{"record":{"id":"ATTACK:enterprise:T1059.007","title":"JavaScript","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1059/007","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d","external_id":"T1059.007","domain":"enterprise","created":"2020-06-23T19:12:24.924Z","modified":"2026-05-12T15:12:00.620Z","version":"2.2","aliases":[],"tactics":["execution"],"source_references":[{"source_name":"Apple About Mac Scripting 2016","url":"https://developer.apple.com/library/archive/documentation/LanguagesUtilities/Conceptual/MacAutomationScriptingGuide/index.html"},{"source_name":"MDSec macOS JXA and VSCode","url":"https://www.mdsec.co.uk/2021/01/macos-post-exploitation-shenanigans-with-vscode-extensions/"},{"source_name":"Microsoft JScript 2007","url":"https://docs.microsoft.com/archive/blogs/gauravseth/the-world-of-jscript-javascript-ecmascript"},{"source_name":"Microsoft Windows Scripts","url":"https://docs.microsoft.com/scripting/winscript/windows-script-interfaces"},{"source_name":"JScrip May 2018","url":"https://docs.microsoft.com/windows/win32/com/translating-to-jscript"},{"source_name":"NodeJS","url":"https://nodejs.org/"},{"source_name":"SentinelOne macOS Red Team","url":"https://www.sentinelone.com/blog/macos-red-team-calling-apple-apis-without-building-binaries/"},{"source_name":"SpecterOps JXA 2020","url":"https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5"},{"source_name":"Red Canary Silver Sparrow Feb2021","url":"https://redcanary.com/blog/clipping-silver-sparrows-wings/"}]},"assertions":[{"id":"enterprise:relationship--063c1ea3-13a7-492c-8934-31886fbbecd8","subject":"ATTACK:enterprise:S9041","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--063c1ea3-13a7-492c-8934-31886fbbecd8","modified":"2026-07-15T19:58:53.322Z","references":[{"source_name":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--06a82ed9-c3c3-412a-98f7-838442f4e1cc","subject":"ATTACK:enterprise:S0622","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--06a82ed9-c3c3-412a-98f7-838442f4e1cc","modified":"2026-04-29T14:23:05.912Z","references":[{"source_name":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--072552be-9c74-4ee8-972c-46454a2c78c0","subject":"ATTACK:enterprise:S0154","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--072552be-9c74-4ee8-972c-46454a2c78c0","modified":"2026-04-29T14:23:05.913Z","references":[{"source_name":"Talos Cobalt Strike September 2020","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--07f72efd-7960-4530-92f3-6ced33087212","subject":"ATTACK:enterprise:S0455","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--07f72efd-7960-4530-92f3-6ced33087212","modified":"2026-04-29T14:23:05.914Z","references":[{"source_name":"Medium Metamorfo Apr 2020","url":"https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0bdac0c4-3faa-429c-9945-a5e3763bee23","subject":"ATTACK:enterprise:S1246","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0bdac0c4-3faa-429c-9945-a5e3763bee23","modified":"2026-04-29T14:23:05.919Z","references":[{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source_name":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0c4e4578-3bb1-4c9a-9dc8-af3b7368ada9","subject":"ATTACK:enterprise:G0010","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0c4e4578-3bb1-4c9a-9dc8-af3b7368ada9","modified":"2026-07-31T18:48:03.554Z","references":[{"source_name":"ESET Turla Mosquito Jan 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0eed880c-738f-4654-b6c2-fdc2362520e9","subject":"ATTACK:enterprise:S1144","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0eed880c-738f-4654-b6c2-fdc2362520e9","modified":"2026-04-29T14:23:05.924Z","references":[{"source_name":"FRP GitHub","url":"https://github.com/fatedier/frp"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--18771b0e-2d4b-4f76-ae1e-9cdac1c77cd0","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--18771b0e-2d4b-4f76-ae1e-9cdac1c77cd0","modified":"2026-07-31T18:47:43.917Z","references":[{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"},{"source_name":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1884086e-4ea7-4e8d-b81a-14471eab6ee5","subject":"ATTACK:enterprise:G1031","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1884086e-4ea7-4e8d-b81a-14471eab6ee5","modified":"2026-07-31T18:48:00.270Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e95c694-902e-4d6c-b5bd-17888e426d55","subject":"ATTACK:enterprise:S9003","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e95c694-902e-4d6c-b5bd-17888e426d55","modified":"2026-04-29T14:23:05.946Z","references":[{"source_name":"Breakdev Evilginx 2.3 JAN 