{"record":{"id":"ATTACK:enterprise:T1074.001","title":"Local Data Staging","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1074/001","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--1c34f7aa-9341-4a48-bfab-af22e51aca6c","external_id":"T1074.001","domain":"enterprise","created":"2020-03-13T21:13:10.467Z","modified":"2026-09-11T19:49:27.665Z","version":"1.2","aliases":[],"tactics":["collection"],"source_references":[{"source_name":"Prevailion DarkWatchman 2021","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}]},"assertions":[{"id":"enterprise:relationship--05669b75-65ea-4b30-8f97-f2c806a0703d","subject":"ATTACK:enterprise:G1046","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--05669b75-65ea-4b30-8f97-f2c806a0703d","modified":"2026-07-31T18:47:47.744Z","references":[{"source_name":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0634c754-9660-414f-8304-d9d92e37a0ce","subject":"ATTACK:enterprise:S0264","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0634c754-9660-414f-8304-d9d92e37a0ce","modified":"2026-04-29T14:23:05.911Z","references":[{"source_name":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--066425f1-79cb-4cbc-b570-0280ac503c55","subject":"ATTACK:enterprise:S1029","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--066425f1-79cb-4cbc-b570-0280ac503c55","modified":"2026-04-29T14:23:05.912Z","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0764c8ee-8577-4124-9658-7cc90f74726f","subject":"ATTACK:enterprise:S1149","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0764c8ee-8577-4124-9658-7cc90f74726f","modified":"2026-04-29T14:23:05.913Z","references":[{"source_name":"Mandiant ROADSWEEP August 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0ce76eff-085b-47c7-bce4-144d4b4252fc","subject":"ATTACK:enterprise:C0049","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0ce76eff-085b-47c7-bce4-144d4b4252fc","modified":"2026-07-31T18:47:32.636Z","references":[{"source_name":"CISA Leviathan 2024","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0f578b99-3d14-4416-8936-51e11d71a47b","subject":"ATTACK:enterprise:S1110","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0f578b99-3d14-4416-8936-51e11d71a47b","modified":"2026-04-29T14:23:05.925Z","references":[{"source_name":"Mandiant Pulse Secure Zero-Day April 2021","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--118d9413-0b34-47e6-b333-b712e78dc404","subject":"ATTACK:enterprise:S0567","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--118d9413-0b34-47e6-b333-b712e78dc404","modified":"2026-04-29T14:23:05.928Z","references":[{"source_name":"Securelist Dtrack","url":"https://securelist.com/my-name-is-dtrack/93338/"},{"source_name":"CyberBit Dtrack","url":"https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--11fdff9c-078b-48f6-ac6c-4a2c89dafc4f","subject":"ATTACK:enterprise:S1196","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--11fdff9c-078b-48f6-ac6c-4a2c89dafc4f","modified":"2026-04-29T14:23:05.928Z","references":[{"source_name":"S2W Troll Stealer 2024","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--13e52bdf-aa82-4220-8a02-02c735c4fccf","subject":"ATTACK:enterprise:S1015","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--13e52bdf-aa82-4220-8a02-02c735c4fccf","modified":"2026-04-29T14:23:05.931Z","references":[{"source_name":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1784577e-9d82-497b-aba1-bc4d5a23d8f8","subject":"ATTACK:enterprise:S0247","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1784577e-9d82-497b-aba1-bc4d5a23d8f8","modified":"2026-04-29T14:23:05.936Z","references":[{"source_name":"Talos NavRAT May 2018","url":"https://blog.talosintelligence.com/2018/05/navrat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1b45f3b5-b7a4-4424-a8ff-1b1f1c1a55d9","subject":"ATTACK:enterprise:G0027","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1b45f3b5-b7a4-4424-a8ff-1b1f1c1a55d9","modified":"2026-07-31T18:48:28.460Z","references":[{"source_name":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1bf421b0-1faf-403d-a8c6-3f5eb90d7c9d","subject":"ATTACK:enterprise:G0121","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1bf421b0-1faf-403d-a8c6-3f5eb90d7c9d","modified":"2026-07-31T18:47:51.756Z","references":[{"source_name":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e46f5cf-dfaf-4cc6-a685-ee876f371b7e","subject":"ATTACK:enterprise:S0386","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e46f5cf-dfaf-4cc6-a685-ee876f371b7e","modified":"2026-04-29T14:23:05.946Z","references":[{"source_name":"TrendMicro Ursnif Mar 2015","url":"https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--20b14e6f-685d-4b88-9ab7-40f7beb99ec4","subject":"ATTACK:enterprise:S1044","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--20b14e6f-685d-4b88-9ab7-40f7beb99ec4","modified":"2026-04-29T14:23:05.949Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--23a9b432-2d25-45a7-b75f-7496b26702f8","subject":"ATTACK:enterprise:S9020","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--23a9b432-2d25-45a7-b75f-7496b26702f8","modified":"2026-04-29T14:23:05.954Z","references":[{"source_name":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2545e3a8-751e-443b-ad4e-da1843014f6b","subject":"ATTACK:enterprise:C0032","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2545e3a8-751e-443b-ad4e-da1843014f6b","modified":"2026-07-31T18:47:25.873Z","references":[{"source_name":"FireEye TRITON 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2af3c673-c0c6-4246-aacc-984eb370e7b9","subject":"ATTACK:enterprise:G0053","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2af3c673-c0c6-4246-aacc-984eb370e7b9","modified":"2026-07-31T20:48:40.238Z","references":[{"source_name":"Mandiant FIN5 GrrCON Oct 2016","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2d82c7df-baa0-4268-855d-03df92fa35ab","subject":"ATTACK:enterprise:S0024","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2d82c7df-baa0-4268-855d-03df92fa35ab","modified":"2026-04-29T14:23:05.966Z","references":[{"source_name":"Malwarebytes