{"record":{"id":"ATTACK:enterprise:T1112","title":"Modify Registry","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1112","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--57340c81-c025-4189-8fa0-fc7ede51bae4","external_id":"T1112","domain":"enterprise","created":"2017-05-31T21:31:23.587Z","modified":"2026-09-11T19:48:51.536Z","version":"3.0","aliases":[],"tactics":["defense-impairment","persistence"],"source_references":[{"source_name":"CISA Russian Gov Critical Infra 2018","url":"https://www.cisa.gov/news-events/alerts/2018/03/15/russian-government-cyber-activity-targeting-energy-and-other-critical-infrastructure-sectors"},{"source_name":"CISA LockBit 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a"},{"source_name":"Avaddon Ransomware 2021","url":"https://arxiv.org/pdf/2102.04796"},{"source_name":"Microsoft BlackCat Jun 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"},{"source_name":"Microsoft Reg","url":"https://technet.microsoft.com/en-us/library/cc732643.aspx"},{"source_name":"Microsoft Remote","url":"https://technet.microsoft.com/en-us/library/cc754820.aspx"},{"source_name":"SpectorOps Hiding Reg Jul 2017","url":"https://posts.specterops.io/hiding-registry-keys-with-psreflect-b18ec5ac8353"},{"source_name":"Microsoft Reghide NOV 2006","url":"https://docs.microsoft.com/sysinternals/downloads/reghide"},{"source_name":"TrendMicro POWELIKS AUG 2014","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/poweliks-malware-hides-in-windows-registry/"},{"source_name":"Unit42 BabyShark Feb 2019","url":"https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"}]},"assertions":[{"id":"enterprise:relationship--0167fba6-d37d-46ba-bb07-5fc70b864b3f","subject":"ATTACK:enterprise:S0674","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0167fba6-d37d-46ba-bb07-5fc70b864b3f","modified":"2026-04-29T14:23:05.905Z","references":[{"source_name":"Check Point APT35 CharmPower January 2022","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--052acd65-b05a-4645-943b-1c53a717c419","subject":"ATTACK:enterprise:C0028","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--052acd65-b05a-4645-943b-1c53a717c419","modified":"2026-08-04T20:48:44.699Z","references":[{"source_name":"Booz Allen Hamilton","url":"https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--052be04b-5ff3-4757-a5c1-de012997accc","subject":"ATTACK:enterprise:G0010","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--052be04b-5ff3-4757-a5c1-de012997accc","modified":"2026-07-31T18:48:03.494Z","references":[{"source_name":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"},{"source_name":"Symantec Waterbug Jun 2019","url":"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--067ece2b-4e66-437f-88e0-8dc3f076331b","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--067ece2b-4e66-437f-88e0-8dc3f076331b","modified":"2026-04-29T14:23:05.912Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"CIRCL PlugX March 2013","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"},{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","url":"https://www.justice.gov/archives/opa/media/1384136/dl"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--072c3b1d-1ad6-447e-9512-2c6bc6e797fd","subject":"ATTACK:enterprise:S0596","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--072c3b1d-1ad6-447e-9512-2c6bc6e797fd","modified":"2026-04-29T14:23:05.913Z","references":[{"source_name":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"},{"source_name":"Kaspersky ShadowPad Aug 2017","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0775a1ba-c95a-472e-ab1c-d21108acc907","subject":"ATTACK:enterprise:S0457","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0775a1ba-c95a-472e-ab1c-d21108acc907","modified":"2026-04-29T14:23:05.913Z","references":[{"source_name":"TrendMicro Netwalker May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0841cd91-1151-411f-befc-0204e3a3eb30","subject":"ATTACK:enterprise:S0476","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0841cd91-1151-411f-befc-0204e3a3eb30","modified":"2026-04-29T14:23:05.915Z","references":[{"source_name":"Unit 42 Valak July 2020","url":"https://unit42.paloaltonetworks.com/valak-evolution/"},{"source_name":"SentinelOne Valak June 2020","url":"https://assets.sentinelone.com/labs/sentinel-one-valak-i"},{"source_name":"Cybereason Valak May 2020","url":"https://www.cybereason.com/blog/valak-more-than-meets-the-eye"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0ae212be-c07b-4f62-8c5e-9dfc0472254e","subject":"ATTACK:enterprise:S0240","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0ae212be-c07b-4f62-8c5e-9dfc0472254e","modified":"2026-04-29T14:23:05.918Z","references":[{"source_name":"Malwarebytes RokRAT VBA January 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0ccca05d-955c-40fa-9fd4-c10480abcf3d","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0ccca05d-955c-40fa-9fd4-c10480abcf3d","modified":"2026-07-31T20:48:23.030Z","references":[{"source_name":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0cf14628-b4c0-470a-9059-43fc562717d8","subject":"ATTACK:enterprise:S0376","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0cf14628-b4c0-470a-9059-43fc562717d8","modified":"2026-04-29T14:23:05.921Z","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0dd74596-509c-4669-9d29-e1fb501c9c70","subject":"ATTACK:enterprise:S0261","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0dd74596-509c-4669-9d29-e1fb501c9c70","modified":"2026-04-29T14:23:05.922Z","references":[{"source_name":"Symantec Catchamas April 2018","url":"https://web.archive.org/web/20190508165711/https://www-west.symantec.com/content/symantec/english/en/security-center/writeup.html/2018-040209-1742-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0f4c2cab-c3ca-4f31-8557-485248b65761","subject":"ATTACK:enterprise:S0032","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0f4c2cab-c3ca-4f31-8557-485248b65761","modified":"2026-04-29T14:23:05.925Z","references":[{"source_name":"Gh0stRAT ATT March 2019","url":"https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--109b2118-d714-41bb-a39d-b1fd1b755b55","subject":"ATTACK:enterprise:S0242","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--109b2118-d714-41bb-a39d-b1fd1b755b55","modified":"2026-04-29T14:23:05.926Z","references":[{"source_name":"SecureList SynAck Doppelgänging May 2018","url":"https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--10fb2420-a482-4909-90c6-fd9f7e5c24a6","subject":"ATTACK:enterprise:S0533","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--10fb2420-a482-4909-90c6-fd9f7e5c24a6","modified":"2026-04-29T14:23:05.927Z","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--150667a8-2155-4500-b7bb-c2d6bbc568b8","subject":"ATTACK:enterprise:S0608","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--150667a8-2155-4500-b7bb-c2d6bbc568b8","modified":"2026-04-29T14:23:05.933Z","references":[{"source_name":"SANS Conficker","url":"https://web.archive.org/web/20200125132645/https://www.sans.org/security-resources/malwarefaq/conficker-worm"},{"source_name":"Trend Micro Conficker","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/conficker"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--150f7dbe-3e64-4ee4-a621-6d416e53af63","subject":"ATTACK:enterprise:S1033","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--150f7dbe-3e64-4ee4-a621-6d416e53af63","modified":"2026-04-29T14:23:05.933Z","references":[{"source_name":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--15cd99f1-29b4-4603-ae74-fdc204afead4","subject":"ATTACK:enterprise:S0559","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--15cd99f1-29b4-4603-ae74-fdc204afead4","modified":"2026-04-29T14:23:05.934Z","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"},{"source_name":"Microsoft Analyzing Solorigate Dec 