2019","url":"https://breakdev.org/evilginx-2-3-phishermans-dream/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2a94575a-8e47-4d69-964b-f96210a673bd","subject":"ATTACK:enterprise:S0228","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2a94575a-8e47-4d69-964b-f96210a673bd","modified":"2026-04-29T14:23:05.962Z","references":[{"source_name":"fsecure NanHaiShu July 2016","url":"https://www.f-secure.com/documents/996508/1030745/nanhaishu_whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3086bfc5-96b1-4768-a243-a82da7155728","subject":"ATTACK:enterprise:M1040","predicate":"mitigates","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3086bfc5-96b1-4768-a243-a82da7155728","modified":"2026-04-29T14:23:05.977Z","references":[{"source_name":"win10_asr","url":"https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--31221040-295a-437a-ac4a-d85e0b5d9122","subject":"ATTACK:enterprise:G0037","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--31221040-295a-437a-ac4a-d85e0b5d9122","modified":"2026-07-31T20:48:30.814Z","references":[{"source_name":"Trend Micro FIN6 October 2019","url":"https://www.trendmicro.com/en_us/research/19/j/fin6-compromised-e-commerce-platform-via-magecart-to-inject-credit-card-skimmers-into-thousands-of-online-shops.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--326d0ed6-35a6-452e-a8a2-ab2a7e034faa","subject":"ATTACK:enterprise:G0121","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--326d0ed6-35a6-452e-a8a2-ab2a7e034faa","modified":"2026-07-31T18:47:51.795Z","references":[{"source_name":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source_name":"Rewterz Sidewinder COVID-19 June 2020","url":"https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3281ad27-8a05-4389-9438-f0ffce776346","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3281ad27-8a05-4389-9438-f0ffce776346","modified":"2026-04-29T14:23:05.985Z","references":[{"source_name":"Trend Micro Black Basta October 2022","url":"https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"},{"source_name":"Kaspersky QakBot September 2021","url":"https://securelist.com/qakbot-technical-analysis/103931/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--32c5ae14-5e74-4bb8-8d31-3dcef1391381","subject":"ATTACK:enterprise:S1180","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--32c5ae14-5e74-4bb8-8d31-3dcef1391381","modified":"2026-04-29T14:23:05.985Z","references":[{"source_name":"Trustwave BlackByte 2021","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--396056dc-8657-418c-9c7a-4468878af204","subject":"ATTACK:enterprise:G1019","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--396056dc-8657-418c-9c7a-4468878af204","modified":"2026-07-31T20:48:38.792Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f21f508-5f35-4d99-a133-8abbf02cf6d5","subject":"ATTACK:enterprise:G0099","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f21f508-5f35-4d99-a133-8abbf02cf6d5","modified":"2026-07-31T18:48:18.421Z","references":[{"source_name":"Zscaler BlindEagle DEC 2025","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4142d0fd-6c96-417f-8725-17eabf444854","subject":"ATTACK:enterprise:S0640","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4142d0fd-6c96-417f-8725-17eabf444854","modified":"2026-04-29T14:23:06.014Z","references":[{"source_name":"Hornet Security Avaddon June 2020","url":"https://www.hornetsecurity.com/en/security-information/avaddon-from-seeking-affiliates-to-in-the-wild-in-2-days/"},{"source_name":"Awake Security Avaddon","url":"https://awakesecurity.com/blog/threat-hunting-for-avaddon-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--435c288d-1e10-4610-bf41-531390e5a650","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--435c288d-1e10-4610-bf41-531390e5a650","modified":"2026-07-31T20:48:29.792Z","references":[{"source_name":"ClearSky MuddyWater Nov 2018","url":"https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"},{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"},{"source_name":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4504384f-f832-4ec2-87b0-b8dfc2208083","subject":"ATTACK:enterprise:G1006","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4504384f-f832-4ec2-87b0-b8dfc2208083","modified":"2026-07-31T20:48:48.173Z","references":[{"source_name":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4677c432-d537-4d61-bc25-efe1b608c378","subject":"ATTACK:enterprise:G1057","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4677c432-d537-4d61-bc25-efe1b608c378","modified":"2026-07-31T18:47:58.722Z","references":[{"source_name":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--48f75458-3c14-4ffe-9950-97d6bff16822","subject":"ATTACK:enterprise:S1183","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--48f75458-3c14-4ffe-9950-97d6bff16822","modified":"2026-04-29T14:23:06.025Z","references":[{"source_name":"PaloAlto