Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference.
{
  "record": {
    "id": "ATTACK:enterprise:T1132.001",
    "title": "Standard Encoding",
    "type": "Subtechnique",
    "source_url": "https://attack.mitre.org/techniques/T1132/001",
    "snapshot": "enterprise-attack-20.0.json",
    "status": "active",
    "rights": "Source metadata only; source notices retained; no operational prose or payloads",
    "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
    "stix_id": "attack-pattern--04fd5427-79c7-44ea-ae13-11b24778ff1c",
    "external_id": "T1132.001",
    "domain": "enterprise",
    "created": "2020-03-14T23:36:52.095Z",
    "modified": "2026-09-03T19:46:40.081Z",
    "version": "1.1",
    "aliases": [

    ],
    "tactics": [
      "command-and-control"
    ],
    "source_references": [
      {
        "source_name": "University of Birmingham C2",
        "url": "https://arxiv.org/pdf/1408.1136"
      },
      {
        "source_name": "Wikipedia Binary-to-text Encoding",
        "url": "https://en.wikipedia.org/wiki/Binary-to-text_encoding"
      },
      {
        "source_name": "Wikipedia Character Encoding",
        "url": "https://en.wikipedia.org/wiki/Character_encoding"
      }
    ]
  },
  "assertions": [
    {
      "id": "enterprise:relationship--0b71ce5b-7174-4491-8890-c699d93907e7",
      "subject": "ATTACK:enterprise:S0610",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0b71ce5b-7174-4491-8890-c699d93907e7",
      "modified": "2026-09-03T19:46:46.249Z",
      "references": [
        {
          "source_name": "Check Point APT34 April 2021",
          "url": "https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0edefa7f-0b1b-48b7-ab51-e0107b48c683",
      "subject": "ATTACK:enterprise:S0410",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0edefa7f-0b1b-48b7-ab51-e0107b48c683",
      "modified": "2026-09-03T19:46:46.348Z",
      "references": [
        {
          "source_name": "Fysbis Dr Web Analysis",
          "url": "https://vms.drweb.com/virus/?i=4276269"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0f41364e-e72b-4186-980f-a5a5a5d07395",
      "subject": "ATTACK:enterprise:S1021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0f41364e-e72b-4186-980f-a5a5a5d07395",
      "modified": "2026-09-03T19:46:46.492Z",
      "references": [
        {
          "source_name": "Zscaler Lyceum DnsSystem June 2022",
          "url": "https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--103f1ad4-feec-4be3-9da7-ee0b2503c318",
      "subject": "ATTACK:enterprise:S0045",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--103f1ad4-feec-4be3-9da7-ee0b2503c318",
      "modified": "2026-09-03T19:46:46.603Z",
      "references": [
        {
          "source_name": "Kaspersky Sofacy",
          "url": "https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--118c427e-fcd2-4464-a32a-a6edb0d6ead5",
      "subject": "ATTACK:enterprise:S0696",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--118c427e-fcd2-4464-a32a-a6edb0d6ead5",
      "modified": "2026-09-03T19:46:46.694Z",
      "references": [
        {
          "source_name": "NTT Security Flagpro new December 2021",
          "url": "https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--130f35b1-17d5-45bf-9000-2040adbcc56c",
      "subject": "ATTACK:enterprise:S0603",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--130f35b1-17d5-45bf-9000-2040adbcc56c",
      "modified": "2026-09-03T19:46:46.841Z",
      "references": [
        {
          "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
          "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--13c97dd2-5c0b-4f18-84ab-533949fbeb25",
      "subject": "ATTACK:enterprise:S0053",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--13c97dd2-5c0b-4f18-84ab-533949fbeb25",
      "modified": "2026-09-03T19:46:47.146Z",
      "references": [
        {
          "source_name": "Unit 42 SeaDuke 2015",
          "url": "http://researchcenter.paloaltonetworks.com/2015/07/unit-42-technical-analysis-seaduke/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--14bcff67-6ecb-4a0a-9fcf-5b5ea72a6f06",
      "subject": "ATTACK:enterprise:S1160",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--14bcff67-6ecb-4a0a-9fcf-5b5ea72a6f06",
      "modified": "2026-09-03T19:46:47.347Z",
      "references": [
        {
          "source_name": "Latrodectus APR 2024",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"
        },
        {
          "source_name": "Elastic Latrodectus May 2024",
          "url": "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--17ea71a2-4be4-434a-956c-79ec00d010f6",
      "subject": "ATTACK:enterprise:S1196",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--17ea71a2-4be4-434a-956c-79ec00d010f6",
      "modified": "2026-09-03T19:46:47.485Z",
      "references": [
        {
          "source_name": "S2W Troll Stealer 2024",
          "url": "https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--185020c6-9b2a-4b08-8936-7d407ea753b4",
      "subject": "ATTACK:enterprise:G0034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--185020c6-9b2a-4b08-8936-7d407ea753b4",
      "modified": "2026-09-03T19:46:47.667Z",
      "references": [
        {
          "source_name": "ESET Telebots Dec 2016",
          "url": "https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1a82f449-eb3f-4b9a-9eaa-f30a66f1d0ef",
      "subject": "ATTACK:enterprise:S9063",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1a82f449-eb3f-4b9a-9eaa-f30a66f1d0ef",
      "modified": "2026-10-01T18:25:59.976Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549_Nov2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1b1a7abf-72bc-44fa-8f90-4321003f0553",
