f",
      "modified": "2026-07-31T18:47:44.754Z",
      "references": [
        {
          "source_name": "PWC Cloud Hopper Technical Annex April 2017",
          "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"
        },
        {
          "source_name": "Symantec Cicada November 2020",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e2c05732-0721-4836-aa07-52f4c379b361",
      "subject": "ATTACK:enterprise:S0476",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e2c05732-0721-4836-aa07-52f4c379b361",
      "modified": "2026-04-29T14:23:06.234Z",
      "references": [
        {
          "source_name": "Cybereason Valak May 2020",
          "url": "https://www.cybereason.com/blog/valak-more-than-meets-the-eye"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e2ce90d2-7470-4f2d-a86c-f429b934ab35",
      "subject": "ATTACK:enterprise:G0033",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e2ce90d2-7470-4f2d-a86c-f429b934ab35",
      "modified": "2026-07-31T18:48:05.316Z",
      "references": [
        {
          "source_name": "Kaspersky Poseidon Group",
          "url": "https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e2e33068-b08e-45fd-89e0-0cf79868f902",
      "subject": "ATTACK:enterprise:G0038",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e2e33068-b08e-45fd-89e0-0cf79868f902",
      "modified": "2026-07-31T18:48:07.425Z",
      "references": [
        {
          "source_name": "Citizen Lab Stealth Falcon May 2016",
          "url": "https://citizenlab.org/2016/05/stealth-falcon/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e3534937-b68c-47d3-9ebd-b9fff381528c",
      "subject": "ATTACK:enterprise:S1199",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e3534937-b68c-47d3-9ebd-b9fff381528c",
      "modified": "2026-04-29T14:23:06.235Z",
      "references": [
        {
          "source_name": "Palo Alto Lockbit 2.0 JUN 2022",
          "url": "https://unit42.paloaltonetworks.com/lockbit-2-ransomware/"
        },
        {
          "source_name": "FBI Lockbit 2.0 FEB 2022",
          "url": "https://www.ic3.gov/CSA/2022/220204.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e3831a8a-1713-49d3-a464-14437d213c3e",
      "subject": "ATTACK:enterprise:S1030",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e3831a8a-1713-49d3-a464-14437d213c3e",
      "modified": "2026-04-29T14:23:06.235Z",
      "references": [
        {
          "source_name": "ZScaler Squirrelwaffle Sep 2021",
          "url": "https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"
        },
        {
          "source_name": "Netskope Squirrelwaffle Oct 2021",
          "url": "https://www.netskope.com/blog/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e3909a5f-ebfb-48e1-b0fc-5737217a994b",
      "subject": "ATTACK:enterprise:S0186",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e3909a5f-ebfb-48e1-b0fc-5737217a994b",
      "modified": "2026-04-29T14:23:06.235Z",
      "references": [
        {
          "source_name": "ClearSky Charming Kitten Dec 2017",
          "url": "http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e47397b7-b3c7-4919-ac5e-1f3266ef97e3",
      "subject": "ATTACK:enterprise:S0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e47397b7-b3c7-4919-ac5e-1f3266ef97e3",
      "modified": "2026-04-29T14:23:06.236Z",
      "references": [
        {
          "source_name": "Forcepoint Monsoon",
          "url": "https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e58abef6-2089-4f55-b5ee-9fc24378b52f",
      "subject": "ATTACK:enterprise:S0270",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e58abef6-2089-4f55-b5ee-9fc24378b52f",
      "modified": "2026-04-29T14:23:06.238Z",
      "references": [
        {
          "source_name": "Unit 42 DarkHydrus July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
        },
        {
          "source_name": "Unit42 DarkHydrus Jan 2019",
          "url": "https://unit42.paloaltonetworks.com/darkhydrus-delivers-new-trojan-that-can-use-google-drive-for-c2-communications/"
        },
        {
          "source_name": "Unit 42 DarkHydrus July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e59e3fc8-eba4-4874-9e51-7e8f88afe06b",
      "subject": "ATTACK:enterprise:C0060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e59e3fc8-eba4-4874-9e51-7e8f88afe06b",
      "modified": "2026-07-31T18:47:27.365Z",
      "references": [
        {
          "source_name": "ESET MirrorFace 2025",
          "url": "https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/"
        },
        {
          "source_name": "Trend Micro Earth Kasha Anel NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e631d85f-e93c-475f-bd40-546544c99e90",
      "subject": "ATTACK:enterprise:M1026",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e631d85f-e93c-475f-bd40-546544c99e90",
      "modified": "2026-04-29T14:23:06.238Z",
      "references": [
        {
          "source_name": "Microsoft PS JEA",