StrelaStealer 2024","url":"https://unit42.paloaltonetworks.com/strelastealer-campaign/"},{"source_name":"Fortgale StrelaStealer 2023","url":"https://fortgale.com/blog/malware-analysis/strelastealer-malware-analysis-2/"},{"source_name":"IBM StrelaStealer 2024","url":"https://securityintelligence.com/x-force/strela-stealer-todays-invoice-tomorrows-phish/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5853af0d-4716-4290-b3d9-63fadfd5f554","subject":"ATTACK:enterprise:M1038","predicate":"mitigates","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5853af0d-4716-4290-b3d9-63fadfd5f554","modified":"2026-04-29T14:23:06.046Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--58801cab-349a-4f09-b449-149b19bcf085","subject":"ATTACK:enterprise:S0417","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--58801cab-349a-4f09-b449-149b19bcf085","modified":"2026-04-29T14:23:06.046Z","references":[{"source_name":"SecureList Griffon May 2019","url":"https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5cd34b85-c6bf-48e7-8cad-3dd2147cca47","subject":"ATTACK:enterprise:G1037","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5cd34b85-c6bf-48e7-8cad-3dd2147cca47","modified":"2026-07-31T18:47:38.682Z","references":[{"source_name":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5d5fa465-7221-4ba5-9c39-9c51e9e102db","subject":"ATTACK:enterprise:G1035","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5d5fa465-7221-4ba5-9c39-9c51e9e102db","modified":"2026-07-31T18:48:03.088Z","references":[{"source_name":"ESET WinterVivern 2023","url":"https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--60989b47-4725-4077-8aed-fb5f990fda22","subject":"ATTACK:enterprise:G0091","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--60989b47-4725-4077-8aed-fb5f990fda22","modified":"2026-07-31T18:48:21.155Z","references":[{"source_name":"Cyber Forensicator Silence Jan 2019","url":"https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--612c45b3-a705-4d6d-90f3-1406964df217","subject":"ATTACK:enterprise:G1052","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--612c45b3-a705-4d6d-90f3-1406964df217","modified":"2026-07-31T18:47:54.609Z","references":[{"source_name":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--65dfb984-a7b3-4da0-90d0-20d61eb0e828","subject":"ATTACK:enterprise:S1249","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--65dfb984-a7b3-4da0-90d0-20d61eb0e828","modified":"2026-04-29T14:23:06.063Z","references":[{"source_name":"Socket Contagious Interview NPM April 2025","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"},{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--67d072c0-3439-4a61-9a67-fb3f2b72d04e","subject":"ATTACK:enterprise:G0140","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--67d072c0-3439-4a61-9a67-fb3f2b72d04e","modified":"2026-07-31T18:48:13.322Z","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--69772984-96a1-47f1-ac27-08f85ff492e2","subject":"ATTACK:enterprise:S1124","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--69772984-96a1-47f1-ac27-08f85ff492e2","modified":"2026-04-29T14:23:06.069Z","references":[{"source_name":"SocGholish-update","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"},{"source_name":"SentinelOne SocGholish Infrastructure November 2022","url":"https://www.sentinelone.com/labs/socgholish-diversifies-and-expands-its-malware-staging-infrastructure-to-counter-defenders/"},{"source_name":"Red Canary SocGholish March 2024","url":"https://redcanary.com/threat-detection-report/threats/socgholish/"},{"source_name":"Secureworks Gold Prelude Profile","url":"https://www.secureworks.com/research/threat-profiles/gold-prelude"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6b58b7e3-4588-45a6-9ff4-7f6ead315ac5","subject":"ATTACK:enterprise:S0634","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6b58b7e3-4588-45a6-9ff4-7f6ead315ac5","modified":"2026-04-29T14:23:06.071Z","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6be48603-8603-45dd-8423-294169ca45a6","subject":"ATTACK:enterprise:S0476","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6be48603-8603-45dd-8423-294169ca45a6","modified":"2026-04-29T14:23:06.072Z","references":[{"source_name":"Cybereason Valak May 