      "subject": "ATTACK:enterprise:S0663",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1b1a7abf-72bc-44fa-8f90-4321003f0553",
      "modified": "2026-09-03T19:46:47.829Z",
      "references": [
        {
          "source_name": "Lunghi Iron Tiger Linux",
          "url": "https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1b6f0ec5-55d5-4aee-a90b-30238599d13c",
      "subject": "ATTACK:enterprise:S0631",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1b6f0ec5-55d5-4aee-a90b-30238599d13c",
      "modified": "2026-09-03T19:46:47.937Z",
      "references": [
        {
          "source_name": "Cybereason Chaes Nov 2020",
          "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--21295e0f-33f4-44dc-a649-87d0e55f8ed7",
      "subject": "ATTACK:enterprise:S1020",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--21295e0f-33f4-44dc-a649-87d0e55f8ed7",
      "modified": "2026-09-03T19:46:48.025Z",
      "references": [
        {
          "source_name": "Kaspersky Lyceum October 2021",
          "url": "https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--215c28bd-3698-4962-b8a9-c632f27c9c82",
      "subject": "ATTACK:enterprise:S0472",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--215c28bd-3698-4962-b8a9-c632f27c9c82",
      "modified": "2026-09-03T19:46:48.119Z",
      "references": [
        {
          "source_name": "Trend Micro Tick November 2019",
          "url": "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--21caad94-1568-4e40-8e38-c0f7e854aede",
      "subject": "ATTACK:enterprise:G0040",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--21caad94-1568-4e40-8e38-c0f7e854aede",
      "modified": "2026-09-03T19:46:48.178Z",
      "references": [
        {
          "source_name": "Cymmetria Patchwork",
          "url": "https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--261937ca-8c05-430a-9c85-280b78505f65",
      "subject": "ATTACK:enterprise:S0678",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--261937ca-8c05-430a-9c85-280b78505f65",
      "modified": "2026-09-03T19:46:48.398Z",
      "references": [
        {
          "source_name": "McAfee Lazarus Nov 2020",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--27e7969b-a0bf-4db6-90bf-1f17c5e0c853",
      "subject": "ATTACK:enterprise:S0044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--27e7969b-a0bf-4db6-90bf-1f17c5e0c853",
      "modified": "2026-09-03T19:46:48.528Z",
      "references": [
        {
          "source_name": "Unit 42 Playbook Dec 2017",
          "url": "https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2cfd020b-e6e7-40aa-963d-12d1dc4a2d6b",
      "subject": "ATTACK:enterprise:S9067",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2cfd020b-e6e7-40aa-963d-12d1dc4a2d6b",
      "modified": "2026-10-01T21:51:30.966Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549_Nov2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2db32876-d6f5-4862-b760-f0a9dfb28c3c",
      "subject": "ATTACK:enterprise:S0559",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2db32876-d6f5-4862-b760-f0a9dfb28c3c",
      "modified": "2026-09-03T19:46:48.686Z",
      "references": [
        {
          "source_name": "FireEye SUNBURST Backdoor December 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2efd43af-7571-4fd6-81cd-c26d7f769133",
      "subject": "ATTACK:enterprise:S1060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2efd43af-7571-4fd6-81cd-c26d7f769133",
      "modified": "2026-09-03T19:46:48.744Z",
      "references": [
        {
          "source_name": "SentinelLabs Metador Technical Appendix Sept 2022",
          "url": "https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--300ef1e9-9b6e-44b9-b082-35295c38876f",
      "subject": "ATTACK:enterprise:S9052",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--300ef1e9-9b6e-44b9-b082-35295c38876f",
      "modified": "2026-09-24T18:51:12.517Z",
      "references": [
        {
          "source_name": "CheckPoint_NimbusManticore_May2026",
          "url": "https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--30f98441-b9cd-49ab-ba95-c7f19a82becd",
      "subject": "ATTACK:enterprise:S0649",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--30f98441-b9cd-49ab-ba95-c7f19a82becd",
      "modified": "2026-09-03T19:46:48.916Z",
      "references": [
        {
          "source_name": "FireEye SMOKEDHAM June 2021",
          "url": "https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--329f545d-7ef4-4c43-9ce8-b56e7275e11f",
      "subject": "ATTACK:enterprise:S1110",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--329f545d-7ef4-4c43-9ce8-b56e7275e11f",
      "modified": "2026-09-03T19:46:48.978Z",
      "references": [
        {
          "source_name": "Mandiant Pulse Secure Zero-Day April 2021",
          "url": "https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--34407c81-aca5-477e-a978-a66f32ae6545",
      "subject": "ATTACK:enterprise:T1132.001",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1132",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--34407c81-aca5-477e-a978-a66f32ae6545",
      "modified": "2026-09-08T20:15:04.698Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--35d35ecf-1326-4690-b105-23280e29c120",
      "subject": "ATTACK:enterprise:S0137",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--35d35ecf-1326-4690-b105-23280e29c120",
      "modified": "2026-09-03T19:46:49.149Z",
      "references": [
        {
          "source_name": "FireEye APT28",
          "url": "https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--37f48df4-80b1-4f5b-917c-8ac699e5cc0e",