          "url": "https://learn.microsoft.com/powershell/scripting/learn/remoting/jea/overview?view=powershell-7.3"
        },
        {
          "source_name": "Netspi PowerShell Execution Policy Bypass",
          "url": "https://www.netspi.com/blog/technical-blog/network-penetration-testing/15-ways-to-bypass-the-powershell-execution-policy/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e68bec53-4592-4d15-a573-086e10cbef12",
      "subject": "ATTACK:enterprise:S1193",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e68bec53-4592-4d15-a573-086e10cbef12",
      "modified": "2026-04-29T14:23:06.239Z",
      "references": [
        {
          "source_name": "Mandiant APT42-untangling",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e7a0b7a4-b49b-46b9-9bfa-5db0a87dd09e",
      "subject": "ATTACK:enterprise:S0053",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e7a0b7a4-b49b-46b9-9bfa-5db0a87dd09e",
      "modified": "2026-06-13T16:00:25.983Z",
      "references": [
        {
          "source_name": "Symantec Seaduke 2015",
          "url": "https://web.archive.org/web/20150717011546/http://www.symantec.com/connect/blogs/forkmeiamfamous-seaduke-latest-weapon-duke-armory"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e7df8e8c-dfc4-48f2-bbd3-46b2572d60ca",
      "subject": "ATTACK:enterprise:S0194",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e7df8e8c-dfc4-48f2-bbd3-46b2572d60ca",
      "modified": "2026-04-29T14:23:06.241Z",
      "references": [
        {
          "source_name": "GitHub PowerSploit May 2012",
          "url": "https://github.com/PowerShellMafia/PowerSploit"
        },
        {
          "source_name": "PowerSploit Documentation",
          "url": "http://powersploit.readthedocs.io"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e8a77e9f-594d-429a-9eb0-51502af84c14",
      "subject": "ATTACK:enterprise:G0069",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e8a77e9f-594d-429a-9eb0-51502af84c14",
      "modified": "2026-07-31T20:48:30.259Z",
      "references": [
        {
          "source_name": "Talos MuddyWater May 2019",
          "url": "https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html"
        },
        {
          "source_name": "ClearSky MuddyWater Nov 2018",
          "url": "https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"
        },
        {
          "source_name": "DHS CISA AA22-055A MuddyWater February 2022",
          "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
        },
        {
          "source_name": "Securelist MuddyWater Oct 2018",
          "url": "https://securelist.com/muddywater/88059/"
        },
        {
          "source_name": "Talos MuddyWater Jan 2022",
          "url": "https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"
        },
        {
          "source_name": "NaumaanProofpoint_GlobalClickFix_April2025",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"
        },
        {
          "source_name": "Trend Micro Muddy Water March 2021",
          "url": "https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
        },
        {
          "source_name": "Reaqta MuddyWater November 2017",
          "url": "https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"
        },
        {
          "source_name": "FireEye MuddyWater Mar 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"
        },
        {
          "source_name": "Symantec MuddyWater Dec 2018",
          "url": "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
        },
        {
          "source_name": "MuddyWater TrendMicro June 2018",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/another-potential-muddywater-campaign-uses-powershell-based-prb-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ecc9a971-349b-428d-a376-74f11b5b7086",
      "subject": "ATTACK:enterprise:G0117",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ecc9a971-349b-428d-a376-74f11b5b7086",
      "modified": "2026-07-31T18:48:17.886Z",
      "references": [
        {
          "source_name": "CISA AA20-259A Iran-Based Actor September 2020",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-259a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ed25d74a-2536-4ffe-9dc4-b6ea8ae03b19",
      "subject": "ATTACK:enterprise:G1021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ed25d74a-2536-4ffe-9dc4-b6ea8ae03b19",
      "modified": "2026-07-31T18:48:08.099Z",
      "references": [
        {
          "source_name": "Sygnia Emperor Dragonfly October 2022",
          "url": "https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ed91791b-8e5a-4e0c-b77c-6fad78be7378",
      "subject": "ATTACK:enterprise:S0241",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ed91791b-8e5a-4e0c-b77c-6fad78be7378",
      "modified": "2026-04-29T14:23:06.248Z",
      "references": [
        {
          "source_name": "Lazarus RATANKBA",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/"
        },
        {
          "source_name": "RATANKBA",