2020","url":"https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"},{"source_name":"Microsoft Deep Dive Solorigate January 2021","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1770cc28-c49c-4b70-b4d0-6976efaede16","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1770cc28-c49c-4b70-b4d0-6976efaede16","modified":"2026-07-31T20:48:26.171Z","references":[{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--178116a9-6ac9-45c0-bc74-36fe9ba12686","subject":"ATTACK:enterprise:S0569","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--178116a9-6ac9-45c0-bc74-36fe9ba12686","modified":"2026-04-29T14:23:05.936Z","references":[{"source_name":"CheckPoint Volatile Cedar March 2015","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--190057d5-13ad-40d2-a2f0-0177850e2905","subject":"ATTACK:enterprise:S0518","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--190057d5-13ad-40d2-a2f0-0177850e2905","modified":"2026-04-29T14:23:05.938Z","references":[{"source_name":"ESET Dukes October 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--19161920-e6b5-481f-a240-62f05c624010","subject":"ATTACK:enterprise:S0012","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--19161920-e6b5-481f-a240-62f05c624010","modified":"2026-04-29T14:23:05.939Z","references":[{"source_name":"Symantec Darkmoon Aug 2005","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2005-081910-3934-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1aae3796-86d5-4b31-ad21-e1dcc508a3b5","subject":"ATTACK:enterprise:S0669","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1aae3796-86d5-4b31-ad21-e1dcc508a3b5","modified":"2026-04-29T14:23:05.941Z","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1c4a31d0-3567-4081-93f5-14de47eabecf","subject":"ATTACK:enterprise:S1202","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1c4a31d0-3567-4081-93f5-14de47eabecf","modified":"2026-04-29T14:23:05.943Z","references":[{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"},{"source_name":"INCIBE-CERT LockBit MAR 2024","url":"https://www.incibe.es/en/incibe-cert/blog/lockbit-response-and-recovery-actions"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1cebf654-8955-4be0-b01f-392ffa2bad0a","subject":"ATTACK:enterprise:G0119","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1cebf654-8955-4be0-b01f-392ffa2bad0a","modified":"2026-07-31T18:47:35.286Z","references":[{"source_name":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1f5c6a39-aa0b-469e-aabe-67e4d237b213","subject":"ATTACK:enterprise:S0397","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1f5c6a39-aa0b-469e-aabe-67e4d237b213","modified":"2026-04-29T14:23:05.947Z","references":[{"source_name":"ESET LoJax Sept 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--202a6c36-ba18-4615-88ae-a6e0005eda71","subject":"ATTACK:enterprise:S1230","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--202a6c36-ba18-4615-88ae-a6e0005eda71","modified":"2026-04-29T14:23:05.949Z","references":[{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--202b96f6-0f7c-4aed-8004-780f1d880059","subject":"ATTACK:enterprise:S0158","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--202b96f6-0f7c-4aed-8004-780f1d880059","modified":"2026-04-29T14:23:05.949Z","references":[{"source_name":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--22af9ec6-fb67-4007-85f8-70a3be7f209f","subject":"ATTACK:enterprise:G1051","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--22af9ec6-fb67-4007-85f8-70a3be7f209f","modified":"2026-07-31T18:48:10.115Z","references":[{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2606ed25-9f1d-4e85-822a-af39ce0d8e66","subject":"ATTACK:enterprise:S0428","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2606ed25-9f1d-4e85-822a-af39ce0d8e66","modified":"2026-04-29T14:23:05.957Z","references":[{"source_name":"Talos PoetRAT April 2020","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2c927351-d98a-4734-83db-82ad3231e59f","subject":"ATTACK:enterprise:S0496","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2c927351-d98a-4734-83db-82ad3231e59f","modified":"2026-04-29T14:23:05.965Z","references":[{"source_name":"Secureworks REvil September 2019","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"},{"source_name":"Cylance Sodinokibi July 2019","url":"https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"},{"source_name":"Intel 471 REvil March 2020","url":"https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"},{"source_name":"McAfee Sodinokibi October 2019","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"},{"source_name":"Secureworks GandCrab and REvil September 2019","url":"https://www.secureworks.com/blog/revil-the-gandcrab-connection"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2dec6ce1-e459-4266-86d5-f336ab056f17","subject":"ATTACK:enterprise:S0031","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2dec6ce1-e459-4266-86d5-f336ab056f17","modified":"2026-04-29T14:23:05.967Z","references":[{"source_name":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2e126b9a-f902-4077-963e-64185c9544ff","subject":"ATTACK:enterprise:S0673","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2e126b9a-f902-4077-963e-64185c9544ff","modified":"2026-04-29T14:23:05.967Z","references":[{"source_name":"Prevailion DarkWatchman 2021","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2e53dad4-17cc-4fe6-a3b9-d622075d78f7","subject":"ATTACK:enterprise:S0531","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2e53dad4-17cc-4fe6-a3b9-d622075d78f7","modified":"2026-04-29T14:23:05.967Z","references":[{"source_name":"ESET Grandoreiro April 2020","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2e8e6362-ce7e-4fd5-8c9b-8b85b6f35a58","subject":"ATTACK:enterprise:S0011","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2e8e6362-ce7e-4fd5-8c9b-8b85b6f35a58","modified":"2026-04-29T14:23:05.967Z","references":[{"source_name":"CISA MAR-10292089-1.v2 TAIDOOR August 2021","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f11e661-a5a0-4420-b97e-b080fc4fa441","subject":"ATTACK:enterprise:S0603","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f11e661-a5a0-4420-b97e-b080fc4fa441","modified":"2026-04-29T14:23:05.969Z","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f603550-4368-4f34-89d9-50f69eed2fa9","subject":"ATTACK:enterprise:S0668","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f603550-4368-4f34-89d9-50f69eed2fa9","modified":"2026-04-29T14:23:05.971Z","references":[{"source_name":"Talos TinyTurla September 2021","url":"https://blog.talosintelligence.com/2021/09/tinyturla.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--321c1e2e-c295-42db-87cf-4d71f6c7f164","subject":"ATTACK:enterprise:S0267","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--321c1e2e-c295-42db-87cf-4d71f6c7f164","modified":"2026-04-29T14:23:05.983Z","references":[{"source_name":"FireEye FELIXROOT July 2018","url":"https://web.archive.org/web/20200607025424/https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--331f7990-d817-49ec-9d55-c4c64da7f4a6","subject":"ATTACK:enterprise:S0649","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--331f7990-d817-49ec-9d55-c4c64da7f4a6","modified":"2026-04-29T14:23:05.986Z","references":[{"source_name":"FireEye SMOKEDHAM June 2021","url":"https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--332ce4cd-311a-457f-ae10-6d8e3ef7bc77","subject":"ATTACK:enterprise:S0517","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--332ce4cd-311a-457f-ae10-6d8e3ef7bc77","modified":"2026-04-29T14:23:05.986Z","references":[{"source_name":"Trustwave Pillowmint June 2020","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--33823f15-f43f-41ef-bc14-7dea2ab21acf","subject":"ATTACK:enterprise:S0501","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--33823f15-f43f-41ef-bc14-7dea2ab21acf","modified":"2026-04-29T14:23:05.987Z","references":[{"source_name":"ESET PipeMon