Dyreza November 2015","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--330e86f3-f4ff-4fe0-af64-cd3c86849239","subject":"ATTACK:enterprise:S0337","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--330e86f3-f4ff-4fe0-af64-cd3c86849239","modified":"2026-04-29T14:23:05.986Z","references":[{"source_name":"Unit 42 BadPatch Oct 2017","url":"https://researchcenter.paloaltonetworks.com/2017/10/unit42-badpatch/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--343c6e94-fda1-41d6-865e-6a30570afb98","subject":"ATTACK:enterprise:S0673","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--343c6e94-fda1-41d6-865e-6a30570afb98","modified":"2026-04-29T14:23:05.989Z","references":[{"source_name":"Prevailion DarkWatchman 2021","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3c3646c8-56a5-443a-a71f-a32ea6269750","subject":"ATTACK:enterprise:C0006","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3c3646c8-56a5-443a-a71f-a32ea6269750","modified":"2026-07-31T18:47:20.574Z","references":[{"source_name":"McAfee Honeybee","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f564288-8695-4cbc-a8b9-813cb67e0f1e","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f564288-8695-4cbc-a8b9-813cb67e0f1e","modified":"2026-07-31T18:47:31.519Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--40082714-cb19-482f-9b6d-22031ef39926","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--40082714-cb19-482f-9b6d-22031ef39926","modified":"2026-07-31T20:48:26.254Z","references":[{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4126e124-fb28-4274-a687-dc5344b34859","subject":"ATTACK:enterprise:S1059","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4126e124-fb28-4274-a687-dc5344b34859","modified":"2026-04-29T14:23:06.014Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4180422b-a478-4ceb-ac8c-6fe86c85399c","subject":"ATTACK:enterprise:T1074.001","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1074","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4180422b-a478-4ceb-ac8c-6fe86c85399c","modified":"2026-04-29T14:23:06.014Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--421fd048-a5c3-46b0-b1ff-a7510c107879","subject":"ATTACK:enterprise:S1060","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--421fd048-a5c3-46b0-b1ff-a7510c107879","modified":"2026-04-29T14:23:06.015Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--42ca6477-eae6-4423-8153-a1e0662f3fe5","subject":"ATTACK:enterprise:S9036","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--42ca6477-eae6-4423-8153-a1e0662f3fe5","modified":"2026-04-29T14:23:06.016Z","references":[{"source_name":"ESET_MuddyWater_Dec2025","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--44a77efc-9215-4e5a-a246-ac9669dc52a4","subject":"ATTACK:enterprise:S1016","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--44a77efc-9215-4e5a-a246-ac9669dc52a4","modified":"2026-04-29T14:23:06.019Z","references":[{"source_name":"Objective-See MacMa Nov 2021","url":"https://objective-see.org/blog/blog_0x69.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4618019f-219d-4a50-be6b-434568bd97d0","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4618019f-219d-4a50-be6b-434568bd97d0","modified":"2026-09-30T20:43:30.292Z","references":[{"source_name":"Microsoft Sapphire Sleet APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"},{"source_name":"MIcrosoft Mastra npm Compromise JUN 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--487cc105-dd80-4b43-94ae-da23517aab6f","subject":"ATTACK:enterprise:S0335","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--487cc105-dd80-4b43-94ae-da23517aab6f","modified":"2026-04-29T14:23:06.024Z","references":[{"source_name":"ESET Carbon Mar 2017","url":"https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--492ee8f7-6f00-43a9-ae9b-fbf57879c49e","subject":"ATTACK:enterprise:G0090","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--492ee8f7-6f00-43a9-ae9b-fbf57879c49e","modified":"2026-07-31T20:48:52.443Z","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4b03f718-f89a-4652-b3be-5cbe4e0e044f","subject":"ATTACK:enterprise:S0458","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4b03f718-f89a-4652-b3be-5cbe4e0e044f","modified":"2026-04-29T14:23:06.028Z","references":[{"source_name":"Eset Ramsay May 2020","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"},{"source_name":"Antiy CERT Ramsay April 2020","url":"https://www.programmersought.com/article/62493896999/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4b6c887c-5fae-49d2-acf2-5922bab839dc","subject":"ATTACK:enterprise:G1048","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4b6c887c-5fae-49d2-acf2-5922bab839dc","modified":"2026-07-31T18:47:53.596Z","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4dcb70d9-017b-44b8-a13c-fab275c5bc56","subject":"ATTACK:enterprise:C0015","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4dcb70d9-017b-44b8-a13c-fab275c5bc56","modified":"2026-07-31T18:47:25.293Z","references":[{"source_name":"DFIR Conti Bazar Nov 2021","url":"https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4df03f98-3c25-4772-8be5-cc1aaeff1cc9","subject":"ATTACK:enterprise:G1023","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4df03f98-3c25-4772-8be5-cc1aaeff1cc9","modified":"2026-07-31T18:48:16.860Z","references":[{"source_name":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4e956278-89d6-45b5-a7e3-2ad13ae07e01","subject":"ATTACK:enterprise:G0030","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4e956278-89d6-45b5-a7e3-2ad13ae07e01","modified":"2026-07-31T18:48:06.842Z","references":[{"source_name":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--52ae918a-8afe-4e67-801f-d4fabbecef77","subject":"ATTACK:enterprise:G0139","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--52ae918a-8afe-4e67-801f-d4fabbecef77","modified":"2026-07-31T18:47:49.455Z","references":[{"source_name":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--585bbf8f-b2d3-4186-8e15-f57ea1961d8c","subject":"ATTACK:enterprise:C0062","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--585bbf8f-b2d3-4186-8e15-f57ea1961d8c","modified":"2026-07-31T18:47:24.317Z","references":[{"source_name":"Anthropic