          "url": "https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--eddcfbbf-9e82-4029-87fe-bf0f6bea0ba9",
      "subject": "ATTACK:enterprise:S0554",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--eddcfbbf-9e82-4029-87fe-bf0f6bea0ba9",
      "modified": "2026-04-29T14:23:06.249Z",
      "references": [
        {
          "source_name": "Intrinsec Egregor Nov 2020",
          "url": "https://www.intrinsec.com/egregor-prolock/?cn-reloaded=1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ee73acc3-a506-41a2-b7b9-e5aa9b68342b",
      "subject": "ATTACK:enterprise:S0352",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ee73acc3-a506-41a2-b7b9-e5aa9b68342b",
      "modified": "2026-04-29T14:23:06.250Z",
      "references": [
        {
          "source_name": "TrendMicro MacOS April 2018",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ee9a7f72-eac2-4ca4-b82a-5c5a50618d0d",
      "subject": "ATTACK:enterprise:S0677",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ee9a7f72-eac2-4ca4-b82a-5c5a50618d0d",
      "modified": "2026-04-29T14:23:06.250Z",
      "references": [
        {
          "source_name": "AADInternals Documentation",
          "url": "https://o365blog.com/aadinternals"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--efb8b96b-7f50-4152-b18c-bbec7de28cbb",
      "subject": "ATTACK:enterprise:S1085",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--efb8b96b-7f50-4152-b18c-bbec7de28cbb",
      "modified": "2026-04-29T14:23:06.251Z",
      "references": [
        {
          "source_name": "Bitdefender Sardonic Aug 2021",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f24cbdeb-cf7b-43d9-87b0-9ab10ba74b60",
      "subject": "ATTACK:enterprise:G0035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f24cbdeb-cf7b-43d9-87b0-9ab10ba74b60",
      "modified": "2026-07-31T20:48:28.775Z",
      "references": [
        {
          "source_name": "US-CERT TA18-074A",
          "url": "https://www.us-cert.gov/ncas/alerts/TA18-074A"
        },
        {
          "source_name": "Symantec Dragonfly Sept 2017",
          "url": "https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f31ff00d-794c-41ef-ab92-65bf7ff25169",
      "subject": "ATTACK:enterprise:G1035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f31ff00d-794c-41ef-ab92-65bf7ff25169",
      "modified": "2026-07-31T18:48:03.356Z",
      "references": [
        {
          "source_name": "CERT-UA WinterVivern 2023",
          "url": "https://cert.gov.ua/article/3761104"
        },
        {
          "source_name": "DomainTools WinterVivern 2021",
          "url": "https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f4315d71-e2aa-4039-acfa-c7737b1e8c86",
      "subject": "ATTACK:enterprise:S0417",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f4315d71-e2aa-4039-acfa-c7737b1e8c86",
      "modified": "2026-04-29T14:23:06.257Z",
      "references": [
        {
          "source_name": "SecureList Griffon May 2019",
          "url": "https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f4801ea0-dbc1-482d-93ef-be3808d41cca",
      "subject": "ATTACK:enterprise:S1173",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f4801ea0-dbc1-482d-93ef-be3808d41cca",
      "modified": "2026-04-29T14:23:06.257Z",
      "references": [
        {
          "source_name": "Symantec Crambus OCT 2023",
          "url": "https://www.security.com/threat-intelligence/crambus-middle-east-government"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f57dc789-e35e-4336-8935-9e1b7eca0324",
      "subject": "ATTACK:enterprise:G0143",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f57dc789-e35e-4336-8935-9e1b7eca0324",
      "modified": "2026-07-31T18:47:59.667Z",
      "references": [
        {
          "source_name": "CrowdStrike AQUATIC PANDA December 2021",
          "url": "https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f5fcb813-4522-4846-8176-b630847269d9",
      "subject": "ATTACK:enterprise:S1086",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f5fcb813-4522-4846-8176-b630847269d9",
      "modified": "2026-04-29T14:23:06.259Z",
      "references": [
        {
          "source_name": "Telefonica Snip3 December 2021",
          "url": "https://telefonicatech.com/blog/snip3-investigacion-malware"
        },
        {
          "source_name": "Morphisec Snip3 May 2021",
          "url": "https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f6d0705a-e4a5-4aae-a8a3-b1c2b7287469",
      "subject": "ATTACK:enterprise:S0360",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f6d0705a-e4a5-4aae-a8a3-b1c2b7287469",
      "modified": "2026-04-29T14:23:06.260Z",
      "references": [
        {
          "source_name": "FireEye APT34 Dec 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
        },
        {
          "source_name": "Palo Alto OilRig Sep 2018",
          "url": "https://unit42.paloaltonetworks.com/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f6f5d688-5f78-492f-aed9-12f299b4f6f5",