2020","url":"https://www.cybereason.com/blog/valak-more-than-meets-the-eye"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6d5e93c2-073a-4974-a25f-c5a805780a45","subject":"ATTACK:enterprise:S1160","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6d5e93c2-073a-4974-a25f-c5a805780a45","modified":"2026-04-29T14:23:06.074Z","references":[{"source_name":"Bitsight Latrodectus June 2024","url":"https://www.bitsight.com/blog/latrodectus-are-you-coming-back"},{"source_name":"Elastic Latrodectus May 2024","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"},{"source_name":"Palo Alto Latrodectus Activity June 2024","url":"https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2024-06-25-IOCs-from-Latrodectus-activity.txt"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6f57b4eb-ba87-4755-9b96-3715e1da1de1","subject":"ATTACK:enterprise:G0092","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6f57b4eb-ba87-4755-9b96-3715e1da1de1","modified":"2026-07-31T18:48:05.558Z","references":[{"source_name":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"},{"source_name":"Proofpoint TA505 June 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7105dbb9-fcb2-41f7-a740-a19d539758fb","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7105dbb9-fcb2-41f7-a740-a19d539758fb","modified":"2026-04-29T14:23:06.079Z","references":[{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--71ec5140-320c-452c-8512-6a787af027c8","subject":"ATTACK:enterprise:S0373","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--71ec5140-320c-452c-8512-6a787af027c8","modified":"2026-04-29T14:23:06.081Z","references":[{"source_name":"Cofense Astaroth Sept 2018","url":"https://web.archive.org/web/20200302071436/https://cofense.com/seeing-resurgence-demonic-astaroth-wmic-trojan/"},{"source_name":"Securelist Brazilian Banking Malware July 2020","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--72b1c4ab-81ca-47a4-a541-ceb44580c87b","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--72b1c4ab-81ca-47a4-a541-ceb44580c87b","modified":"2026-07-31T20:48:31.988Z","references":[{"source_name":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"},{"source_name":"Flashpoint FIN 7 March 2019","url":"https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7667e829-3602-410b-b3ea-614ed8d55607","subject":"ATTACK:enterprise:S0648","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7667e829-3602-410b-b3ea-614ed8d55607","modified":"2026-04-29T14:23:06.087Z","references":[{"source_name":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--80516f0f-53de-4058-9ae5-d426adb9e99e","subject":"ATTACK:enterprise:C0017","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--80516f0f-53de-4058-9ae5-d426adb9e99e","modified":"2026-07-31T21:12:31.668Z","references":[{"source_name":"Mandiant APT41","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8426ec50-0d64-47c9-979a-109510ba8265","subject":"ATTACK:enterprise:S1116","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8426ec50-0d64-47c9-979a-109510ba8265","modified":"2026-04-29T14:23:06.106Z","references":[{"source_name":"Mandiant Cutting Edge January 2024","url":"https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--87a6c355-530c-4c68-a435-f83565000e95","subject":"ATTACK:enterprise:S9034","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--87a6c355-530c-4c68-a435-f83565000e95","modified":"2026-04-29T14:23:06.110Z","references":[{"source_name":"SecureListUbiedo_Tsundere_Nov2025","url":"https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8be670ce-f8bd-4f67-9f84-3e278235325a","subject":"ATTACK:enterprise:S0695","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8be670ce-f8bd-4f67-9f84-3e278235325a","modified":"2026-04-29T14:23:06.116Z","references":[{"source_name":"Donut Github","url":"https://github.com/TheWover/donut"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8dd45f3b-a005-40b3-a6ef-c1ef208e8504","subject":"ATTACK:enterprise:S0341","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8dd45f3b-a005-40b3-a6ef-c1ef208e8504","modified":"2026-04-29T14:23:06.118Z","references":[{"source_name":"Unit42 Xbash Sept 2018","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8e8bebc7-14ff-4c84-a2a4-472446c5897a","subject":"ATTACK:enterprise:G0080","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8e8bebc7-14ff-4c84-a2a4-472446c5897a","modified":"2026-07-31T18:48:23.193Z","references":[{"source_name":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source_name":"PTSecurity Cobalt Group Aug 2017","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"},{"source_name":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"},{"source_name":"Morphisec Cobalt Gang Oct 2018","url":"https://blog.morphisec.com/cobalt-gang-2.0"},{"source_name":"Unit 42 Cobalt Gang Oct 