AI Orchestrated Campaign NOV 2025","url":"https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--58643a55-d526-4536-935c-5c1b5c1d9b20","subject":"ATTACK:enterprise:S1153","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--58643a55-d526-4536-935c-5c1b5c1d9b20","modified":"2026-04-29T14:23:06.046Z","references":[{"source_name":"Kandji Cuckoo April 2024","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--59193fff-6bea-41c6-b744-36850e6cc39a","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--59193fff-6bea-41c6-b744-36850e6cc39a","modified":"2026-04-29T14:23:06.047Z","references":[{"source_name":"ESET InvisiMole June 2018","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5926c79d-b8a7-419a-b789-7e2ff1ee32b9","subject":"ATTACK:enterprise:G0119","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5926c79d-b8a7-419a-b789-7e2ff1ee32b9","modified":"2026-07-31T18:47:35.383Z","references":[{"source_name":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5a3333ef-b106-42db-b0bb-46b2ac7c21b2","subject":"ATTACK:enterprise:G1030","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5a3333ef-b106-42db-b0bb-46b2ac7c21b2","modified":"2026-07-31T18:48:14.710Z","references":[{"source_name":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5b4d7467-8418-42c8-bb6f-ad275fc7fb40","subject":"ATTACK:enterprise:S1042","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5b4d7467-8418-42c8-bb6f-ad275fc7fb40","modified":"2026-04-29T14:23:06.050Z","references":[{"source_name":"Mandiant UNC3890 Aug 2022","url":"https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5d397a8d-2195-440d-a0f5-bbf6c3e8f6e4","subject":"ATTACK:enterprise:S0045","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5d397a8d-2195-440d-a0f5-bbf6c3e8f6e4","modified":"2026-04-29T14:23:06.052Z","references":[{"source_name":"ESET Sednit Part 2","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5f055076-79d1-44e8-95cb-43fc515df2f6","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5f055076-79d1-44e8-95cb-43fc515df2f6","modified":"2026-07-31T20:48:46.754Z","references":[{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5fd8740a-6197-4099-a4d9-af0c9421cfc2","subject":"ATTACK:enterprise:S0667","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5fd8740a-6197-4099-a4d9-af0c9421cfc2","modified":"2026-04-29T14:23:06.055Z","references":[{"source_name":"ESET Gelsemium June 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--611cb6eb-efdb-4d74-b354-5064ab52bd34","subject":"ATTACK:enterprise:S0038","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--611cb6eb-efdb-4d74-b354-5064ab52bd34","modified":"2026-06-12T15:51:16.723Z","references":[{"source_name":"Symantec W32.Duqu","url":"https://web.archive.org/web/20111213083345/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6376c6be-5ec7-4775-8984-13a1474dc92d","subject":"ATTACK:enterprise:S0438","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6376c6be-5ec7-4775-8984-13a1474dc92d","modified":"2026-04-29T14:23:06.060Z","references":[{"source_name":"ESET Attor Oct 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--648c423a-ac35-411d-8ace-59b511e10fb3","subject":"ATTACK:enterprise:S9013","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--648c423a-ac35-411d-8ace-59b511e10fb3","modified":"2026-04-29T14:23:06.061Z","references":[{"source_name":"Google UNC5221 Ivanti January 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"},{"source_name":"Picus Security UNC5221 Ivanti May 2025","url":"https://www.picussecurity.com/resource/blog/unc5221-cve-2025-22457-ivanti-connect-secure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--66773d13-7e97-493f-a1b6-9484c52cc6a1","subject":"ATTACK:enterprise:S9010","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--66773d13-7e97-493f-a1b6-9484c52cc6a1","modified":"2026-04-29T14:23:06.064Z","references":[{"source_name":"Koi Glassworm New Tricks December 2025","url":"https://www.koi.ai/blog/glassworm-goes-mac-fresh-infrastructure-new-tricks"},{"source_name":"Socket GlassWorm January 2026","url":"https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--68953f34-79e2-482a-bc9a-dbe11c2839ae","subject":"ATTACK:enterprise:G0114","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--68953f34-79e2-482a-bc9a-dbe11c2839ae","modified":"2026-07-31T20:48:41.337Z","references":[{"source_name":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6b9d6a84-b73e-4fb3-ad86-64b5832056d4","subject":"ATTACK:enterprise:S0629","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6b9d6a84-b73e-4fb3-ad86-64b5832056d4","modified":"2026-04-29T14:23:06.072Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6d657d75-9718-43a8-985e-44d47d1b1d15","subject":"ATTACK:enterprise:S1246","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6d657d75-9718-43a8-985e-44d47d1b1d15","modified":"2026-04-29T14:23:06.074Z","references":[{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ecbd739-f0c0-4aff-858f-255e3afeee8f","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ecbd739-f0c0-4aff-858f-255e3afeee8f","modified":"2026-07-31T20:48:29.889Z","references":[{"source_name":"Talos MuddyWater Jan 2022","url":"https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7014e092-7f05-4f0a-9c6d-f264bf76de7b","subject":"ATTACK:enterprise:C0017","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7014e092-7f05-4f0a-9c6d-f264bf76de7b","modified":"2026-07-31T21:12:31.474Z","references":[{"source_name":"Mandiant APT41","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--74edb7f4-4c3b-4573-abb0-c4842032b6c3","subject":"ATTACK:enterprise:S0249","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--74edb7f4-4c3b-4573-abb0-c4842032b6c3","modified":"2026-04-29T14:23:06.085Z","references":[{"source_name":"McAfee