      "subject": "ATTACK:enterprise:S0269",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--37f48df4-80b1-4f5b-917c-8ac699e5cc0e",
      "modified": "2026-09-03T19:46:49.235Z",
      "references": [
        {
          "source_name": "Unit 42 QUADAGENT July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3a1883a0-8626-4cf0-8e0f-19bf9cf39a30",
      "subject": "ATTACK:enterprise:S0373",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3a1883a0-8626-4cf0-8e0f-19bf9cf39a30",
      "modified": "2026-09-03T19:46:49.450Z",
      "references": [
        {
          "source_name": "Cofense Astaroth Sept 2018",
          "url": "https://web.archive.org/web/20200302071436/https://cofense.com/seeing-resurgence-demonic-astaroth-wmic-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3a9d2be9-57a6-49d6-9301-253351927e82",
      "subject": "ATTACK:enterprise:S9037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3a9d2be9-57a6-49d6-9301-253351927e82",
      "modified": "2026-09-03T19:46:49.602Z",
      "references": [
        {
          "source_name": "CloudSEK_RustyWater_Jan2026",
          "url": "https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4211ef16-7a9e-49b8-92c4-b73cbef0f843",
      "subject": "ATTACK:enterprise:G1044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4211ef16-7a9e-49b8-92c4-b73cbef0f843",
      "modified": "2026-09-03T19:46:49.672Z",
      "references": [
        {
          "source_name": "Mandiant APT42-untangling",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--434a9327-8e08-4336-adbd-f24a0ee9eba6",
      "subject": "ATTACK:enterprise:S0144",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--434a9327-8e08-4336-adbd-f24a0ee9eba6",
      "modified": "2026-09-03T19:46:49.851Z",
      "references": [
        {
          "source_name": "Palo Alto menuPass Feb 2017",
          "url": "http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/"
        },
        {
          "source_name": "JPCERT ChChes Feb 2017",
          "url": "https://blogs.jpcert.or.jp/en/2017/02/chches-malware--93d6.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--466ea5cf-ebe7-49da-9197-047c70cabaeb",
      "subject": "ATTACK:enterprise:S1078",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--466ea5cf-ebe7-49da-9197-047c70cabaeb",
      "modified": "2026-09-03T19:46:50.200Z",
      "references": [
        {
          "source_name": "RotaJakiro 2021 netlab360 analysis",
          "url": "https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--46e84bd8-d38f-43e7-b62b-ea211231abef",
      "subject": "ATTACK:enterprise:S0520",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--46e84bd8-d38f-43e7-b62b-ea211231abef",
      "modified": "2026-09-03T19:46:50.332Z",
      "references": [
        {
          "source_name": "US-CERT BLINDINGCAN Aug 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--476e4837-d820-44c5-9217-30d6dc821652",
      "subject": "ATTACK:enterprise:S1193",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--476e4837-d820-44c5-9217-30d6dc821652",
      "modified": "2026-09-03T19:46:50.400Z",
      "references": [
        {
          "source_name": "Mandiant APT42-untangling",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--48a7db34-eee7-4358-918b-0cc802aaec03",
      "subject": "ATTACK:enterprise:S0367",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--48a7db34-eee7-4358-918b-0cc802aaec03",
      "modified": "2026-09-03T19:46:50.497Z",
      "references": [
        {
          "source_name": "Binary Defense Emotes Wi-Fi Spreader",
          "url": "https://www.binarydefense.com/resources/blog/emotet-evolves-with-new-wi-fi-spreader/"
        },
        {
          "source_name": "Fortinet Emotet May 2017",
          "url": "https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-1.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4919cec0-77ce-4505-91e5-5a538fe1b198",
      "subject": "ATTACK:enterprise:S0340",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4919cec0-77ce-4505-91e5-5a538fe1b198",
      "modified": "2026-09-03T19:46:50.572Z",
      "references": [
        {
          "source_name": "Securelist Octopus Oct 2018",
          "url": "https://securelist.com/octopus-infested-seas-of-central-asia/88200/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4abcf209-1dab-435b-a347-b8ff318ac5d8",
      "subject": "ATTACK:enterprise:S0187",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4abcf209-1dab-435b-a347-b8ff318ac5d8",
      "modified": "2026-09-03T19:46:50.635Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE BUTLER Oct 2017",
          "url": "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4de4cf78-542c-4f7a-a83b-f876a59e2553",
      "subject": "ATTACK:enterprise:S0495",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4de4cf78-542c-4f7a-a83b-f876a59e2553",
      "modified": "2026-09-03T19:46:50.742Z",
      "references": [
        {
          "source_name": "Unit42 RDAT July 2020",
          "url": "https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4ec9a523-e27f-4984-9bde-4af785e5e75a",
      "subject": "ATTACK:enterprise:S0124",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4ec9a523-e27f-4984-9bde-4af785e5e75a",
      "modified": "2026-09-03T19:46:50.783Z",
      "references": [
        {
          "source_name": "Palo Alto DNS Requests",
          "url": "http://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--50f0d6ac-0cfa-41d6-9795-e6843101c524",
      "subject": "ATTACK:enterprise:S0632",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--50f0d6ac-0cfa-41d6-9795-e6843101c524",
      "modified": "2026-09-03T19:46:50.985Z",
      "references": [
        {
          "source_name": "Group IB GrimAgent July 2021",