2018","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"},{"source_name":"TrendMicro Cobalt Group Nov 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8ef60c8b-f178-4b78-b5c4-76747e075d84","subject":"ATTACK:enterprise:G0126","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8ef60c8b-f178-4b78-b5c4-76747e075d84","modified":"2026-07-31T18:47:56.690Z","references":[{"source_name":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source_name":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"},{"source_name":"PTSecurity Higaisa 2020","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--96e1c86d-f92e-4443-a674-2e6f8078e8b9","subject":"ATTACK:enterprise:G1056","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--96e1c86d-f92e-4443-a674-2e6f8078e8b9","modified":"2026-09-02T17:31:49.022Z","references":[{"source_name":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"},{"source_name":"Trend Micro TeamPCP MAY 2026","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--98b90b49-f152-4eb5-8bb7-3b6c68bf9646","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--98b90b49-f152-4eb5-8bb7-3b6c68bf9646","modified":"2026-07-31T20:48:25.246Z","references":[{"source_name":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source_name":"VirusBulletin Kimsuky October 2019","url":"https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/"},{"source_name":"Zscaler Kimsuky TRANSLATEXT","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a22f6aff-ffbc-49f1-9f39-a52cafca2ed3","subject":"ATTACK:enterprise:S9062","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a22f6aff-ffbc-49f1-9f39-a52cafca2ed3","modified":"2026-10-01T13:52:05.681Z","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a28ed204-7e5c-4090-a0c5-0a056ef602fe","subject":"ATTACK:enterprise:S0283","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a28ed204-7e5c-4090-a0c5-0a056ef602fe","modified":"2026-04-29T14:23:06.146Z","references":[{"source_name":"Kaspersky Adwind Feb 2016","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a2eb983e-f4ad-45a3-9348-088bbfdbab77","subject":"ATTACK:enterprise:M1042","predicate":"mitigates","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a2eb983e-f4ad-45a3-9348-088bbfdbab77","modified":"2026-04-29T14:23:06.147Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a322f31a-42e0-4314-9ea0-9e04037dc5ce","subject":"ATTACK:enterprise:S1138","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a322f31a-42e0-4314-9ea0-9e04037dc5ce","modified":"2026-04-29T14:23:06.147Z","references":[{"source_name":"SentinelOne Gootloader June 2021","url":"https://www.sentinelone.com/labs/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets/"},{"source_name":"Sophos Gootloader","url":"https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a5db1eaf-094d-498f-b7bd-3701025a2987","subject":"ATTACK:enterprise:S9031","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a5db1eaf-094d-498f-b7bd-3701025a2987","modified":"2026-04-29T14:23:06.151Z","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a7c7be1a-68a4-408b-94c8-3bbebeed618d","subject":"ATTACK:enterprise:S9010","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a7c7be1a-68a4-408b-94c8-3bbebeed618d","modified":"2026-04-29T14:23:06.154Z","references":[{"source_name":"Koi Glassworm New Tricks December 2025","url":"https://www.koi.ai/blog/glassworm-goes-mac-fresh-infrastructure-new-tricks"},{"source_name":"Koi Glassworm Extensions November 2025","url":"https://www.koi.ai/blog/glassworm-returns-new-wave-openvsx-malware-expose-attacker-infrastructure"},{"source_name":"Koi Glassworm InvisibleCode October 2025","url":"https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace"},{"source_name":"Aikido GlassWorm October 2025","url":"https://www.aikido.dev/blog/the-return-of-the-invisible-threat-hidden-pua-unicode-hits-github-repositorties"},{"source_name":"Socket GlassWorm January 2026","url":"https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ab55f99b-5239-4aea-93f7-e1002520bf05","subject":"ATTACK:enterprise:S0646","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ab55f99b-5239-4aea-93f7-e1002520bf05","modified":"2026-04-29T14:23:06.158Z","references":[{"source_name":"Secureworks GOLD KINGSWOOD September 2018","url":"https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--adc39d51-e21b-488c-bdc8-a97b1524ffac","subject":"ATTACK:enterprise:C0037","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--adc39d51-e21b-488c-bdc8-a97b1524ffac","modified":"2026-07-31T18:47:23.478Z","references":[{"source_name":"TrendMicro Pikabot 