Gold Dragon","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--757936cb-468c-4b60-a996-8089c77cea62","subject":"ATTACK:enterprise:C0051","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--757936cb-468c-4b60-a996-8089c77cea62","modified":"2026-07-31T21:11:46.109Z","references":[{"source_name":"Nearest Neighbor Volexity","url":"https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--766eaed1-a26a-4065-8793-17df813e9996","subject":"ATTACK:enterprise:S9053","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--766eaed1-a26a-4065-8793-17df813e9996","modified":"2026-09-24T22:21:53.946Z","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--79333543-6031-4aa4-91be-35d80fae8ed2","subject":"ATTACK:enterprise:S0409","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--79333543-6031-4aa4-91be-35d80fae8ed2","modified":"2026-04-29T14:23:06.091Z","references":[{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"},{"source_name":"Cylance Machete Mar 2017","url":"https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7cf7d162-a34f-4951-a643-5bf959283f6b","subject":"ATTACK:enterprise:S0094","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7cf7d162-a34f-4951-a643-5bf959283f6b","modified":"2026-04-29T14:23:06.096Z","references":[{"source_name":"Symantec Dragonfly","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"},{"source_name":"Secureworks Karagany July 2019","url":"https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7d8e5c4d-afdb-43f9-bfcf-7ed674a516e3","subject":"ATTACK:enterprise:S0012","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7d8e5c4d-afdb-43f9-bfcf-7ed674a516e3","modified":"2026-04-29T14:23:06.097Z","references":[{"source_name":"Symantec Darkmoon Aug 2005","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2005-081910-3934-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e7c0aa8-a17e-4079-b1fd-188977cf1a6e","subject":"ATTACK:enterprise:S0062","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e7c0aa8-a17e-4079-b1fd-188977cf1a6e","modified":"2026-04-29T14:23:06.098Z","references":[{"source_name":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--830b0685-3b30-4c7b-9b37-2fca346e6fc8","subject":"ATTACK:enterprise:S1104","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--830b0685-3b30-4c7b-9b37-2fca346e6fc8","modified":"2026-04-29T14:23:06.104Z","references":[{"source_name":"Mandiant Pulse Secure Zero-Day April 2021","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83ea392a-3959-4b29-b7b8-517a20ec836d","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83ea392a-3959-4b29-b7b8-517a20ec836d","modified":"2026-04-29T14:23:06.105Z","references":[{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","url":"https://www.justice.gov/archives/opa/media/1384136/dl"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--87999cb2-7565-465a-ad10-b585be2e3e3f","subject":"ATTACK:enterprise:S0395","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--87999cb2-7565-465a-ad10-b585be2e3e3f","modified":"2026-04-29T14:23:06.110Z","references":[{"source_name":"ESET LightNeuron May 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--87aaf244-2ecb-453e-87c0-836f9a26cc59","subject":"ATTACK:enterprise:S1012","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--87aaf244-2ecb-453e-87c0-836f9a26cc59","modified":"2026-04-29T14:23:06.110Z","references":[{"source_name":"Cybereason PowerLess February 2022","url":"https://www.cybereason.com/blog/research/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--87ddc052-0933-4722-9fb2-4653c4a3663c","subject":"ATTACK:enterprise:G0022","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--87ddc052-0933-4722-9fb2-4653c4a3663c","modified":"2026-07-31T18:47:37.979Z","references":[{"source_name":"aptsim","url":"http://carnal0wnage.attackresearch.com/2012/09/more-on-aptsim.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8c9728bd-f58c-4a78-8b4d-63e8fe8cce31","subject":"ATTACK:enterprise:S1213","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8c9728bd-f58c-4a78-8b4d-63e8fe8cce31","modified":"2026-04-29T14:23:06.117Z","references":[{"source_name":"TrendMicro LummaStealer 2025","url":"https://www.trendmicro.com/en_us/research/25/a/lumma-stealers-github-based-delivery-via-mdr.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--910d0f07-383b-480b-9637-d5b747353bdc","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--910d0f07-383b-480b-9637-d5b747353bdc","modified":"2026-04-29T14:23:06.123Z","references":[{"source_name":"Kroll Qakbot June 2020","url":"https://www.kroll.com/en/insights/publications/cyber/qakbot-malware-exfiltrating-emails-thread-hijacking-attacks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--935d1918-a1ea-4c46-b3b0-5c1d0f44a346","subject":"ATTACK:enterprise:S0503","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--935d1918-a1ea-4c46-b3b0-5c1d0f44a346","modified":"2026-04-29T14:23:06.126Z","references":[{"source_name":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--959bda8e-6c64-4048-9c34-f8ccd64066e8","subject":"ATTACK:enterprise:S1101","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--959bda8e-6c64-4048-9c34-f8ccd64066e8","modified":"2026-04-29T14:23:06.129Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--95ebe979-ec88-489d-ba9d-b4ac2f1f22db","subject":"ATTACK:enterprise:S9022","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--95ebe979-ec88-489d-ba9d-b4ac2f1f22db","modified":"2026-04-29T14:23:06.129Z","references":[{"source_name":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--966ce7a3-4306-4003-89d8-9d6af89a0c2e","subject":"ATTACK:enterprise:S1043","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--966ce7a3-4306-4003-89d8-9d6af89a0c2e","modified":"2026-04-29T14:23:06.130Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--97a62430-6a83-4ead-b8c7-ce47f5d0cac0","subject":"ATTACK:enterprise:G0102","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--97a62430-6a83-4ead-b8c7-ce47f5d0cac0","modified":"2026-07-31T20:48:50.391Z","references":[{"source_name":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--97ffb5c1-05da-42b4-90eb-60c1eedc1292","subject":"ATTACK:enterprise:S0340","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--97ffb5c1-05da-42b4-90eb-60c1eedc1292","modified":"2026-04-29T14:23:06.132Z","references":[{"source_name":"Securelist