          "url": "https://www.group-ib.com/blog/grimagent/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--53ae8545-a24d-431c-a0ee-6d5b63278490",
      "subject": "ATTACK:enterprise:S1112",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--53ae8545-a24d-431c-a0ee-6d5b63278490",
      "modified": "2026-09-03T19:46:51.112Z",
      "references": [
        {
          "source_name": "Mandiant Pulse Secure Zero-Day April 2021",
          "url": "https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--545a618f-9fe4-4573-a0a0-ecfcef0b407c",
      "subject": "ATTACK:enterprise:G0060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--545a618f-9fe4-4573-a0a0-ecfcef0b407c",
      "modified": "2026-09-03T19:46:51.306Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE BUTLER Oct 2017",
          "url": "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--54e27824-ac46-49ca-8b58-dc5726b6cefb",
      "subject": "ATTACK:enterprise:S0543",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--54e27824-ac46-49ca-8b58-dc5726b6cefb",
      "modified": "2026-09-03T19:46:51.405Z",
      "references": [
        {
          "source_name": "Unit42 Molerat Mar 2020",
          "url": "https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--553dc864-7d6b-41f9-bb1c-9fc6ee3724b7",
      "subject": "ATTACK:enterprise:S0459",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--553dc864-7d6b-41f9-bb1c-9fc6ee3724b7",
      "modified": "2026-09-03T19:46:51.536Z",
      "references": [
        {
          "source_name": "Unit 42 MechaFlounder March 2019",
          "url": "https://unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--56e55812-7622-4e84-96c6-6fc46dd2b541",
      "subject": "ATTACK:enterprise:S0354",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--56e55812-7622-4e84-96c6-6fc46dd2b541",
      "modified": "2026-09-03T19:46:51.746Z",
      "references": [
        {
          "source_name": "Cybereason Cobalt Kitty 2017",
          "url": "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--578a4fd8-7c24-44b2-a7c3-1a47786d3c9a",
      "subject": "ATTACK:enterprise:S0264",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--578a4fd8-7c24-44b2-a7c3-1a47786d3c9a",
      "modified": "2026-09-03T19:46:51.861Z",
      "references": [
        {
          "source_name": "Unit 42 OopsIE! Feb 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--596f9132-84e2-42c9-ad58-8833fe38b1e6",
      "subject": "ATTACK:enterprise:S0265",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--596f9132-84e2-42c9-ad58-8833fe38b1e6",
      "modified": "2026-09-03T19:46:51.953Z",
      "references": [
        {
          "source_name": "Unit 42 Kazuar May 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5ccf856f-abd9-4ef6-b17f-803ecb20435f",
      "subject": "ATTACK:enterprise:S0409",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5ccf856f-abd9-4ef6-b17f-803ecb20435f",
      "modified": "2026-09-03T19:46:52.032Z",
      "references": [
        {
          "source_name": "Securelist Machete Aug 2014",
          "url": "https://securelist.com/el-machete/66108/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5ef73661-0bc8-47f5-bae6-2beb5342a68e",
      "subject": "ATTACK:enterprise:S1031",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5ef73661-0bc8-47f5-bae6-2beb5342a68e",
      "modified": "2026-09-03T19:46:52.187Z",
      "references": [
        {
          "source_name": "Unit 42 PingPull Jun 2022",
          "url": "https://unit42.paloaltonetworks.com/pingpull-gallium/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--654d5d71-a4ab-4768-8089-fddc3b1c63ad",
      "subject": "ATTACK:enterprise:C0044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--654d5d71-a4ab-4768-8089-fddc3b1c63ad",
      "modified": "2026-09-03T19:46:52.269Z",
      "references": [
        {
          "source_name": "ESET OilRig Campaigns Sep 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6a4eafba-a7fb-46d1-8c50-033e1e3d7409",
      "subject": "ATTACK:enterprise:G0127",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6a4eafba-a7fb-46d1-8c50-033e1e3d7409",
      "modified": "2026-09-03T19:46:52.402Z",
      "references": [
        {
          "source_name": "Unit 42 Valak July 2020",
          "url": "https://unit42.paloaltonetworks.com/valak-evolution/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6d10e49f-ebd6-47c5-9042-96bd54f7ca79",
      "subject": "ATTACK:enterprise:S0379",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6d10e49f-ebd6-47c5-9042-96bd54f7ca79",
      "modified": "2026-09-03T19:46:52.475Z",
      "references": [
        {
          "source_name": "Cylance Shaheen Nov 2018",
          "url": "https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6d5ce011-4fb4-4b6a-8c1b-dfea3c0933a1",
      "subject": "ATTACK:enterprise:S1198",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6d5ce011-4fb4-4b6a-8c1b-dfea3c0933a1",
      "modified": "2026-09-03T19:46:52.546Z",
      "references": [
        {
          "source_name": "Symantec Troll Stealer 2024",
          "url": "https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6d69c030-d557-4d35-b5dc-99ee973f10eb",
      "subject": "ATTACK:enterprise:S0352",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6d69c030-d557-4d35-b5dc-99ee973f10eb",
      "modified": "2026-09-03T19:46:52.730Z",
      "references": [
        {
          "source_name": "Unit42 OceanLotus 2017",
          "url": "https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6f9916d0-70c3-4504-93cf-cd0e8dd7ead1",
      "subject": "ATTACK:enterprise:S0223",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6f9916d0-70c3-4504-93cf-cd0e8dd7ead1",
      "modified": "2026-09-03T19:46:52.843Z",
      "references": [
        {
          "source_name": "Unit 42 MuddyWater Nov 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--70cbf260-4995-485e-8dc2-241bfc421b80",
      "subject": "ATTACK:enterprise:S9043",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--70cbf260-4995-485e-8dc2-241bfc421b80",
      "modified": "2026-09-03T19:46:52.987Z",
      "references": [
        {
          "source_name": "Hunt.io TeamPCP Toolkit MAY 2026",
          "url": "https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"
        },
        {
          "source_name": "Phoenix TeamPCP 20 MAY 2026",
          "url": "https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7123a6ee-2026-4db8-a983-cbc2932c2a09",
      "subject": "ATTACK:enterprise:S0093",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7123a6ee-2026-4db8-a983-cbc2932c2a09",
      "modified": "2026-09-03T19:46:53.210Z",
      "references": [
        {
          "source_name": "Symantec Dragonfly",
          "url": "https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--74499e24-ecca-46bb-87fb-e8beb25f1c11",
      "subject": "ATTACK:enterprise:S0376",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--74499e24-ecca-46bb-87fb-e8beb25f1c11",
      "modified": "2026-09-03T19:46:53.323Z",
      "references": [
        {
          "source_name": "US-CERT HOPLIGHT Apr 2019",
          "url": "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7898362c-a930-4cd4-9c94-019a253af141",
      "subject": "ATTACK:enterprise:S0439",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7898362c-a930-4cd4-9c94-019a253af141",
      "modified": "2026-09-03T19:46:53.436Z",
      "references": [
        {
          "source_name": "ESET Okrum July 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--791b12bb-cb49-4fc6-a4a5-ea7773fce408",
      "subject": "ATTACK:enterprise:S1030",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--791b12bb-cb49-4fc6-a4a5-ea7773fce408",
      "modified": "2026-09-03T19:46:53.639Z",
      "references": [
        {
          "source_name": "ZScaler Squirrelwaffle Sep 2021",
          "url": "https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--79f0712b-2cb1-47df-8ea1-26fb1502a831",
      "subject": "ATTACK:enterprise:S0128",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--79f0712b-2cb1-47df-8ea1-26fb1502a831",
      "modified": "2026-09-03T19:46:53.774Z",
      "references": [
        {
          "source_name": "Forcepoint Monsoon",
          "url": "https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"
        },
        {
          "source_name": "PaloAlto Patchwork Mar 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"
        },
        {
          "source_name": "TrendMicro Patchwork Dec 2017",
          "url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7a4ed5e2-6a96-4faf-b647-2372490cfcb2",
      "subject": "ATTACK:enterprise:S1039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7a4ed5e2-6a96-4faf-b647-2372490cfcb2",
      "modified": "2026-09-03T19:46:53.978Z",
      "references": [
        {
          "source_name": "Proofpoint Bumblebee April 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7ac39d41-f859-447e-947b-5da935d30894",
      "subject": "ATTACK:enterprise:S0385",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7ac39d41-f859-447e-947b-5da935d30894",
      "modified": "2026-09-03T19:46:54.088Z",
      "references": [
        {
          "source_name": "Fidelis njRAT June 2013",
          "url": "https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7d13961a-5fcc-4c97-aeda-f3e42325aabf",
      "subject": "ATTACK:enterprise:S0266",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7d13961a-5fcc-4c97-aeda-f3e42325aabf",
      "modified": "2026-09-03T19:46:54.212Z",
      "references": [
        {
          "source_name": "Cyberreason Anchor December 2019",
          "url": "https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7f1c30eb-051f-4d1a-9d81-1ee46f7779c7",
      "subject": "ATTACK:enterprise:S0084",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7f1c30eb-051f-4d1a-9d81-1ee46f7779c7",
      "modified": "2026-09-03T19:46:54.382Z",
      "references": [
        {
          "source_name": "Cylance Dust Storm",
          "url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--801f139f-1361-4d79-965e-078787f8ec36",
      "subject": "ATTACK:enterprise:S0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--801f139f-1361-4d79-965e-078787f8ec36",
      "modified": "2026-09-03T19:46:54.464Z",
      "references": [
        {
          "source_name": "Forcepoint Monsoon",
          "url": "https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--813e4416-bee6-4192-a712-6b5f80a7fff3",
      "subject": "ATTACK:enterprise:S0085",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--813e4416-bee6-4192-a712-6b5f80a7fff3",
      "modified": "2026-09-03T19:46:54.557Z",
      "references": [
        {
          "source_name": "Cylance Dust Storm",
          "url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--81682d49-acb2-4439-a7da-1a28126cea94",
      "subject": "ATTACK:enterprise:G0032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--81682d49-acb2-4439-a7da-1a28126cea94",
      "modified": "2026-09-03T19:46:54.638Z",
      "references": [
        {
          "source_name": "McAfee Lazarus Resurfaces Feb 2018",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--827f9dc6-9dbd-4556-a817-efb9b115cac1",
      "subject": "ATTACK:enterprise:S0673",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--827f9dc6-9dbd-4556-a817-efb9b115cac1",
      "modified": "2026-09-03T19:46:54.845Z",
      "references": [