2024","url":"https://www.trendmicro.com/en_us/research/24/a/a-look-into-pikabot-spam-wave-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b432bca9-8f75-431d-b0af-f43623e287d4","subject":"ATTACK:enterprise:M1021","predicate":"mitigates","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b432bca9-8f75-431d-b0af-f43623e287d4","modified":"2026-04-29T14:23:06.171Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b476cf81-9f9c-40bf-ac58-aa0df0af3b4e","subject":"ATTACK:enterprise:G1059","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b476cf81-9f9c-40bf-ac58-aa0df0af3b4e","modified":"2026-10-01T19:06:08.289Z","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b8fbce12-deae-4655-ac96-e23ebbeef624","subject":"ATTACK:enterprise:G0119","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b8fbce12-deae-4655-ac96-e23ebbeef624","modified":"2026-07-31T18:47:35.917Z","references":[{"source_name":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c25ab527-d86f-4146-898c-03e9dc121321","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c25ab527-d86f-4146-898c-03e9dc121321","modified":"2026-09-30T19:10:33.150Z","references":[{"source_name":"Microsoft Axios Compromise APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"},{"source_name":"MIcrosoft Mastra npm Compromise JUN 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c281bef6-624b-45c9-882d-ce05d4c05a50","subject":"ATTACK:enterprise:C0036","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c281bef6-624b-45c9-882d-ce05d4c05a50","modified":"2026-07-31T18:47:26.615Z","references":[{"source_name":"Elastic Pikabot 2024","url":"https://www.elastic.co/security-labs/pikabot-i-choose-you"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cb36459a-d37c-424f-8130-55cf8d29417e","subject":"ATTACK:enterprise:S0223","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cb36459a-d37c-424f-8130-55cf8d29417e","modified":"2026-04-29T14:23:06.203Z","references":[{"source_name":"ClearSky MuddyWater Nov 2018","url":"https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cbba2f85-d5f4-4306-a219-5eea6c59dbb6","subject":"ATTACK:enterprise:G0021","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cbba2f85-d5f4-4306-a219-5eea6c59dbb6","modified":"2026-07-31T18:48:23.865Z","references":[{"source_name":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ccc14a82-43bc-4eea-b19f-95aba6bdb5e6","subject":"ATTACK:enterprise:S0631","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ccc14a82-43bc-4eea-b19f-95aba6bdb5e6","modified":"2026-04-29T14:23:06.205Z","references":[{"source_name":"Cybereason Chaes Nov 2020","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cd45bd64-3793-49e7-82d0-9cdabf417d61","subject":"ATTACK:enterprise:G0077","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cd45bd64-3793-49e7-82d0-9cdabf417d61","modified":"2026-07-31T18:47:49.333Z","references":[{"source_name":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cea08e8e-2209-4d29-bc76-722091344259","subject":"ATTACK:enterprise:C0016","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cea08e8e-2209-4d29-bc76-722091344259","modified":"2026-07-31T20:48:14.860Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cfb02b3d-c902-480f-a579-06ac4ba0c5a4","subject":"ATTACK:enterprise:S9044","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cfb02b3d-c902-480f-a579-06ac4ba0c5a4","modified":"2026-07-31T02:57:02.370Z","references":[{"source_name":"Artic Wolf Labs Kali365 Device Code April 2026","url":"https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/"},{"source_name":"Artic Wolf Kali365 Device Code OAuth June 2026","url":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/"},{"source_name":"Huntress Kali365 Device Code June 2026","url":"https://www.huntress.com/blog/kali365-device-code-phishing-kit"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cfe7f665-9597-49e5-9d2e-73058147e676","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cfe7f665-9597-49e5-9d2e-73058147e676","modified":"2026-07-31T18:47:53.394Z","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d70ae3e8-39e2-4835-9ba6-56dee8d028fc","subject":"ATTACK:enterprise:S0482","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d70ae3e8-39e2-4835-9ba6-56dee8d028fc","modified":"2026-04-29T14:23:06.219Z","references":[{"source_name":"MacKeeper Bundlore Apr 2019","url":"https://mackeeper.com/blog/post/610-macos-bundlore-adware-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--db30a603-c3c5-4ee5-9aaf-687f21311006","subject":"ATTACK:enterprise:S9042","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--db30a603-c3c5-4ee5-9aaf-687f21311006","modified":"2026-07-27T20:31:37.251Z","references":[{"source_name":"Aikido TeamPCP Trivy MAR 