Octopus Oct 2018","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"},{"source_name":"ESET Nomadic Octopus 2018","url":"https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--992d6f04-7454-4211-9a44-a5c87fdb7657","subject":"ATTACK:enterprise:S0196","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--992d6f04-7454-4211-9a44-a5c87fdb7657","modified":"2026-04-29T14:23:06.134Z","references":[{"source_name":"Morphisec ShellTea June 2019","url":"http://blog.morphisec.com/security-alert-fin8-is-back"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--996ad086-aad7-40f2-b711-559ea97295c9","subject":"ATTACK:enterprise:C0040","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--996ad086-aad7-40f2-b711-559ea97295c9","modified":"2026-07-31T18:47:30.480Z","references":[{"source_name":"Google Cloud APT41 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9bb68fb7-931e-4d24-a042-c6545fb8167f","subject":"ATTACK:enterprise:C0044","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9bb68fb7-931e-4d24-a042-c6545fb8167f","modified":"2026-07-31T21:13:47.681Z","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9c4a8336-5f5f-4e58-b00d-b6bf1c59ec03","subject":"ATTACK:enterprise:S0149","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9c4a8336-5f5f-4e58-b00d-b6bf1c59ec03","modified":"2026-04-29T14:23:06.138Z","references":[{"source_name":"Palo Alto MoonWind March 2017","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9c7ecbf4-88fe-4144-8dc4-f5bca2c3156d","subject":"ATTACK:enterprise:S0170","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9c7ecbf4-88fe-4144-8dc4-f5bca2c3156d","modified":"2026-04-29T14:23:06.138Z","references":[{"source_name":"Palo Alto OilRig May 2016","url":"http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9cef6fec-e4eb-49eb-85db-880138f335bd","subject":"ATTACK:enterprise:S0090","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9cef6fec-e4eb-49eb-85db-880138f335bd","modified":"2026-04-29T14:23:06.139Z","references":[{"source_name":"Palo Alto Rover","url":"http://researchcenter.paloaltonetworks.com/2016/02/new-malware-rover-targets-indian-ambassador-to-afghanistan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9e214d5b-7d46-4135-bc42-4caab16b39d8","subject":"ATTACK:enterprise:S0035","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9e214d5b-7d46-4135-bc42-4caab16b39d8","modified":"2026-04-29T14:23:06.141Z","references":[{"source_name":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9e77c6fc-0227-42d6-b4ce-f228115963fe","subject":"ATTACK:enterprise:S0081","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9e77c6fc-0227-42d6-b4ce-f228115963fe","modified":"2026-04-29T14:23:06.141Z","references":[{"source_name":"Accenture Dragonfish Jan 2018","url":"https://web.archive.org/web/20190508165226/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9ff590a0-b722-4282-8644-ff7344ac54b2","subject":"ATTACK:enterprise:C0058","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9ff590a0-b722-4282-8644-ff7344ac54b2","modified":"2026-07-31T18:47:18.799Z","references":[{"source_name":"Trend Micro SharePoint Attacks JUL 2025","url":"https://www.trendmicro.com/en_us/research/25/g/cve-2025-53770-and-cve-2025-53771-sharepoint-attacks.html"},{"source_name":"Palo Alto SharePoint Vulnerabilities JUL 2025","url":"https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a30e2e98-d6c2-4eb1-b520-1b6757c88c47","subject":"ATTACK:enterprise:S0615","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a30e2e98-d6c2-4eb1-b520-1b6757c88c47","modified":"2026-04-29T14:23:06.147Z","references":[{"source_name":"BlackBerry CostaRicto November 2020","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a370ba06-f0e0-49e7-a1dd-508700403bed","subject":"ATTACK:enterprise:S9051","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a370ba06-f0e0-49e7-a1dd-508700403bed","modified":"2026-09-30T20:20:17.185Z","references":[{"source_name":"CarveyODonnellWelchHuntress_TheGentlemen_May2026","url":"https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps"},{"source_name":"CheckPointResearch_TheGentlemen_April2026","url":"https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"},{"source_name":"MSTI_GentelmenRansomware_May2026","url":"https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"},{"source_name":"TrendAI_TheGentlemen_Sept2025","url":"https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a535c99e-66f2-47c9-aa25-352c90efd2ff","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a535c99e-66f2-47c9-aa25-352c90efd2ff","modified":"2026-07-31T20:48:25.279Z","references":[{"source_name":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source_name":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a538c673-e7f2-4fd0-923e-d874a3f3d363","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a538c673-e7f2-4fd0-923e-d874a3f3d363","modified":"2026-07-31T18:47:53.907Z","references":[{"source_name":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a68d8191-b374-4741-a249-1db3515d581b","subject":"ATTACK:enterprise:G0093","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a68d8191-b374-4741-a249-1db3515d581b","modified":"2026-07-31T18:47:37.484Z","references":[{"source_name":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aa12e2a6-02e7-4001-af7b-6a60021ddbfd","subject":"ATTACK:enterprise:S0443","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aa12e2a6-02e7-4001-af7b-6a60021ddbfd","modified":"2026-04-29T14:23:06.156Z","references":[{"source_name":"FireEye MESSAGETAP October 2019","url":"https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-is-reading-your-text-messages.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aa99d075-7455-49bb-badb-6300ffe9265f","subject":"ATTACK:enterprise:S9050","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aa99d075-7455-49bb-badb-6300ffe9265f","modified":"2026-09-11T19:49:27.387Z","references":[{"source_name":"Cyfirma_Vidar_June2024","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"},{"source_name":"Logpoint_StealerMalwareFamilies_2024","url":"https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--acd3fcd8-3b5a-47e5-a9cf-92e0f6d3eb2f","subject":"ATTACK:enterprise:C0063","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--acd3fcd8-3b5a-47e5-a9cf-92e0f6d3eb2f","modified":"2026-07-31T20:48:19.903Z","references":[{"source_name":"CERT Polska","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ad77932b-9632-4816-b9af-db6257f5a7d4","subject":"ATTACK:enterprise:S0261","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ad77932b-9632-4816-b9af-db6257f5a7d4","modified":"2026-04-29T14:23:06.161Z","references":[{"source_name":"Symantec Catchamas April 2018","url":"https://web.archive.org/web/20190508165711/https://www-west.symantec.com/content/symantec/english/en/security-center/writeup.html/2018-040209-1742-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b25f5d90-f6cc-47e9-89f1-5527886bf536","subject":"ATTACK:enterprise:S0169","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b25f5d90-f6cc-47e9-89f1-5527886bf536","modified":"2026-04-29T14:23:06.168Z","references":[{"source_name":"Kroll RawPOS Jan 2017","url":"https://www.kroll.com/en/insights/publications/malware-analysis-report-rawpos-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b30daf73-f565-4c1e-bc0b-77bb1c22b03f","subject":"ATTACK:enterprise:S0647","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b30daf73-f565-4c1e-bc0b-77bb1c22b03f","modified":"2026-04-29T14:23:06.170Z","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b36109ad-fa2c-4e63-9460-1250053ae821","subject":"ATTACK:enterprise:S9064","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b36109ad-fa2c-4e63-9460-1250053ae821","modified":"2026-10-01T21:00:32.487Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b4e0328b-5ddb-4322-a8db-e736648eab22","subject":"ATTACK:enterprise:S1168","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b4e0328b-5ddb-4322-a8db-e736648eab22","modified":"2026-04-29T14:23:06.172Z","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b7d36798-e9f2-4474-836e-80b100a561e6","subject":"ATTACK:enterprise:G0065","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b7d36798-e9f2-4474-836e-80b100a561e6","modified":"2026-07-31T20:48:38.353Z","references":[{"source_name":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"},{"source_name":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bb6be5dd-602d-4625-859a-eb6c5bddc29c","subject":"ATTACK:enterprise:S0644","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bb6be5dd-602d-4625-859a-eb6c5bddc29c","modified":"2026-04-29T14:23:06.181Z","references":[{"source_name":"Talos Oblique RAT March 2021","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bbd29878-c16a-45ee-9785-78550f080d83","subject":"ATTACK:enterprise:G0045","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bbd29878-c16a-45ee-9785-78550f080d83","modified":"2026-07-31T18:47:44.430Z","references":[{"source_name":"PWC Cloud Hopper April 2017","url":"https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bcba387c-fa32-4a32-8703-5aef8f77ca18","subject":"ATTACK:enterprise:C0048","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bcba387c-fa32-4a32-8703-5aef8f77ca18","modified":"2026-07-31T18:47:21.041Z","references":[{"source_name":"Palo Alto MidnightEclipse APR 2024","url":"https://unit42.paloaltonetworks.com/cve-2024-3400/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--be20956b-6103-4bfc-a7c4-7e61cbc8cbcd","subject":"ATTACK:enterprise:S1233","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--be20956b-6103-4bfc-a7c4-7e61cbc8cbcd","modified":"2026-04-29T14:23:06.185Z","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c2fd10bb-db6f-4ea0-b63e-583c45eec56a","subject":"ATTACK:enterprise:S9058","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c2fd10bb-db6f-4ea0-b63e-583c45eec56a","modified":"2026-09-28T16:45:56.511Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c37f69b0-176a-483d-b75c-3b0c84e03276","subject":"ATTACK:enterprise:G0135","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c37f69b0-176a-483d-b75c-3b0c84e03276","modified":"2026-07-31T18:48:11.345Z","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c469874c-492d-4975-abc1-1668fc65a70a","subject":"ATTACK:enterprise:S9035","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c469874c-492d-4975-abc1-1668fc65a70a","modified":"2026-04-29T14:23:06.193Z","references":[{"source_name":"Splunk LAMEHUG SEP 2025","url":"https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"},{"source_name":"Nov AI Threat Tracker","url":"https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4a2a14a-6fb0-46cf-b97d-c4bcb1c751a7","subject":"ATTACK:enterprise:S0251","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4a2a14a-6fb0-46cf-b97d-c4bcb1c751a7","modified":"2026-04-29T14:23:06.194Z","references":[{"source_name":"ESET Zebrocy Nov 2018","url":"https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c66dddb1-0003-4af8-9887-5642964e0fd0","subject":"ATTACK:enterprise:S1210","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c66dddb1-0003-4af8-9887-5642964e0fd0","modified":"2026-04-29T14:23:06.197Z","references":[{"source_name":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"},{"source_name":"Symantec Bilbug 2022","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c7c855ed-9550-4611-84bd-d4d7c86cef3c","subject":"ATTACK:enterprise:S0353","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c7c855ed-9550-4611-84bd-d4d7c86cef3c","modified":"2026-04-29T14:23:06.198Z","references":[{"source_name":"Unit 42 NOKKI Sept 2018","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c7d7c454-71fb-4a8e-989a-cb2e7404c0d3","subject":"ATTACK:enterprise:S0652","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c7d7c454-71fb-4a8e-989a-cb2e7404c0d3","modified":"2026-04-29T14:23:06.198Z","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c890e6af-c827-4369-a0f7-fb351c6b6ec5","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c890e6af-c827-4369-a0f7-fb351c6b6ec5","modified":"2026-07-31T18:47:53.371Z","references":[{"source_name":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source_name":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c93bb2b9-bd22-4e14-b884-2141168387b2","subject":"ATTACK:enterprise:S0147","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c93bb2b9-bd22-4e14-b884-2141168387b2","modified":"2026-04-29T14:23:06.200Z","references":[{"source_name":"Palo Alto Gamaredon Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ca413f1f-3a42-48f5-b282-425bf3c24b22","subject":"ATTACK:enterprise:S1235","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ca413f1f-3a42-48f5-b282-425bf3c24b22","modified":"2026-04-29T14:23:06.202Z","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ce4321e0-09e0-4e3a-b673-8a6e9248e720","subject":"ATTACK:enterprise:S0343","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ce4321e0-09e0-4e3a-b673-8a6e9248e720","modified":"2026-04-29T14:23:06.207Z","references":[{"source_name":"ESET TeleBots Oct 2018","url":"https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cf1a3f3b-cfe6-4eef-b7eb-d0d4adc0187d","subject":"ATTACK:enterprise:S1245","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cf1a3f3b-cfe6-4eef-b7eb-d0d4adc0187d","modified":"2026-04-29T14:23:06.208Z","references":[{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cf3bdeb7-2728-4bae-a790-6aa2dbf766e8","subject":"ATTACK:enterprise:S9065","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cf3bdeb7-2728-4bae-a790-6aa2dbf766e8","modified":"2026-10-01T21:25:06.388Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d24d1525-3136-4810-a346-cd29a15dfac8","subject":"ATTACK:enterprise:S9052","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d24d1525-3136-4810-a346-cd29a15dfac8","modified":"2026-09-24T18:52:17.115Z","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d747c1d7-646a-4d72-a00b-e2f10ed1f9eb","subject":"ATTACK:enterprise:S0622","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d747c1d7-646a-4d72-a00b-e2f10ed1f9eb","modified":"2026-04-29T14:23:06.219Z","references":[{"source_name":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d8c447e8-6581-47ca-98d6-44b262023669","subject":"ATTACK:enterprise:S1090","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d8c447e8-6581-47ca-98d6-44b262023669","modified":"2026-04-29T14:23:06.221Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--db4032d6-1283-4e1e-a506-110a8600083f","subject":"ATTACK:enterprise:S1172","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--db4032d6-1283-4e1e-a506-110a8600083f","modified":"2026-04-29T14:23:06.225Z","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--db8f1355-57f0-446d-a261-b168497b20c6","subject":"ATTACK:enterprise:S0128","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--db8f1355-57f0-446d-a261-b168497b20c6","modified":"2026-04-29T14:23:06.225Z","references":[{"source_name":"Forcepoint Monsoon","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"},{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dbdf85ca-504d-40f9-9023-ce8acdf99781","subject":"ATTACK:enterprise:S0274","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dbdf85ca-504d-40f9-9023-ce8acdf99781","modified":"2026-04-29T14:23:06.225Z","references":[{"source_name":"Securelist Calisto July 2018","url":"https://securelist.com/calisto-trojan-for-macos/86543/"},{"source_name":"Symantec Calisto July 2018","url":"https://web.archive.org/web/20190111082249/https://www.symantec.com/security-center/writeup/2018-073014-2512-99?om_rssid=sr-latestthreats30days"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dcd2acb8-0f4a-4007-88ec-0962d66399cf","subject":"ATTACK:enterprise:S0526","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dcd2acb8-0f4a-4007-88ec-0962d66399cf","modified":"2026-04-29T14:23:06.227Z","references":[{"source_name":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dd45bff3-368a-4a3b-a97e-8bdeb753aedf","subject":"ATTACK:enterprise:S0538","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dd45bff3-368a-4a3b-a97e-8bdeb753aedf","modified":"2026-04-29T14:23:06.227Z","references":[{"source_name":"ESET Crutch December 2020","url":"https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df207207-01b2-456b-9dc4-7afd5ffeeb46","subject":"ATTACK:enterprise:S0113","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df207207-01b2-456b-9dc4-7afd5ffeeb46","modified":"2026-04-29T14:23:06.229Z","references":[{"source_name":"ESET Operation Groundbait","url":"http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df48ab06-0916-4d1d-9142-d0a508d0f0d4","subject":"ATTACK:enterprise:S0265","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df48ab06-0916-4d1d-9142-d0a508d0f0d4","modified":"2026-04-29T14:23:06.230Z","references":[{"source_name":"Unit 42 Kazuar May 2017","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e08fbaf9-0efe-41b1-99f7-ec61f38b175c","subject":"ATTACK:enterprise:S0084","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e08fbaf9-0efe-41b1-99f7-ec61f38b175c","modified":"2026-04-29T14:23:06.231Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e0fdf36c-02e5-4100-b0f2-a1fb28fdd674","subject":"ATTACK:enterprise:S1124","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e0fdf36c-02e5-4100-b0f2-a1fb28fdd674","modified":"2026-04-29T14:23:06.232Z","references":[{"source_name":"Red Canary SocGholish March 2024","url":"https://redcanary.com/threat-detection-report/threats/socgholish/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e15a2065-49a7-435f-b9ad-b45c4906aa74","subject":"ATTACK:enterprise:G0035","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e15a2065-49a7-435f-b9ad-b45c4906aa74","modified":"2026-07-31T20:48:28.761Z","references":[{"source_name":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e27daa6c-3577-4f58-9440-7a585e9571d9","subject":"ATTACK:enterprise:S0651","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e27daa6c-3577-4f58-9440-7a585e9571d9","modified":"2026-04-29T14:23:06.234Z","references":[{"source_name":"Checkpoint IndigoZebra July 2021","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e43c3765-10e6-40f4-b318-39ee3f34819e","subject":"ATTACK:enterprise:S1222","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e43c3765-10e6-40f4-b318-39ee3f34819e","modified":"2026-04-29T14:23:06.236Z","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e5562f3f-9657-49e8-8243-b5aff51e18a4","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e5562f3f-9657-49e8-8243-b5aff51e18a4","modified":"2026-04-29T14:23:06.237Z","references":[{"source_name":"FireEye NETWIRE March 2019","url":"https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e5728c4d-d404-44e8-9e28-3411942c5234","subject":"ATTACK:enterprise:S0036","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e5728c4d-d404-44e8-9e28-3411942c5234","modified":"2026-04-29T14:23:06.237Z","references":[{"source_name":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e86b2094-65ea-45f8-94cc-0467cf2eebd9","subject":"ATTACK:enterprise:S1154","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e86b2094-65ea-45f8-94cc-0467cf2eebd9","modified":"2026-04-29T14:23:06.241Z","references":[{"source_name":"Lumen Versa 2024","url":"https://blog.lumen.com/taking-the-crossroads-the-versa-director-zero-day-exploitation/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eb63ea0a-1d2d-4d6a-9006-a60dacc035da","subject":"ATTACK:enterprise:G1016","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eb63ea0a-1d2d-4d6a-9006-a60dacc035da","modified":"2026-07-31T18:48:31.544Z","references":[{"source_name":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source_name":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ec6a8fde-702a-4e38-a37b-428a8ca10b18","subject":"ATTACK:enterprise:G0007","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ec6a8fde-702a-4e38-a37b-428a8ca10b18","modified":"2026-07-31T20:48:45.252Z","references":[{"source_name":"Microsoft SIR Vol 19","url":"http://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ef651fd2-97e7-4471-a609-41f46003cf11","subject":"ATTACK:enterprise:S1075","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ef651fd2-97e7-4471-a609-41f46003cf11","modified":"2026-04-29T14:23:06.251Z","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f26e1997-733e-4c3c-ac26-294048466c52","subject":"ATTACK:enterprise:S0373","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f26e1997-733e-4c3c-ac26-294048466c52","modified":"2026-04-29T14:23:06.255Z","references":[{"source_name":"Cofense Astaroth Sept 2018","url":"https://web.archive.org/web/20200302071436/https://cofense.com/seeing-resurgence-demonic-astaroth-wmic-trojan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f2d62173-bd89-4d00-bcb6-5e4f6fa43df2","subject":"ATTACK:enterprise:S1037","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f2d62173-bd89-4d00-bcb6-5e4f6fa43df2","modified":"2026-04-29T14:23:06.255Z","references":[{"source_name":"Mandiant UNC3313 Feb 2022","url":"https://www.mandiant.com/resources/telegram-malware-iranian-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f38ae08a-0d59-41e9-a4ca-891a04297299","subject":"ATTACK:enterprise:S0197","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f38ae08a-0d59-41e9-a4ca-891a04297299","modified":"2026-04-29T14:23:06.256Z","references":[{"source_name":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f8c1f1e4-4580-4ec6-9bc0-6f24214dc273","subject":"ATTACK:enterprise:S0593","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f8c1f1e4-4580-4ec6-9bc0-6f24214dc273","modified":"2026-04-29T14:23:06.263Z","references":[{"source_name":"CISA EB Aug 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-239a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fbeb5e6c-5574-4d41-add3-01efec419ae7","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fbeb5e6c-5574-4d41-add3-01efec419ae7","modified":"2026-07-31T18:47:41.660Z","references":[{"source_name":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source_name":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fc9b992b-d38d-46f5-84b5-13c0e116a717","subject":"ATTACK:enterprise:S1109","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fc9b992b-d38d-46f5-84b5-13c0e116a717","modified":"2026-04-29T14:23:06.268Z","references":[{"source_name":"Mandiant Pulse Secure Zero-Day April 2021","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fca5e5e4-e615-44d5-901e-225fccd329cc","subject":"ATTACK:enterprise:S1142","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fca5e5e4-e615-44d5-901e-225fccd329cc","modified":"2026-04-29T14:23:06.268Z","references":[{"source_name":"ESET Turla Lunar toolset May 2024","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fe229513-0cd9-4e9a-a333-2748ef03dfbc","subject":"ATTACK:enterprise:S0136","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fe229513-0cd9-4e9a-a333-2748ef03dfbc","modified":"2026-04-29T14:23:06.270Z","references":[{"source_name":"ESET Sednit USBStealer 2014","url":"http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/"},{"source_name":"Kaspersky Sofacy","url":"https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff1a526c-156a-410c-bd80-f8e2f86b6c3a","subject":"ATTACK:enterprise:S9041","predicate":"uses","object":"ATTACK:enterprise:T1074.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff1a526c-156a-410c-bd80-f8e2f86b6c3a","modified":"2026-07-29T22:40:27.402Z","references":[{"source_name":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}