      "subject": "ATTACK:enterprise:S0390",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f6f5d688-5f78-492f-aed9-12f299b4f6f5",
      "modified": "2026-04-29T14:23:06.261Z",
      "references": [
        {
          "source_name": "Flashpoint FIN 7 March 2019",
          "url": "https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f739246f-dd47-44bf-ae15-74fd7a053c7a",
      "subject": "ATTACK:enterprise:G0142",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f739246f-dd47-44bf-ae15-74fd7a053c7a",
      "modified": "2026-07-31T20:48:37.681Z",
      "references": [
        {
          "source_name": "TrendMicro Confucius APT Aug 2021",
          "url": "https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f9dadb46-4517-4b5c-897a-20628a9b3e98",
      "subject": "ATTACK:enterprise:S1242",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f9dadb46-4517-4b5c-897a-20628a9b3e98",
      "modified": "2026-04-29T14:23:06.264Z",
      "references": [
        {
          "source_name": "Picus Qilin MAR 2025",
          "url": "https://www.picussecurity.com/resource/blog/qilin-ransomware"
        },
        {
          "source_name": "Cisco Talos Qilin Ransomware OCT 2025",
          "url": "https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"
        },
        {
          "source_name": "BushidoToken Qilin RaaS JUN 2024",
          "url": "https://blog.bushidotoken.net/2024/06/tracking-adversaries-qilin-raas.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fc9d110c-be6f-4976-90f9-1efde4a668e5",
      "subject": "ATTACK:enterprise:G0133",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fc9d110c-be6f-4976-90f9-1efde4a668e5",
      "modified": "2026-07-31T18:48:31.190Z",
      "references": [
        {
          "source_name": "ESET Nomadic Octopus 2018",
          "url": "https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fd99bb5e-8c96-4213-9ccd-ee21777cb9fa",
      "subject": "ATTACK:enterprise:G1059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fd99bb5e-8c96-4213-9ccd-ee21777cb9fa",
      "modified": "2026-10-01T21:00:12.469Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549TTPsTools_Nov2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fda5d0ef-e6ee-4331-a201-5379a981259a",
      "subject": "ATTACK:enterprise:G0099",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fda5d0ef-e6ee-4331-a201-5379a981259a",
      "modified": "2026-07-31T18:48:18.929Z",
      "references": [
        {
          "source_name": "Kaspersky BlindEagle AUG 2024",
          "url": "https://securelist.com/blindeagle-apt/113414/"
        },
        {
          "source_name": "Zscaler BlindEagle DEC 2025",
          "url": "https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fe3cefac-f51b-4bac-b6e1-c4bba1f090a8",
      "subject": "ATTACK:enterprise:S0648",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fe3cefac-f51b-4bac-b6e1-c4bba1f090a8",
      "modified": "2026-04-29T14:23:06.270Z",
      "references": [
        {
          "source_name": "CrowdStrike Carbon Spider August 2021",
          "url": "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fe42b5e6-06dd-4b08-8ef8-31323f8190d2",
      "subject": "ATTACK:enterprise:M1038",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fe42b5e6-06dd-4b08-8ef8-31323f8190d2",
      "modified": "2026-04-29T14:23:06.270Z",
      "references": [
        {
          "source_name": "Microsoft PowerShell CLM",
          "url": "https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--feab3f45-2303-48e5-83b5-b8bb8e044300",
      "subject": "ATTACK:enterprise:S1245",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1059.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--feab3f45-2303-48e5-83b5-b8bb8e044300",
      "modified": "2026-04-29T14:23:06.271Z",
      "references": [
        {
          "source_name": "ESET Contagious Interview BeaverTail InvisibleFerret February 2025",
          "url": "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    }
  ],
  "source_snapshot": {
    "file": "enterprise-attack-20.0.json",
    "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
    "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352",
    "bytes": 55271014,
    "checked_at": "2026-10-16T03:31:39Z"
  },
  "notices_url": "https://aol.pm/source-notices.txt",
  "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"
}

License
-------
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,
development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce
MITRE's copyright designation and this license in any such copy.

"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

Disclaimers
-----------
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part
of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover
full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or
variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE
ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,
AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE.