{"record":{"id":"ATTACK:enterprise:T1125","title":"Video Capture","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1125","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--6faf650d-bf31-4eb4-802d-1000cf38efaf","external_id":"T1125","domain":"enterprise","created":"2017-05-31T21:31:37.917Z","modified":"2026-05-12T15:12:00.641Z","version":"1.2","aliases":[],"tactics":["collection"],"source_references":[{"source_name":"objective-see 2017 review","url":"https://objective-see.com/blog/blog_0x25.html"}]},"assertions":[{"id":"enterprise:relationship--03d08c76-d8ce-435a-bac1-9cb77cdbaa0c","subject":"ATTACK:enterprise:S0363","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--03d08c76-d8ce-435a-bac1-9cb77cdbaa0c","modified":"2026-04-29T14:23:05.908Z","references":[{"source_name":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--07939f42-c9ce-442f-a922-6c3560ac5ddc","subject":"ATTACK:enterprise:S0660","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--07939f42-c9ce-442f-a922-6c3560ac5ddc","modified":"2026-04-29T14:23:05.914Z","references":[{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"Talent-Jump Clambling February 2020","url":"https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0ebd7231-9228-44b6-a4d8-9131eb40bbb3","subject":"ATTACK:enterprise:S0115","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0ebd7231-9228-44b6-a4d8-9131eb40bbb3","modified":"2026-04-29T14:23:05.924Z","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Kaspersky Transparent Tribe August 2020","url":"https://securelist.com/transparent-tribe-part-1/98127/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--15c3f3a3-03c9-4591-a2d2-64b5eafbd4a7","subject":"ATTACK:enterprise:S0467","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--15c3f3a3-03c9-4591-a2d2-64b5eafbd4a7","modified":"2026-04-29T14:23:05.934Z","references":[{"source_name":"Kaspersky TajMahal April 2019","url":"https://securelist.com/project-tajmahal/90240/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--17bee216-d5ff-4e66-b221-0129be41b4f5","subject":"ATTACK:enterprise:S0338","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--17bee216-d5ff-4e66-b221-0129be41b4f5","modified":"2026-04-29T14:23:05.937Z","references":[{"source_name":"Zscaler Cobian Aug 2017","url":"https://www.zscaler.com/blogs/research/cobian-rat-backdoored-rat"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1efc9685-b2ab-46fb-91a9-a305d6c1f335","subject":"ATTACK:enterprise:S0336","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1efc9685-b2ab-46fb-91a9-a305d6c1f335","modified":"2026-04-29T14:23:05.947Z","references":[{"source_name":"DigiTrust NanoCore Jan 2017","url":"https://www.digitrustgroup.com/nanocore-not-your-average-rat/"},{"source_name":"PaloAlto NanoCore Feb 2016","url":"https://researchcenter.paloaltonetworks.com/2016/02/nanocorerat-behind-an-increase-in-tax-themed-phishing-e-mails/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2043a8a7-d365-4f5c-9ee3-5b9be710f14d","subject":"ATTACK:enterprise:S0283","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2043a8a7-d365-4f5c-9ee3-5b9be710f14d","modified":"2026-04-29T14:23:05.949Z","references":[{"source_name":"jRAT Symantec Aug 2018","url":"https://www.symantec.com/blogs/threat-intelligence/jrat-new-anti-parsing-techniques"},{"source_name":"Kaspersky Adwind Feb 2016","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--293f103b-ab5f-46ee-b51e-c111370f3b79","subject":"ATTACK:enterprise:S0409","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--293f103b-ab5f-46ee-b51e-c111370f3b79","modified":"2026-04-29T14:23:05.961Z","references":[{"source_name":"Securelist Machete Aug 2014","url":"https://securelist.com/el-machete/66108/"},{"source_name":"Cylance Machete Mar 2017","url":"https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"},{"source_name":"360 Machete Sep 2020","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2dc986cb-ed76-42ba-9dd9-edaba07b0cc7","subject":"ATTACK:enterprise:S0379","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2dc986cb-ed76-42ba-9dd9-edaba07b0cc7","modified":"2026-04-29T14:23:05.966Z","references":[{"source_name":"Cofense RevengeRAT Feb 2019","url":"https://web.archive.org/web/20200428173819/https://cofense.com/upgrades-delivery-support-infrastructure-revenge-rat-malware-bigger-threat/"},{"source_name":"Cylance Shaheen Nov 2018","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30b85048-ba1f-4b43-b9bc-69c27e426039","subject":"ATTACK:enterprise:S0334","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30b85048-ba1f-4b43-b9bc-69c27e426039","modified":"2026-04-29T14:23:05.978Z","references":[{"source_name":"TrendMicro