May 2020","url":"https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--35317fb7-9426-4f6e-9c78-64bb7a2da67f","subject":"ATTACK:enterprise:S1060","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--35317fb7-9426-4f6e-9c78-64bb7a2da67f","modified":"2026-04-29T14:23:05.990Z","references":[{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--396a5415-67aa-4ec6-ae27-6be641d69e15","subject":"ATTACK:enterprise:G0091","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--396a5415-67aa-4ec6-ae27-6be641d69e15","modified":"2026-07-31T18:48:21.086Z","references":[{"source_name":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3debe0d7-63bb-4e21-bf9b-ed5e23140e57","subject":"ATTACK:enterprise:G0092","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3debe0d7-63bb-4e21-bf9b-ed5e23140e57","modified":"2026-07-31T18:48:05.392Z","references":[{"source_name":"Korean FSI TA505 2020","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--40a8f80d-5497-4218-849c-3c0b63796641","subject":"ATTACK:enterprise:S0023","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--40a8f80d-5497-4218-849c-3c0b63796641","modified":"2026-04-29T14:23:06.013Z","references":[{"source_name":"FireEye APT28","url":"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--40b51ac6-d391-4fcb-ae32-79705d25301a","subject":"ATTACK:enterprise:S1181","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--40b51ac6-d391-4fcb-ae32-79705d25301a","modified":"2026-04-29T14:23:06.013Z","references":[{"source_name":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--41de9761-477c-4674-aea7-64a0b0b4ab4b","subject":"ATTACK:enterprise:S0697","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--41de9761-477c-4674-aea7-64a0b0b4ab4b","modified":"2026-04-29T14:23:06.015Z","references":[{"source_name":"SentinelOne Hermetic Wiper February 2022","url":"https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack"},{"source_name":"Crowdstrike DriveSlayer February 2022","url":"https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"},{"source_name":"Qualys Hermetic Wiper March 2022","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--42a2aec6-4efb-44d0-8ae8-32a208c05da6","subject":"ATTACK:enterprise:S0670","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--42a2aec6-4efb-44d0-8ae8-32a208c05da6","modified":"2026-04-29T14:23:06.016Z","references":[{"source_name":"Check Point Warzone Feb 2020","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"},{"source_name":"Uptycs Warzone UAC Bypass November 2020","url":"https://www.uptycs.com/blog/warzone-rat-comes-with-uac-bypass-technique"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--45376fe9-2a43-4e09-942e-82be661ed572","subject":"ATTACK:enterprise:S0154","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--45376fe9-2a43-4e09-942e-82be661ed572","modified":"2026-04-29T14:23:06.020Z","references":[{"source_name":"Talos Cobalt Strike September 2020","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--45f35ec0-73a8-42a6-b879-d800d27211c8","subject":"ATTACK:enterprise:G0073","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--45f35ec0-73a8-42a6-b879-d800d27211c8","modified":"2026-07-31T18:48:30.856Z","references":[{"source_name":"Unit 42 C0d0so0 Jan 2016","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4a2d2699-a2c0-40e4-8e8d-3450155b9923","subject":"ATTACK:enterprise:S1201","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4a2d2699-a2c0-40e4-8e8d-3450155b9923","modified":"2026-04-29T14:23:06.026Z","references":[{"source_name":"Zscaler Kimsuky TRANSLATEXT","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4d58ff48-b6d8-48ba-aa29-2f34d4dc1264","subject":"ATTACK:enterprise:S0527","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4d58ff48-b6d8-48ba-aa29-2f34d4dc1264","modified":"2026-04-29T14:23:06.030Z","references":[{"source_name":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--516712db-0e82-43a5-bd9f-f1a4cb4939c1","subject":"ATTACK:enterprise:S0666","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--516712db-0e82-43a5-bd9f-f1a4cb4939c1","modified":"2026-04-29T14:23:06.036Z","references":[{"source_name":"ESET Gelsemium June 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--519beaec-1b79-42d7-9739-8c22e896e0cd","subject":"ATTACK:enterprise:S0612","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--519beaec-1b79-42d7-9739-8c22e896e0cd","modified":"2026-04-29T14:23:06.037Z","references":[{"source_name":"NCC Group WastedLocker June 2020","url":"https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--51b34c1f-4e2f-4bb7-98a1-fa90ed873eba","subject":"ATTACK:enterprise:S1059","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--51b34c1f-4e2f-4bb7-98a1-fa90ed873eba","modified":"2026-04-29T14:23:06.037Z","references":[{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--52b695ee-33cb-445a-96b1-3fa074318d44","subject":"ATTACK:enterprise:S1178","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--52b695ee-33cb-445a-96b1-3fa074318d44","modified":"2026-04-29T14:23:06.038Z","references":[{"source_name":"Kaspersky ShrinkLocker 2024","url":"https://securelist.com/ransomware-abuses-bitlocker/112643/"},{"source_name":"Splunk ShrinkLocker 2024","url":"https://www.splunk.com/en_us/blog/security/shrinklocker-malware-abusing-bitlocker-to-lock-your-data.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--53d6538d-5b30-4503-94a3-077ddc428a3a","subject":"ATTACK:enterprise:S1226","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--53d6538d-5b30-4503-94a3-077ddc428a3a","modified":"2026-04-29T14:23:06.040Z","references":[{"source_name":"Unit42 Bookworm Nov2015","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--53e09f15-3162-4480-8eb4-709e9c18d7fb","subject":"ATTACK:enterprise:S0262","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--53e09f15-3162-4480-8eb4-709e9c18d7fb","modified":"2026-04-29T14:23:06.040Z","references":[{"source_name":"CISA AR18-352A Quasar RAT December 2018","url":"https://www.cisa.gov/uscert/ncas/analysis-reports/AR18-352A"},{"source_name":"GitHub QuasarRAT","url":"https://github.com/quasar/QuasarRAT"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--541855dd-0249-4f63-8e95-0024f760484e","subject":"ATTACK:enterprise:S0203","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--541855dd-0249-4f63-8e95-0024f760484e","modified":"2026-04-29T14:23:06.040Z","references":[{"source_name":"Symantec Trojan.Hydraq Jan 2010","url":"https://www.symantec.com/connect/blogs/trojanhydraq-incident"},{"source_name":"Symantec Hydraq Jan 2010","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--552afd93-370d-4f8e-b2c0-e27d9d7e050e","subject":"ATTACK:enterprise:S1068","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--552afd93-370d-4f8e-b2c0-e27d9d7e050e","modified":"2026-04-29T14:23:06.041Z","references":[{"source_name":"Microsoft BlackCat Jun 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--56b203da-eda9-4866-8a69-f978a1d34821","subject":"ATTACK:enterprise:G1043","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--56b203da-eda9-4866-8a69-f978a1d34821","modified":"2026-07-31T18:47:35.956Z","references":[{"source_name":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"Cisco BlackByte 2024","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--58bddfb4-2236-444b-8681-2b2e0fe1f7e2","subject":"ATTACK:enterprise:S1131","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--58bddfb4-2236-444b-8681-2b2e0fe1f7e2","modified":"2026-04-29T14:23:06.046Z","references":[{"source_name":"Huntress NPPSPY 2022","url":"https://www.huntress.com/blog/cleartext-shenanigans-gifting-user-passwords-to-adversaries-with-nppspy"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5abf323d-03be-4996-ab4b-89317883d0ab","subject":"ATTACK:enterprise:S1070","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5abf323d-03be-4996-ab4b-89317883d0ab","modified":"2026-04-29T14:23:06.049Z","references":[{"source_name":"Cyble