2026","url":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e81d7554-faad-40a2-99dd-75183efa712c","subject":"ATTACK:enterprise:G1038","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e81d7554-faad-40a2-99dd-75183efa712c","modified":"2026-07-31T18:48:12.391Z","references":[{"source_name":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea3b16db-6b34-4171-9dec-7ce618f49dee","subject":"ATTACK:enterprise:G0120","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea3b16db-6b34-4171-9dec-7ce618f49dee","modified":"2026-07-31T18:47:42.588Z","references":[{"source_name":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eb17d12e-721b-4ebb-a4ff-8fe62a3189ca","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eb17d12e-721b-4ebb-a4ff-8fe62a3189ca","modified":"2026-04-29T14:23:06.245Z","references":[{"source_name":"Malwarebytes Konni Aug 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eb2b318e-2968-485e-8459-1b40c74baf83","subject":"ATTACK:enterprise:C0015","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eb2b318e-2968-485e-8459-1b40c74baf83","modified":"2026-07-31T18:47:25.831Z","references":[{"source_name":"DFIR Conti Bazar Nov 2021","url":"https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eb5ba6c3-c7f7-4a67-9a7e-9fef2cde9527","subject":"ATTACK:enterprise:S1248","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eb5ba6c3-c7f7-4a67-9a7e-9fef2cde9527","modified":"2026-04-29T14:23:06.245Z","references":[{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f3ac1fad-7d60-48a3-8cb0-6b778987d333","subject":"ATTACK:enterprise:G1033","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f3ac1fad-7d60-48a3-8cb0-6b778987d333","modified":"2026-07-31T20:48:42.760Z","references":[{"source_name":"StarBlizzard","url":"https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f3f85cfd-557c-45c1-82ae-a9e349c8714c","subject":"ATTACK:enterprise:S1075","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f3f85cfd-557c-45c1-82ae-a9e349c8714c","modified":"2026-04-29T14:23:06.257Z","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f53a7fa6-b4b8-4624-b6b5-2a3a7d2ded8a","subject":"ATTACK:enterprise:S9008","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f53a7fa6-b4b8-4624-b6b5-2a3a7d2ded8a","modified":"2026-04-29T14:23:06.258Z","references":[{"source_name":"Aikido Shai-Hulud September 2025","url":"https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again"},{"source_name":"Netskope Shai-Hulud November 2025","url":"https://www.netskope.com/blog/shai-hulud-2-0-aggressive-automated-one-of-fastest-spreading-npm-supply-chain-attacks-ever-observed"},{"source_name":"Palo Alto Unit 42 Shai-Hulud November 2025","url":"https://unit42.paloaltonetworks.com/npm-supply-chain-attack/"},{"source_name":"Wiz Shai-Hulud September 2025","url":"https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack"},{"source_name":"Microsoft Shai-Hulud December 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/"},{"source_name":"Socket Shai-Hulud November 2025","url":"https://socket.dev/blog/shai-hulud-strikes-again-v2"},{"source_name":"Socket Shai-Hulud Trufflehog September 2025","url":"https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f8ca294b-b401-4bc3-897d-04ac9860fadb","subject":"ATTACK:enterprise:S9043","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f8ca294b-b401-4bc3-897d-04ac9860fadb","modified":"2026-07-29T21:09:06.565Z","references":[{"source_name":"Flashpoint Mini Shai-Hulud MAY 2026","url":"https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/"},{"source_name":"Trend Micro TeamPCP MAY 2026","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f9867ca2-18a1-4e84-ad1d-61d7c85fe4b3","subject":"ATTACK:enterprise:T1059.007","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1059","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f9867ca2-18a1-4e84-ad1d-61d7c85fe4b3","modified":"2026-04-29T14:23:06.264Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa1dff90-adae-4aea-a9c2-fd25969e5bd3","subject":"ATTACK:enterprise:S0332","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa1dff90-adae-4aea-a9c2-fd25969e5bd3","modified":"2026-04-29T14:23:06.265Z","references":[{"source_name":"Fortinet Remcos Campaign NOV 2024","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fdbd14e9-fffa-4120-a979-24eead47ffa4","subject":"ATTACK:enterprise:S0673","predicate":"uses","object":"ATTACK:enterprise:T1059.007","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fdbd14e9-fffa-4120-a979-24eead47ffa4","modified":"2026-04-29T14:23:06.270Z","references":[{"source_name":"Prevailion DarkWatchman 2021","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}