        {
          "source_name": "Prevailion DarkWatchman 2021",
          "url": "https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--83a949a2-ed5d-4ae5-a45f-885e58a7d931",
      "subject": "ATTACK:enterprise:S0200",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--83a949a2-ed5d-4ae5-a45f-885e58a7d931",
      "modified": "2026-09-03T19:46:54.929Z",
      "references": [
        {
          "source_name": "Microsoft PLATINUM April 2016",
          "url": "https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--83ac6dba-c74f-4a9e-aba3-3581a67588bf",
      "subject": "ATTACK:enterprise:S0270",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--83ac6dba-c74f-4a9e-aba3-3581a67588bf",
      "modified": "2026-09-03T19:46:55.037Z",
      "references": [
        {
          "source_name": "Unit 42 DarkHydrus July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--848f00fe-4fd4-422c-b819-20d5e1f7becf",
      "subject": "ATTACK:enterprise:S0275",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--848f00fe-4fd4-422c-b819-20d5e1f7becf",
      "modified": "2026-09-03T19:46:55.222Z",
      "references": [
        {
          "source_name": "Trend Micro Earth Kasha Anel NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--86dddc68-9032-4467-be3c-a48d3bacfd06",
      "subject": "ATTACK:enterprise:S0514",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--86dddc68-9032-4467-be3c-a48d3bacfd06",
      "modified": "2026-09-03T19:46:55.310Z",
      "references": [
        {
          "source_name": "CISA WellMess July 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8a6b0a59-a9f7-4e65-8070-303a6b79e6bb",
      "subject": "ATTACK:enterprise:S1108",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8a6b0a59-a9f7-4e65-8070-303a6b79e6bb",
      "modified": "2026-09-03T19:46:55.396Z",
      "references": [
        {
          "source_name": "Mandiant Pulse Secure Zero-Day April 2021",
          "url": "https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8aaf06cc-1245-47d2-b270-b7854eec5b64",
      "subject": "ATTACK:enterprise:S1183",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8aaf06cc-1245-47d2-b270-b7854eec5b64",
      "modified": "2026-09-03T19:46:55.621Z",
      "references": [
        {
          "source_name": "IBM StrelaStealer 2024",
          "url": "https://securityintelligence.com/x-force/strela-stealer-todays-invoice-tomorrows-phish/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8bbb3c5d-da3b-4f55-871d-2fd210dfddea",
      "subject": "ATTACK:enterprise:G0082",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8bbb3c5d-da3b-4f55-871d-2fd210dfddea",
      "modified": "2026-09-30T21:31:41.544Z",
      "references": [
        {
          "source_name": "MIcrosoft Mastra npm Compromise JUN 2026",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--90126438-03a9-47c8-98c1-222a1d79ef21",
      "subject": "ATTACK:enterprise:S0487",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--90126438-03a9-47c8-98c1-222a1d79ef21",
      "modified": "2026-09-03T19:46:55.715Z",
      "references": [
        {
          "source_name": "ESET ForSSHe December 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--91180074-16cd-448f-8955-628d06965e22",
      "subject": "ATTACK:enterprise:G0081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--91180074-16cd-448f-8955-628d06965e22",
      "modified": "2026-09-03T19:46:55.827Z",
      "references": [
        {
          "source_name": "TrendMicro Tropic Trooper May 2020",
          "url": "https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--93d01da6-38c4-479a-a123-51e4d10a3d61",
      "subject": "ATTACK:enterprise:S9015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--93d01da6-38c4-479a-a123-51e4d10a3d61",
      "modified": "2026-09-03T19:46:55.977Z",
      "references": [
        {
          "source_name": "NVISO BRICKSTORM April 2025",
          "url": "https://blog.nviso.eu/wp-content/uploads/2025/04/NVISO-BRICKSTORM-Report.pdf"
        },
        {
          "source_name": "Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025",
          "url": "https://www.resecurity.com/blog/article/f5-big-ip-source-code-leak-tied-to-state-linked-campaigns-using-brickstorm-backdoor"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--94e051ad-2f6d-4322-a854-6ee1944a8904",
      "subject": "ATTACK:enterprise:S0414",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--94e051ad-2f6d-4322-a854-6ee1944a8904",
      "modified": "2026-09-03T19:46:56.111Z",
      "references": [
        {
          "source_name": "Unit42 BabyShark Feb 2019",
          "url": "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--94eef51a-f00b-49db-9a8a-9730b4c80b9a",
      "subject": "ATTACK:enterprise:S1240",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--94eef51a-f00b-49db-9a8a-9730b4c80b9a",
      "modified": "2026-09-03T19:46:56.200Z",
      "references": [
        {
          "source_name": "McAfee RedLine Stealer April 2024",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/redline-stealer-a-novel-approach/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--96076f66-3ad6-4e54-b816-c9c3f90fa43a",
      "subject": "ATTACK:enterprise:S0015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--96076f66-3ad6-4e54-b816-c9c3f90fa43a",
      "modified": "2026-09-03T19:46:56.389Z",
      "references": [
        {
          "source_name": "Moran 2013",
          "url": "https://web.archive.org/web/20191224162418/https://www.fireeye.com/blog/threat-research/2013/08/survival-of-the-fittest-new-york-times-attackers-evolve-quickly.html"
        },
        {
          "source_name": "Trend Micro IXESHE 2012",