Black Basta May 2022","url":"https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/"},{"source_name":"Palo Alto Networks Black Basta August 2022","url":"https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware"},{"source_name":"Trend Micro Black Basta May 2022","url":"https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html"},{"source_name":"NCC Group Black Basta June 2022","url":"https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/"},{"source_name":"Deep Instinct Black Basta August 2022","url":"https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence"},{"source_name":"Minerva Labs Black Basta May 2022","url":"https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5bbe7733-4e20-4ee1-a29c-b8e7111781dd","subject":"ATTACK:enterprise:S0254","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5bbe7733-4e20-4ee1-a29c-b8e7111781dd","modified":"2026-04-29T14:23:06.050Z","references":[{"source_name":"Rancor Unit42 June 2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5c89cacf-96fc-40e2-a6ed-b4d4f107cec3","subject":"ATTACK:enterprise:G0030","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5c89cacf-96fc-40e2-a6ed-b4d4f107cec3","modified":"2026-07-31T18:48:06.943Z","references":[{"source_name":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5cb4493b-1830-436a-8c1b-5aab2ef37442","subject":"ATTACK:enterprise:S1199","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5cb4493b-1830-436a-8c1b-5aab2ef37442","modified":"2026-04-29T14:23:06.052Z","references":[{"source_name":"FBI Lockbit 2.0 FEB 2022","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5edb6931-3262-40a9-acce-3016ac4153d4","subject":"ATTACK:enterprise:G0047","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5edb6931-3262-40a9-acce-3016ac4153d4","modified":"2026-07-31T18:47:47.687Z","references":[{"source_name":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source_name":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source_name":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--60202ca3-cadc-4756-99c8-a4b18e07d116","subject":"ATTACK:enterprise:S0692","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--60202ca3-cadc-4756-99c8-a4b18e07d116","modified":"2026-04-29T14:23:06.056Z","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--60a8cf92-7bd7-4e4a-9681-91d227b2609a","subject":"ATTACK:enterprise:S1190","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--60a8cf92-7bd7-4e4a-9681-91d227b2609a","modified":"2026-04-29T14:23:06.057Z","references":[{"source_name":"WithSecure Kapeka 2024","url":"https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Research-Kapeka.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--61360c2f-0a26-49ca-ac7c-2758fcd26ea2","subject":"ATTACK:enterprise:S0022","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--61360c2f-0a26-49ca-ac7c-2758fcd26ea2","modified":"2026-04-29T14:23:06.057Z","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--631ba90c-982c-4415-a13c-75cf06e53252","subject":"ATTACK:enterprise:S0579","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--631ba90c-982c-4415-a13c-75cf06e53252","modified":"2026-04-29T14:23:06.060Z","references":[{"source_name":"Trend Micro Waterbear December 2019","url":"https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6592447f-31c8-46d0-8e88-47584fa301f0","subject":"ATTACK:enterprise:S0157","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6592447f-31c8-46d0-8e88-47584fa301f0","modified":"2026-04-29T14:23:06.063Z","references":[{"source_name":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--66a7d5ae-7975-448d-ae40-b0786a3a8cd6","subject":"ATTACK:enterprise:C0002","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--66a7d5ae-7975-448d-ae40-b0786a3a8cd6","modified":"2026-07-31T18:47:30.939Z","references":[{"source_name":"McAfee Night Dragon","url":"https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--66f2f7b3-3df9-4d4a-bedc-ecacac3039e8","subject":"ATTACK:enterprise:S0332","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--66f2f7b3-3df9-4d4a-bedc-ecacac3039e8","modified":"2026-04-29T14:23:06.065Z","references":[{"source_name":"Riskiq Remcos Jan 2018","url":"https://web.archive.org/web/20180124082756/https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/"},{"source_name":"Fortinet Remcos Campaign NOV 2024","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--66f5e718-f910-487f-852a-98a8d752b0ba","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--66f5e718-f910-487f-852a-98a8d752b0ba","modified":"2026-04-29T14:23:06.065Z","references":[{"source_name":"ESET InvisiMole June 2018","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--676c5a2a-323b-4166-9c83-8c6e5e25bb1f","subject":"ATTACK:enterprise:S0455","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--676c5a2a-323b-4166-9c83-8c6e5e25bb1f","modified":"2026-04-29T14:23:06.066Z","references":[{"source_name":"Medium Metamorfo Apr 2020","url":"https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"},{"source_name":"Fortinet Metamorfo Feb 2020","url":"https://www.fortinet.com/blog/threat-research/another-metamorfo-variant-targeting-customers-of-financial-institutions"},{"source_name":"FireEye Metamorfo Apr 2018","url":"https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"},{"source_name":"ESET Casbaneiro Oct 2019","url":"https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--67e6b603-a45d-4cbc-9b3e-546392934f7f","subject":"ATTACK:enterprise:S0256","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--67e6b603-a45d-4cbc-9b3e-546392934f7f","modified":"2026-04-29T14:23:06.066Z","references":[{"source_name":"ESET Turla Mosquito Jan 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--69356661-76fb-46fe-94ce-d029ee7f8a64","subject":"ATTACK:enterprise:S0560","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--69356661-76fb-46fe-94ce-d029ee7f8a64","modified":"2026-04-29T14:23:06.068Z","references":[{"source_name":"Check Point Sunburst Teardrop December 2020","url":"https://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--69bff194-c90e-4e30-a369-57da4cff014d","subject":"ATTACK:enterprise:S0142","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--69bff194-c90e-4e30-a369-57da4cff014d","modified":"2026-04-29T14:23:06.069Z","references":[{"source_name":"Cylance Shell Crew Feb 2017","url":"https://www.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6bbefe61-008f-4298-8a9b-364c51ba7c20","subject":"ATTACK:enterprise:S1242","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6bbefe61-008f-4298-8a9b-364c51ba7c20","modified":"2026-04-29T14:23:06.072Z","references":[{"source_name":"Picus Qilin MAR 2025","url":"https://www.picussecurity.com/resource/blog/qilin-ransomware"},{"source_name":"Halcyon Qilin.B OCT 2024","url":"https://www.halcyon.ai/blog/new-qilin-b-ransomware-variant-boasts-enhanced-encryption-and-defense-evasion"},{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6d39de5f-6fbd-43e3-8da8-03a4cbe46656","subject":"ATTACK:enterprise:S0438","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6d39de5f-6fbd-43e3-8da8-03a4cbe46656","modified":"2026-04-29T14:23:06.074Z","references":[{"source_name":"ESET Attor Oct 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--70d725a6-f1d8-46e5-b857-b0cbd0249d6b","subject":"ATTACK:enterprise:S1132","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--70d725a6-f1d8-46e5-b857-b0cbd0249d6b","modified":"2026-04-29T14:23:06.079Z","references":[{"source_name":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--710919f6-2c74-4f41-be51-af848ad691af","subject":"ATTACK:enterprise:S0447","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--710919f6-2c74-4f41-be51-af848ad691af","modified":"2026-04-29T14:23:06.080Z","references":[{"source_name":"Talos Lokibot Jan 2021","url":"https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--713495d9-e481-4f48-af72-e3bfd474016b","subject":"ATTACK:enterprise:S0412","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--713495d9-e481-4f48-af72-e3bfd474016b","modified":"2026-04-29T14:23:06.080Z","references":[{"source_name":"Talos ZxShell Oct 2014","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7431e309-f379-45a5-ae7d-0520f6b17a94","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7431e309-f379-45a5-ae7d-0520f6b17a94","modified":"2026-04-29T14:23:06.084Z","references":[{"source_name":"Medium KONNI Jan 2020","url":"https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b"},{"source_name":"Malwarebytes Konni Aug 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--74e72fff-a4b9-4802-8eab-0555043d7304","subject":"ATTACK:enterprise:S1247","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--74e72fff-a4b9-4802-8eab-0555043d7304","modified":"2026-04-29T14:23:06.085Z","references":[{"source_name":"ESET Embargo Ransomware October 2024","url":"https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--75f0ea4c-5b88-4b14-9859-67379f4ba9b0","subject":"ATTACK:enterprise:G0102","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--75f0ea4c-5b88-4b14-9859-67379f4ba9b0","modified":"2026-07-31T20:48:50.300Z","references":[{"source_name":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source_name":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--76d2d007-1adb-4e04-8e79-dbd799ff57ef","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--76d2d007-1adb-4e04-8e79-dbd799ff57ef","modified":"2026-07-31T18:47:44.829Z","references":[{"source_name":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--77f8ae7e-c2a1-4c9e-95fd-e886ab57a218","subject":"ATTACK:enterprise:G0143","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--77f8ae7e-c2a1-4c9e-95fd-e886ab57a218","modified":"2026-07-31T18:47:59.332Z","references":[{"source_name":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7a097ec6-c379-4aef-849e-fe7d9ea1e7d1","subject":"ATTACK:enterprise:S0583","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7a097ec6-c379-4aef-849e-fe7d9ea1e7d1","modified":"2026-04-29T14:23:06.092Z","references":[{"source_name":"CERT-FR PYSA April 2020","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-003.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7ac875db-8d72-416b-93cf-2712d376d84e","subject":"ATTACK:enterprise:S9032","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7ac875db-8d72-416b-93cf-2712d376d84e","modified":"2026-04-29T14:23:06.093Z","references":[{"source_name":"ESET_MuddyWater_Dec2025","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7af7bfc3-7b1b-41aa-b162-47c222390815","subject":"ATTACK:enterprise:C0006","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7af7bfc3-7b1b-41aa-b162-47c222390815","modified":"2026-07-31T18:47:20.742Z","references":[{"source_name":"McAfee Honeybee","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e559e10-483a-42ca-8ddf-d8ca04ed8bd2","subject":"ATTACK:enterprise:S0245","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e559e10-483a-42ca-8ddf-d8ca04ed8bd2","modified":"2026-04-29T14:23:06.098Z","references":[{"source_name":"US-CERT BADCALL","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-G.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--81bb4898-aaa2-4dff-9af8-a97e6b69a95a","subject":"ATTACK:enterprise:M1024","predicate":"mitigates","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--81bb4898-aaa2-4dff-9af8-a97e6b69a95a","modified":"2026-04-29T14:23:06.103Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83aedf08-e8eb-4c18-80c1-727ddb0f1d07","subject":"ATTACK:enterprise:G1006","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83aedf08-e8eb-4c18-80c1-727ddb0f1d07","modified":"2026-07-31T20:48:48.267Z","references":[{"source_name":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83d63b2b-f287-4047-bbe4-82c8b100222a","subject":"ATTACK:enterprise:S0576","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83d63b2b-f287-4047-bbe4-82c8b100222a","modified":"2026-04-29T14:23:06.105Z","references":[{"source_name":"IBM MegaCortex","url":"https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86245eed-44d6-4a2a-ad83-1dd6a700a7be","subject":"ATTACK:enterprise:S1058","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86245eed-44d6-4a2a-ad83-1dd6a700a7be","modified":"2026-04-29T14:23:06.108Z","references":[{"source_name":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--87630bba-4308-46f2-9601-7d30795a2eb6","subject":"ATTACK:enterprise:S0511","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--87630bba-4308-46f2-9601-7d30795a2eb6","modified":"2026-04-29T14:23:06.110Z","references":[{"source_name":"ESET Dukes October 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8b3f4fd5-9acd-49e5-bae5-6996ae46aa0f","subject":"ATTACK:enterprise:G0108","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8b3f4fd5-9acd-49e5-bae5-6996ae46aa0f","modified":"2026-07-31T18:48:02.853Z","references":[{"source_name":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8c29eb34-02dd-42c8-9324-bfad5cde2fc7","subject":"ATTACK:enterprise:S0691","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8c29eb34-02dd-42c8-9324-bfad5cde2fc7","modified":"2026-04-29T14:23:06.116Z","references":[{"source_name":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8cb570d9-34be-40a7-9ef5-5ab34d89d476","subject":"ATTACK:enterprise:G0049","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8cb570d9-34be-40a7-9ef5-5ab34d89d476","modified":"2026-07-31T20:48:35.622Z","references":[{"source_name":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"},{"source_name":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8e8730bf-a7cd-4c35-9c6a-ae34552fe59c","subject":"ATTACK:enterprise:S9050","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8e8730bf-a7cd-4c35-9c6a-ae34552fe59c","modified":"2026-09-11T19:48:50.946Z","references":[{"source_name":"Logpoint_StealerMalwareFamilies_2024","url":"https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8eb5293f-e310-429c-a801-596feb3903a0","subject":"ATTACK:enterprise:S1011","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8eb5293f-e310-429c-a801-596feb3903a0","modified":"2026-04-29T14:23:06.119Z","references":[{"source_name":"Tarrask scheduled task","url":"https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8ecc61b0-c0b9-4f3a-a6b4-53c88e1d9bb7","subject":"ATTACK:enterprise:S0572","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8ecc61b0-c0b9-4f3a-a6b4-53c88e1d9bb7","modified":"2026-04-29T14:23:06.120Z","references":[{"source_name":"ClearSky Lebanese Cedar Jan 2021","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8edfde6c-1ede-41eb-bc84-0d98fe24bebd","subject":"ATTACK:enterprise:S0268","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8edfde6c-1ede-41eb-bc84-0d98fe24bebd","modified":"2026-04-29T14:23:06.120Z","references":[{"source_name":"Talos Bisonal Mar 2020","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--91c175b7-5c8e-4534-82b1-9bdb1b709a34","subject":"ATTACK:enterprise:S0467","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--91c175b7-5c8e-4534-82b1-9bdb1b709a34","modified":"2026-04-29T14:23:06.124Z","references":[{"source_name":"Kaspersky TajMahal April 2019","url":"https://securelist.com/project-tajmahal/90240/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--91f7282f-e496-462d-9fd5-6cf4d0170e91","subject":"ATTACK:enterprise:S0537","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--91f7282f-e496-462d-9fd5-6cf4d0170e91","modified":"2026-04-29T14:23:06.124Z","references":[{"source_name":"Accenture HyperStack October 2020","url":"https://web.archive.org/web/20201101015247/https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--924b50b9-7de3-4036-b732-c87d08971122","subject":"ATTACK:enterprise:S0115","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--924b50b9-7de3-4036-b732-c87d08971122","modified":"2026-04-29T14:23:06.124Z","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--93570192-4fb5-4d8a-98a7-1f4bb7c2b986","subject":"ATTACK:enterprise:G1003","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--93570192-4fb5-4d8a-98a7-1f4bb7c2b986","modified":"2026-07-31T18:48:13.281Z","references":[{"source_name":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--93addaa1-7baa-4fdd-ab92-3e58865a5ef2","subject":"ATTACK:enterprise:S0229","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--93addaa1-7baa-4fdd-ab92-3e58865a5ef2","modified":"2026-04-29T14:23:06.126Z","references":[{"source_name":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--94b4de9a-1f83-4923-8d4b-e9bafdb1bef9","subject":"ATTACK:enterprise:S0148","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--94b4de9a-1f83-4923-8d4b-e9bafdb1bef9","modified":"2026-04-29T14:23:06.128Z","references":[{"source_name":"ESET RTM Feb 2017","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--97b0f29c-343d-40fc-a37f-85d65ed26ba6","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--97b0f29c-343d-40fc-a37f-85d65ed26ba6","modified":"2026-07-31T18:47:40.825Z","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--983073e5-9115-46c2-ba78-17e1c111916d","subject":"ATTACK:enterprise:S1099","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--983073e5-9115-46c2-ba78-17e1c111916d","modified":"2026-04-29T14:23:06.132Z","references":[{"source_name":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--98b39362-d743-49be-b07e-748b19e12158","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--98b39362-d743-49be-b07e-748b19e12158","modified":"2026-07-31T18:47:31.798Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--99c360a2-7395-46e4-88fc-dbd757bed5bf","subject":"ATTACK:enterprise:G0035","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--99c360a2-7395-46e4-88fc-dbd757bed5bf","modified":"2026-07-31T20:48:28.533Z","references":[{"source_name":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--99eab281-6555-4aee-9d83-0e97bb3262ef","subject":"ATTACK:enterprise:S0488","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--99eab281-6555-4aee-9d83-0e97bb3262ef","modified":"2026-04-29T14:23:06.135Z","references":[{"source_name":"CME Github September 2018","url":"https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9f00ebba-7e80-4495-8ba0-081e6a8cc0c8","subject":"ATTACK:enterprise:G0078","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9f00ebba-7e80-4495-8ba0-081e6a8cc0c8","modified":"2026-07-31T18:47:42.757Z","references":[{"source_name":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9fbc10b3-f72e-4cc8-9e94-34c6404c3a1f","subject":"ATTACK:enterprise:S0350","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9fbc10b3-f72e-4cc8-9e94-34c6404c3a1f","modified":"2026-04-29T14:23:06.143Z","references":[{"source_name":"McAfee Night Dragon","url":"https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9fde7504-bd24-46f5-88d7-4afcb8d37f4a","subject":"ATTACK:enterprise:S0631","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9fde7504-bd24-46f5-88d7-4afcb8d37f4a","modified":"2026-04-29T14:23:06.143Z","references":[{"source_name":"Cybereason Chaes Nov 2020","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a21afd42-09ae-4e6b-a065-dc1b4454216d","subject":"ATTACK:enterprise:S0336","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a21afd42-09ae-4e6b-a065-dc1b4454216d","modified":"2026-04-29T14:23:06.145Z","references":[{"source_name":"DigiTrust NanoCore Jan 2017","url":"https://www.digitrustgroup.com/nanocore-not-your-average-rat/"},{"source_name":"PaloAlto NanoCore Feb 2016","url":"https://researchcenter.paloaltonetworks.com/2016/02/nanocorerat-behind-an-increase-in-tax-themed-phishing-e-mails/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a5c59466-b7ac-44a0-804d-cdfbc88c8fba","subject":"ATTACK:enterprise:S0611","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a5c59466-b7ac-44a0-804d-cdfbc88c8fba","modified":"2026-04-29T14:23:06.151Z","references":[{"source_name":"Cybereason Clop Dec 2020","url":"https://www.cybereason.com/blog/cybereason-vs.-clop-ransomware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a5f5eee7-6cc2-4eb4-b918-fc771b927abc","subject":"ATTACK:enterprise:S0665","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a5f5eee7-6cc2-4eb4-b918-fc771b927abc","modified":"2026-04-29T14:23:06.151Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a6252cbd-82a6-4cd6-a5f6-74507cd49f72","subject":"ATTACK:enterprise:S0386","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a6252cbd-82a6-4cd6-a5f6-74507cd49f72","modified":"2026-04-29T14:23:06.151Z","references":[{"source_name":"TrendMicro BKDR_URSNIF.SM","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_URSNIF.SM?_ga=2.129468940.1462021705.1559742358-1202584019.1549394279"},{"source_name":"ProofPoint Ursnif Aug 2016","url":"https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a679be02-156a-4e02-bfa5-ce07b60d147b","subject":"ATTACK:enterprise:S0441","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a679be02-156a-4e02-bfa5-ce07b60d147b","modified":"2026-04-29T14:23:06.152Z","references":[{"source_name":"Unit 42 Inception November 2018","url":"https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a71256aa-a2e3-447c-ba4e-004ba4f062b2","subject":"ATTACK:enterprise:S0045","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a71256aa-a2e3-447c-ba4e-004ba4f062b2","modified":"2026-04-29T14:23:06.153Z","references":[{"source_name":"Bitdefender APT28 Dec 2015","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a7c6693e-d1e2-4396-982f-85978c9b97a3","subject":"ATTACK:enterprise:S0568","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a7c6693e-d1e2-4396-982f-85978c9b97a3","modified":"2026-04-29T14:23:06.154Z","references":[{"source_name":"Prevailion EvilNum May 2020","url":"https://web.archive.org/web/20221209052853/https://www.prevailion.com/phantom-in-the-command-shell-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a8ead19f-6ea1-48e0-99e3-71ceb0360fcb","subject":"ATTACK:enterprise:S9051","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a8ead19f-6ea1-48e0-99e3-71ceb0360fcb","modified":"2026-09-23T21:19:14.554Z","references":[{"source_name":"CheckPointResearch_TheGentlemen_April2026","url":"https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a9a0ecce-239c-4666-94e9-ef1fb64cf796","subject":"ATTACK:enterprise:S0330","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a9a0ecce-239c-4666-94e9-ef1fb64cf796","modified":"2026-04-29T14:23:06.156Z","references":[{"source_name":"GDATA Zeus Panda June 2017","url":"https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ab11615f-a0d9-43c9-b71e-6ae83155bf3b","subject":"ATTACK:enterprise:S0343","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ab11615f-a0d9-43c9-b71e-6ae83155bf3b","modified":"2026-04-29T14:23:06.158Z","references":[{"source_name":"ESET TeleBots Oct 2018","url":"https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aea0804f-e322-401f-a012-c16c25e0ac70","subject":"ATTACK:enterprise:S0205","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aea0804f-e322-401f-a012-c16c25e0ac70","modified":"2026-04-29T14:23:06.163Z","references":[{"source_name":"Symantec Naid June 2012","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-061518-4639-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--af9347a3-00a9-4ece-b075-8c55bd4f4b9b","subject":"ATTACK:enterprise:S0140","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--af9347a3-00a9-4ece-b075-8c55bd4f4b9b","modified":"2026-04-29T14:23:06.164Z","references":[{"source_name":"Palo Alto Shamoon Nov 2016","url":"http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"},{"source_name":"FireEye Shamoon Nov 2016","url":"https://web.archive.org/web/20210126065851/https://www.fireeye.com/blog/threat-research/2016/11/fireeye_respondsto.html"},{"source_name":"McAfee Shamoon December 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/shamoon-returns-to-wipe-systems-in-middle-east-europe/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b01341a2-dacf-4780-acf9-3325f8597409","subject":"ATTACK:enterprise:S0663","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b01341a2-dacf-4780-acf9-3325f8597409","modified":"2026-04-29T14:23:06.165Z","references":[{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b29088a3-47cf-4799-a8e5-428472908d06","subject":"ATTACK:enterprise:G1014","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b29088a3-47cf-4799-a8e5-428472908d06","modified":"2026-07-31T18:48:14.987Z","references":[{"source_name":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source_name":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b2cf7d18-daa0-45a1-b2c1-6b6056bb19c4","subject":"ATTACK:enterprise:S0385","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b2cf7d18-daa0-45a1-b2c1-6b6056bb19c4","modified":"2026-04-29T14:23:06.169Z","references":[{"source_name":"Fidelis njRAT June 2013","url":"https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"},{"source_name":"Trend Micro njRAT 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b2d24622-d6ee-4a9f-84cc-ecb6efab9625","subject":"ATTACK:enterprise:S1047","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b2d24622-d6ee-4a9f-84cc-ecb6efab9625","modified":"2026-04-29T14:23:06.169Z","references":[{"source_name":"CYBERCOM Iranian Intel Cyber January 2022","url":"https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/"},{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b75982a3-8ba7-4a30-8ed8-894a1e2f75da","subject":"ATTACK:enterprise:S9025","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b75982a3-8ba7-4a30-8ed8-894a1e2f75da","modified":"2026-04-29T14:23:06.176Z","references":[{"source_name":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b7dfc429-1f62-4bb1-933f-25dfd4fff9ad","subject":"ATTACK:enterprise:S0342","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b7dfc429-1f62-4bb1-933f-25dfd4fff9ad","modified":"2026-04-29T14:23:06.176Z","references":[{"source_name":"ESET GreyEnergy Oct 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--baabf444-1748-472f-b991-7a5b25e4e1bb","subject":"ATTACK:enterprise:S0075","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--baabf444-1748-472f-b991-7a5b25e4e1bb","modified":"2026-04-29T14:23:06.180Z","references":[{"source_name":"Microsoft Reg","url":"https://technet.microsoft.com/en-us/library/cc732643.aspx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bad90106-a150-4d76-b39f-f35aab4ac766","subject":"ATTACK:enterprise:S0090","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bad90106-a150-4d76-b39f-f35aab4ac766","modified":"2026-04-29T14:23:06.180Z","references":[{"source_name":"Palo Alto Rover","url":"http://researchcenter.paloaltonetworks.com/2016/02/new-malware-rover-targets-indian-ambassador-to-afghanistan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bd8fec61-37c8-489b-a74b-424ff85222ad","subject":"ATTACK:enterprise:S0180","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bd8fec61-37c8-489b-a74b-424ff85222ad","modified":"2026-04-29T14:23:06.184Z","references":[{"source_name":"US-CERT Volgmer 2 Nov 2017","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-D_WHITE_S508C.PDF"},{"source_name":"Symantec Volgmer Aug 2014","url":"https://web.archive.org/web/20181126143456/https://www.symantec.com/security-center/writeup/2014-081811-3237-99?tabid=2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bef96df2-cc94-414d-8144-4c4875c59751","subject":"ATTACK:enterprise:S0660","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bef96df2-cc94-414d-8144-4c4875c59751","modified":"2026-04-29T14:23:06.186Z","references":[{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c039483a-5e0f-47be-b614-0d766eda9e0f","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c039483a-5e0f-47be-b614-0d766eda9e0f","modified":"2026-04-29T14:23:06.188Z","references":[{"source_name":"Group IB Ransomware September 2020","url":"https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"},{"source_name":"Red Canary Qbot","url":"https://redcanary.com/threat-detection-report/threats/qbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c0d119a2-c5f9-4c18-a18c-28bfa576ea9a","subject":"ATTACK:enterprise:S0239","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c0d119a2-c5f9-4c18-a18c-28bfa576ea9a","modified":"2026-04-29T14:23:06.189Z","references":[{"source_name":"US-CERT Bankshot Dec 2017","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c1566ee0-3ddb-4482-94dc-eb05e35e7afa","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c1566ee0-3ddb-4482-94dc-eb05e35e7afa","modified":"2026-07-31T20:48:25.420Z","references":[{"source_name":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source_name":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source_name":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source_name":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c2496cf4-b502-44cf-ae85-efb9b882a4b1","subject":"ATTACK:enterprise:S0126","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c2496cf4-b502-44cf-ae85-efb9b882a4b1","modified":"2026-04-29T14:23:06.191Z","references":[{"source_name":"CISA ComRAT Oct 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303a"},{"source_name":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c27ceec5-2eaf-4b3b-8120-9fb691d6458b","subject":"ATTACK:enterprise:S0640","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c27ceec5-2eaf-4b3b-8120-9fb691d6458b","modified":"2026-04-29T14:23:06.191Z","references":[{"source_name":"Arxiv Avaddon Feb 2021","url":"https://arxiv.org/pdf/2102.04796.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c2c31b26-7e42-43b6-964b-c959cabc53a4","subject":"ATTACK:enterprise:S1025","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c2c31b26-7e42-43b6-964b-c959cabc53a4","modified":"2026-04-29T14:23:06.191Z","references":[{"source_name":"BlackBerry Amadey 2020","url":"https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c5c1bf20-d215-41cb-a5d2-4388a1ca5e59","subject":"ATTACK:enterprise:S1180","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c5c1bf20-d215-41cb-a5d2-4388a1ca5e59","modified":"2026-04-29T14:23:06.196Z","references":[{"source_name":"Trustwave BlackByte 2021","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c75ec383-2acd-479f-b9b7-b2038ec10a7d","subject":"ATTACK:enterprise:S0266","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c75ec383-2acd-479f-b9b7-b2038ec10a7d","modified":"2026-04-29T14:23:06.198Z","references":[{"source_name":"Trend Micro Trickbot Nov 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-shows-off-new-trick-password-grabber-module/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c8475b1b-c98f-4fdc-89dd-c9b04e6fbd9c","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c8475b1b-c98f-4fdc-89dd-c9b04e6fbd9c","modified":"2026-07-31T20:48:27.529Z","references":[{"source_name":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source_name":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c88e7db9-47b1-4fe9-943a-98ebde29980b","subject":"ATTACK:enterprise:S0334","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c88e7db9-47b1-4fe9-943a-98ebde29980b","modified":"2026-04-29T14:23:06.199Z","references":[{"source_name":"TrendMicro DarkComet Sept 2014","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET"},{"source_name":"Malwarebytes DarkComet March 2018","url":"https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cacbb779-a901-470f-9bb2-cc2d98088713","subject":"ATTACK:enterprise:G0059","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cacbb779-a901-470f-9bb2-cc2d98088713","modified":"2026-07-31T18:48:29.373Z","references":[{"source_name":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ceb66bd9-3e75-4559-a0b9-3339a926cde6","subject":"ATTACK:enterprise:S0263","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ceb66bd9-3e75-4559-a0b9-3339a926cde6","modified":"2026-04-29T14:23:06.208Z","references":[{"source_name":"US-CERT TYPEFRAME June 2018","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d45fe5a0-f9e5-4f05-b40b-8693c8eab0f7","subject":"ATTACK:enterprise:S1050","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d45fe5a0-f9e5-4f05-b40b-8693c8eab0f7","modified":"2026-04-29T14:23:06.215Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d4f0554e-46bb-4fd5-94e8-900dfe3198cf","subject":"ATTACK:enterprise:S0271","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d4f0554e-46bb-4fd5-94e8-900dfe3198cf","modified":"2026-04-29T14:23:06.216Z","references":[{"source_name":"US-CERT KEYMARBLE Aug 2018","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-221A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d52b8760-abba-46f0-8c82-653b95cb2775","subject":"ATTACK:enterprise:S0679","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d52b8760-abba-46f0-8c82-653b95cb2775","modified":"2026-04-29T14:23:06.217Z","references":[{"source_name":"Kaspersky WIRTE November 2021","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d6bb4c39-f4d1-41aa-8b0a-363f198ed6ab","subject":"ATTACK:enterprise:S1066","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d6bb4c39-f4d1-41aa-8b0a-363f198ed6ab","modified":"2026-04-29T14:23:06.219Z","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d6d05488-44f6-4018-9e40-d8b9c98b68b6","subject":"ATTACK:enterprise:C0058","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d6d05488-44f6-4018-9e40-d8b9c98b68b6","modified":"2026-07-31T18:47:19.162Z","references":[{"source_name":"Microsoft SharePoint Exploit JUL 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d7983dcd-1970-4d84-82e7-a61d2125caeb","subject":"ATTACK:enterprise:S0348","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d7983dcd-1970-4d84-82e7-a61d2125caeb","modified":"2026-04-29T14:23:06.220Z","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d9cd513e-c863-4695-a6e0-b2e4e79c24e8","subject":"ATTACK:enterprise:S0331","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d9cd513e-c863-4695-a6e0-b2e4e79c24e8","modified":"2026-04-29T14:23:06.223Z","references":[{"source_name":"SentinelLabs Agent Tesla Aug 2020","url":"https://labs.sentinelone.com/agent-tesla-old-rat-uses-new-tricks-to-stay-on-top/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dd0dbfef-065c-47c9-a9e3-ac8d02f7ca42","subject":"ATTACK:enterprise:S1090","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dd0dbfef-065c-47c9-a9e3-ac8d02f7ca42","modified":"2026-04-29T14:23:06.227Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e0999d7e-deec-446b-a86b-4c8988e20a96","subject":"ATTACK:enterprise:S0269","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e0999d7e-deec-446b-a86b-4c8988e20a96","modified":"2026-04-29T14:23:06.231Z","references":[{"source_name":"Unit 42 QUADAGENT July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e0c53a14-01d3-42f6-9dea-6cb60ac72025","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e0c53a14-01d3-42f6-9dea-6cb60ac72025","modified":"2026-04-29T14:23:06.231Z","references":[{"source_name":"Red Canary NETWIRE January 2020","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e41eea8b-20d6-4050-96e6-6b59670f6e65","subject":"ATTACK:enterprise:S0589","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e41eea8b-20d6-4050-96e6-6b59670f6e65","modified":"2026-04-29T14:23:06.236Z","references":[{"source_name":"MSTIC NOBELIUM Mar 2021","url":"https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e811f6e8-a736-4bb8-8cd9-c6edc9a7ebd8","subject":"ATTACK:enterprise:S0570","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e811f6e8-a736-4bb8-8cd9-c6edc9a7ebd8","modified":"2026-04-29T14:23:06.241Z","references":[{"source_name":"Crowdstrike Indrik November 2018","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea54979f-3e4c-459c-bfaa-1435e36729e1","subject":"ATTACK:enterprise:S1149","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea54979f-3e4c-459c-bfaa-1435e36729e1","modified":"2026-04-29T14:23:06.244Z","references":[{"source_name":"Mandiant ROADSWEEP August 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eb93689a-f815-4d93-ba6d-6104a60d9a9e","subject":"ATTACK:enterprise:S9023","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eb93689a-f815-4d93-ba6d-6104a60d9a9e","modified":"2026-04-29T14:23:06.246Z","references":[{"source_name":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ec72af45-d362-41c1-99d1-7a225a823049","subject":"ATTACK:enterprise:S0662","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ec72af45-d362-41c1-99d1-7a225a823049","modified":"2026-04-29T14:23:06.247Z","references":[{"source_name":"Profero APT27 December 2020","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"},{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eebf3764-7500-4798-9a78-3119691a3170","subject":"ATTACK:enterprise:G1044","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eebf3764-7500-4798-9a78-3119691a3170","modified":"2026-07-31T18:48:16.550Z","references":[{"source_name":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eff4cf6d-b84d-4fd9-9fd5-1b7f5d06fbad","subject":"ATTACK:enterprise:G1031","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eff4cf6d-b84d-4fd9-9fd5-1b7f5d06fbad","modified":"2026-07-31T18:48:00.456Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f7ded6a1-043e-437a-8a0c-00ded73e5289","subject":"ATTACK:enterprise:S0210","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f7ded6a1-043e-437a-8a0c-00ded73e5289","modified":"2026-04-29T14:23:06.262Z","references":[{"source_name":"Symantec Nerex May 2012","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-051515-3445-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f81b567d-9fd3-44f4-bd6b-9ba6f386609e","subject":"ATTACK:enterprise:S0444","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f81b567d-9fd3-44f4-bd6b-9ba6f386609e","modified":"2026-04-29T14:23:06.262Z","references":[{"source_name":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f88fcb22-698b-4901-b894-a597192c2ba3","subject":"ATTACK:enterprise:G0027","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f88fcb22-698b-4901-b894-a597192c2ba3","modified":"2026-07-31T18:48:29.952Z","references":[{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"},{"source_name":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f8ff17c3-2921-40c2-b4a9-19ee7678397a","subject":"ATTACK:enterprise:G0061","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f8ff17c3-2921-40c2-b4a9-19ee7678397a","modified":"2026-07-31T18:48:30.147Z","references":[{"source_name":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--faa657c6-e223-4b45-8f92-b35fbd76bd56","subject":"ATTACK:enterprise:S0677","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--faa657c6-e223-4b45-8f92-b35fbd76bd56","modified":"2026-04-29T14:23:06.265Z","references":[{"source_name":"AADInternals Documentation","url":"https://o365blog.com/aadinternals"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fe3c4134-ddef-45f8-b83a-6865a01b9764","subject":"ATTACK:enterprise:S0019","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fe3c4134-ddef-45f8-b83a-6865a01b9764","modified":"2026-04-29T14:23:06.270Z","references":[{"source_name":"Kaspersky Regin","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070305/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff495a54-08f1-4b0f-b44d-6bbeb5240225","subject":"ATTACK:enterprise:S0664","predicate":"uses","object":"ATTACK:enterprise:T1112","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff495a54-08f1-4b0f-b44d-6bbeb5240225","modified":"2026-04-29T14:23:06.272Z","references":[{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}