DarkComet Sept 2014","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET"},{"source_name":"Malwarebytes DarkComet March 2018","url":"https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30be2552-9794-4eef-b3b6-fa663f68784b","subject":"ATTACK:enterprise:S0385","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30be2552-9794-4eef-b3b6-fa663f68784b","modified":"2026-04-29T14:23:05.978Z","references":[{"source_name":"Fidelis njRAT June 2013","url":"https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"},{"source_name":"Citizen Lab Group5","url":"https://citizenlab.ca/2016/08/group5-syria/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--49efe6c7-aec6-4e54-bc7d-212816e23347","subject":"ATTACK:enterprise:S0331","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--49efe6c7-aec6-4e54-bc7d-212816e23347","modified":"2026-04-29T14:23:06.026Z","references":[{"source_name":"DigiTrust Agent Tesla Jan 2017","url":"https://www.digitrustgroup.com/agent-tesla-keylogger/"},{"source_name":"Talos Agent Tesla Oct 2018","url":"https://blog.talosintelligence.com/2018/10/old-dog-new-tricks-analysing-new-rtf_15.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4c823ae9-ac1e-4f09-bb1a-5e573938fc29","subject":"ATTACK:enterprise:G1003","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4c823ae9-ac1e-4f09-bb1a-5e573938fc29","modified":"2026-07-31T18:48:13.048Z","references":[{"source_name":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--52ad9918-ffba-4897-bbdc-261504094339","subject":"ATTACK:enterprise:S0428","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--52ad9918-ffba-4897-bbdc-261504094339","modified":"2026-04-29T14:23:06.038Z","references":[{"source_name":"Talos PoetRAT April 2020","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5e60c70a-7b2f-45b8-b7d4-80e214acfb2d","subject":"ATTACK:enterprise:G0091","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5e60c70a-7b2f-45b8-b7d4-80e214acfb2d","modified":"2026-07-31T18:48:21.137Z","references":[{"source_name":"SecureList Silence Nov 2017","url":"https://securelist.com/the-silence/83009/"},{"source_name":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--62bf12af-cf11-48e7-8963-4fdf3e23fea0","subject":"ATTACK:enterprise:S0434","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--62bf12af-cf11-48e7-8963-4fdf3e23fea0","modified":"2026-04-29T14:23:06.059Z","references":[{"source_name":"Imminent Unit42 Dec2019","url":"https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-down-under/"},{"source_name":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--63c952f9-1fec-46db-a2f3-f87114180f25","subject":"ATTACK:enterprise:S0591","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--63c952f9-1fec-46db-a2f3-f87114180f25","modified":"2026-04-29T14:23:06.061Z","references":[{"source_name":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6782d7bb-5e81-4656-9445-fbd6ae1f2bdb","subject":"ATTACK:enterprise:S0152","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6782d7bb-5e81-4656-9445-fbd6ae1f2bdb","modified":"2026-04-29T14:23:06.066Z","references":[{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--79852ad8-86ff-4747-97c0-1c7faa5fa69d","subject":"ATTACK:enterprise:S0265","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--79852ad8-86ff-4747-97c0-1c7faa5fa69d","modified":"2026-04-29T14:23:06.091Z","references":[{"source_name":"Unit 42 Kazuar May 2017","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--84094d38-2a22-4d9a-b570-72e45baf17ab","subject":"ATTACK:enterprise:S1087","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--84094d38-2a22-4d9a-b570-72e45baf17ab","modified":"2026-04-29T14:23:06.106Z","references":[{"source_name":"AsyncRAT GitHub","url":"https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp/blob/master/README.md"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--88d48848-1f23-4d91-8934-045d04b219ea","subject":"ATTACK:enterprise:S0461","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--88d48848-1f23-4d91-8934-045d04b219ea","modified":"2026-04-29T14:23:06.112Z","references":[{"source_name":"IBM TA505 April 2020","url":"https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"},{"source_name":"Proofpoint TA505 October 2019","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--91926031-c1b4-462b-8597-20b10e7211ef","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--91926031-c1b4-462b-8597-20b10e7211ef","modified":"2026-07-31T20:48:32.037Z","references":[{"source_name":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"},{"source_name":"DOJ FIN7 Aug 2018","url":"https://www.justice.gov/opa/press-release/file/1084361/download"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a4485212-aea0-4cf0-b7f1-79b3048d910f","subject":"ATTACK:enterprise:S1209","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a4485212-aea0-4cf0-b7f1-79b3048d910f","modified":"2026-04-29T14:23:06.148Z","references":[{"source_name":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"},{"source_name":"Microsoft Quick Assist 2024","url":"https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aa9b33a5-81b2-4126-b8f5-0182ec365fc8","subject":"ATTACK:enterprise:S0412","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aa9b33a5-81b2-4126-b8f5-0182ec365fc8","modified":"2026-04-29T14:23:06.157Z","references":[{"source_name":"Talos ZxShell Oct 2014","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aba4daa2-5022-4fe9-8359-7c0af1f58b86","subject":"ATTACK:enterprise:S0670","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aba4daa2-5022-4fe9-8359-7c0af1f58b86","modified":"2026-04-29T14:23:06.158Z","references":[{"source_name":"Check Point Warzone Feb 2020","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"},{"source_name":"Uptycs Warzone UAC Bypass November 2020","url":"https://www.uptycs.com/blog/warzone-rat-comes-with-uac-bypass-technique"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c18f83e7-979e-4bd8-80bb-d0a4e8146a21","subject":"ATTACK:enterprise:S0192","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c18f83e7-979e-4bd8-80bb-d0a4e8146a21","modified":"2026-04-29T14:23:06.190Z","references":[{"source_name":"GitHub Pupy","url":"https://github.com/n1nj4sec/pupy"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4f9c2ad-f740-4b08-9788-c058b98f2094","subject":"ATTACK:enterprise:S0234","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4f9c2ad-f740-4b08-9788-c058b98f2094","modified":"2026-04-29T14:23:06.194Z","references":[{"source_name":"EFF Manul Aug 2016","url":"https://www.eff.org/files/2016/08/03/i-got-a-letter-from-the-government.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c73f5693-e40c-48a9-b41c-8207f7180523","subject":"ATTACK:enterprise:S0332","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c73f5693-e40c-48a9-b41c-8207f7180523","modified":"2026-04-29T14:23:06.197Z","references":[{"source_name":"Fortinet Remcos Feb 2017","url":"https://www.fortinet.com/blog/threat-research/remcos-a-new-rat-in-the-wild-2.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cfd35b85-8048-4c8f-9176-603744eecfce","subject":"ATTACK:enterprise:G1055","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cfd35b85-8048-4c8f-9176-603744eecfce","modified":"2026-07-31T18:48:25.978Z","references":[{"source_name":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d2067a75-0d5d-4899-9d9f-6537d98296c1","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d2067a75-0d5d-4899-9d9f-6537d98296c1","modified":"2026-04-29T14:23:06.213Z","references":[{"source_name":"ESET InvisiMole June 2018","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d953a664-5a8f-45a9-a3e6-819cb2cef2c7","subject":"ATTACK:enterprise:S0021","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d953a664-5a8f-45a9-a3e6-819cb2cef2c7","modified":"2026-04-29T14:23:06.222Z","references":[{"source_name":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e31c20e8-f6f7-4ebb-89e0-51c34597c379","subject":"ATTACK:enterprise:S0644","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e31c20e8-f6f7-4ebb-89e0-51c34597c379","modified":"2026-04-29T14:23:06.234Z","references":[{"source_name":"Talos Oblique RAT March 2021","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e5a2a20c-1ef7-49a9-a9fa-2b89231793b8","subject":"ATTACK:enterprise:S0098","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e5a2a20c-1ef7-49a9-a9fa-2b89231793b8","modified":"2026-04-29T14:23:06.238Z","references":[{"source_name":"Palo Alto T9000 Feb 2016","url":"http://researchcenter.paloaltonetworks.com/2016/02/t9000-advanced-modular-backdoor-uses-complex-anti-analysis-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f3c0c3c1-e7a9-46ae-94cf-e128120a7c5f","subject":"ATTACK:enterprise:S0262","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f3c0c3c1-e7a9-46ae-94cf-e128120a7c5f","modified":"2026-04-29T14:23:06.256Z","references":[{"source_name":"GitHub QuasarRAT","url":"https://github.com/quasar/QuasarRAT"},{"source_name":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fd9c0570-d19a-49b6-a354-d3eaa25b00f2","subject":"ATTACK:enterprise:S1050","predicate":"uses","object":"ATTACK:enterprise:T1125","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fd9c0570-d19a-49b6-a354-d3eaa25b00f2","modified":"2026-04-29T14:23:06.269Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}