          "url": "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--97bb6552-08cc-4c75-938f-fde6041f114b",
      "subject": "ATTACK:enterprise:S1190",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--97bb6552-08cc-4c75-938f-fde6041f114b",
      "modified": "2026-09-03T19:46:56.453Z",
      "references": [
        {
          "source_name": "WithSecure Kapeka 2024",
          "url": "https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Research-Kapeka.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--97beb535-e226-4581-a329-de9fabe7a49d",
      "subject": "ATTACK:enterprise:S1024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--97beb535-e226-4581-a329-de9fabe7a49d",
      "modified": "2026-09-03T19:46:56.533Z",
      "references": [
        {
          "source_name": "Microsoft POLONIUM June 2022",
          "url": "https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--98b19c5d-efbc-4e00-b7cc-71df5a1109e0",
      "subject": "ATTACK:enterprise:S0441",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--98b19c5d-efbc-4e00-b7cc-71df5a1109e0",
      "modified": "2026-09-03T19:46:56.629Z",
      "references": [
        {
          "source_name": "Unit 42 Inception November 2018",
          "url": "https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"
        },
        {
          "source_name": "Kaspersky Cloud Atlas August 2019",
          "url": "https://securelist.com/recent-cloud-atlas-activity/92016/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9cf37d0b-a23d-4514-961d-94d1cc6e2bef",
      "subject": "ATTACK:enterprise:S0113",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9cf37d0b-a23d-4514-961d-94d1cc6e2bef",
      "modified": "2026-09-03T19:46:56.723Z",
      "references": [
        {
          "source_name": "ESET Operation Groundbait",
          "url": "http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9dffc323-ae0a-430e-b9de-e059862432a1",
      "subject": "ATTACK:enterprise:S0356",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9dffc323-ae0a-430e-b9de-e059862432a1",
      "modified": "2026-09-03T19:46:56.801Z",
      "references": [
        {
          "source_name": "Medium KONNI Jan 2020",
          "url": "https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9e472909-7f89-430f-8782-8bf20ef265d4",
      "subject": "ATTACK:enterprise:S0268",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9e472909-7f89-430f-8782-8bf20ef265d4",
      "modified": "2026-09-03T19:46:56.879Z",
      "references": [
        {
          "source_name": "Talos Bisonal Mar 2020",
          "url": "https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"
        },
        {
          "source_name": "Kaspersky CactusPete Aug 2020",
          "url": "https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9ffd30d7-9f2b-45cd-94cb-4ff2be36f84f",
      "subject": "ATTACK:enterprise:S1202",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9ffd30d7-9f2b-45cd-94cb-4ff2be36f84f",
      "modified": "2026-09-03T19:46:56.955Z",
      "references": [
        {
          "source_name": "Joint Cybersecurity Advisory LockBit 3.0 MAR 2023",
          "url": "https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a12a471b-39b2-4abf-80d0-af88d5a4f038",
      "subject": "ATTACK:enterprise:S0083",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a12a471b-39b2-4abf-80d0-af88d5a4f038",
      "modified": "2026-09-03T19:46:57.029Z",
      "references": [
        {
          "source_name": "Cylance Dust Storm",
          "url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a1fc4800-c670-4bc1-bc42-2b5fe66d0297",
      "subject": "ATTACK:enterprise:G0069",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a1fc4800-c670-4bc1-bc42-2b5fe66d0297",
      "modified": "2026-09-03T19:46:57.123Z",
      "references": [
        {
          "source_name": "ClearSky MuddyWater June 2019",
          "url": "https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"
        },
        {
          "source_name": "Trend Micro Muddy Water March 2021",
          "url": "https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a3bd1498-10dd-4eeb-b328-fbfa8c8217d0",
      "subject": "ATTACK:enterprise:S1166",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a3bd1498-10dd-4eeb-b328-fbfa8c8217d0",
      "modified": "2026-09-03T19:46:57.205Z",
      "references": [
        {
          "source_name": "ESET OilRig Campaigns Sep 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a70a6fbd-379d-4104-8323-ce25a950c892",
      "subject": "ATTACK:enterprise:S0338",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a70a6fbd-379d-4104-8323-ce25a950c892",
      "modified": "2026-09-03T19:46:57.258Z",
      "references": [
        {
          "source_name": "Zscaler Cobian Aug 2017",
          "url": "https://www.zscaler.com/blogs/research/cobian-rat-backdoored-rat"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a805a8d5-632c-48df-909d-c3d745652475",
      "subject": "ATTACK:enterprise:S0014",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a805a8d5-632c-48df-909d-c3d745652475",
      "modified": "2026-09-03T19:46:57.315Z",
      "references": [
        {
          "source_name": "Mandiant Operation Ke3chang November 2014",
          "url": "https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a98804cf-b3f8-40c5-beac-2a82a18c891f",
      "subject": "ATTACK:enterprise:S1026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a98804cf-b3f8-40c5-beac-2a82a18c891f",
      "modified": "2026-09-03T19:46:57.377Z",
      "references": [
        {
          "source_name": "SentinelOne Aoqin Dragon June 2022",
          "url": "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ac5089b3-db8b-401d-924d-76e35bce7e9c",
      "subject": "ATTACK:enterprise:S0284",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ac5089b3-db8b-401d-924d-76e35bce7e9c",
      "modified": "2026-09-03T19:46:57.428Z",
      "references": [
        {
          "source_name": "Security Intelligence More Eggs Aug 2019",
          "url": "https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b108443a-669a-42a3-b065-3c97ba318fcf",
      "subject": "ATTACK:enterprise:S1085",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b108443a-669a-42a3-b065-3c97ba318fcf",
      "modified": "2026-09-03T19:46:57.478Z",
      "references": [
        {
          "source_name": "Bitdefender Sardonic Aug 2021",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b1b17a6e-991a-4ead-aedd-c7b1f09ce17c",
      "subject": "ATTACK:enterprise:S1138",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b1b17a6e-991a-4ead-aedd-c7b1f09ce17c",
      "modified": "2026-09-03T19:46:57.539Z",
      "references": [
        {
          "source_name": "SentinelOne Gootloader June 2021",
          "url": "https://www.sentinelone.com/labs/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b2ec264b-8490-406f-b239-db5b150a138f",
      "subject": "ATTACK:enterprise:S1099",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b2ec264b-8490-406f-b239-db5b150a138f",
      "modified": "2026-09-03T19:46:57.581Z",
      "references": [
        {
          "source_name": "Kaspersky ToddyCat June 2022",
          "url": "https://securelist.com/toddycat/106799/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b44a5877-4cd1-4a5c-b2ea-d1078da36cc2",
      "subject": "ATTACK:enterprise:S1145",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b44a5877-4cd1-4a5c-b2ea-d1078da36cc2",
      "modified": "2026-09-03T19:46:57.647Z",
      "references": [
        {
          "source_name": "Zscaler Pikabot 2023",
          "url": "https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot"
        },
        {
          "source_name": "Elastic Pikabot 2024",
          "url": "https://www.elastic.co/security-labs/pikabot-i-choose-you"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b6714e64-3741-4d0a-9377-6aa743cda936",
      "subject": "ATTACK:enterprise:S1156",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b6714e64-3741-4d0a-9377-6aa743cda936",
      "modified": "2026-09-03T19:46:57.706Z",
      "references": [
        {
          "source_name": "Talos Manjusaka 2022",
          "url": "https://blog.talosintelligence.com/manjusaka-offensive-framework/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b732b424-4648-48a5-8ecc-a2d55fda04c6",
      "subject": "ATTACK:enterprise:S0653",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b732b424-4648-48a5-8ecc-a2d55fda04c6",
      "modified": "2026-09-03T19:46:57.751Z",
      "references": [
        {
          "source_name": "Checkpoint IndigoZebra July 2021",
          "url": "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b8bc044a-2cc7-484e-97f7-77f5577245b5",
      "subject": "ATTACK:enterprise:S1115",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b8bc044a-2cc7-484e-97f7-77f5577245b5",
      "modified": "2026-09-03T19:46:57.798Z",
      "references": [
        {
          "source_name": "Mandiant Cutting Edge January 2024",
          "url": "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b9109cd5-1b13-4376-a761-b68302879351",
      "subject": "ATTACK:enterprise:S0184",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b9109cd5-1b13-4376-a761-b68302879351",
      "modified": "2026-09-03T19:46:57.835Z",
      "references": [
        {
          "source_name": "FireEye APT34 Dec 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bd41e985-806d-4bc5-b7ef-fd00fc96cd3c",
      "subject": "ATTACK:enterprise:S0171",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bd41e985-806d-4bc5-b7ef-fd00fc96cd3c",
      "modified": "2026-09-03T19:46:57.889Z",
      "references": [
        {
          "source_name": "Forcepoint Felismus Mar 2017",
          "url": "https://blogs.forcepoint.com/security-labs/playing-cat-mouse-introducing-felismus-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--be99408a-dc65-41a0-83db-235d8495e55c",
      "subject": "ATTACK:enterprise:S0476",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--be99408a-dc65-41a0-83db-235d8495e55c",
      "modified": "2026-09-03T19:46:57.937Z",
      "references": [
        {
          "source_name": "Unit 42 Valak July 2020",
          "url": "https://unit42.paloaltonetworks.com/valak-evolution/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c035e54b-c504-4e4f-9915-c2f37236ef34",
      "subject": "ATTACK:enterprise:S0374",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c035e54b-c504-4e4f-9915-c2f37236ef34",
      "modified": "2026-09-03T19:46:57.979Z",
      "references": [
        {
          "source_name": "CheckPoint SpeakUp Feb 2019",
          "url": "https://research.checkpoint.com/speakup-a-new-undetected-backdoor-linux-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c0677c42-7c1f-48ee-9a96-de3686917405",
      "subject": "ATTACK:enterprise:S1047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c0677c42-7c1f-48ee-9a96-de3686917405",
      "modified": "2026-09-03T19:46:58.033Z",
      "references": [
        {
          "source_name": "DHS CISA AA22-055A MuddyWater February 2022",
          "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c128b821-b39b-481a-91a1-a2bad7d6dda2",
      "subject": "ATTACK:enterprise:S0377",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c128b821-b39b-481a-91a1-a2bad7d6dda2",
      "modified": "2026-09-03T19:46:58.088Z",
      "references": [
        {
          "source_name": "ESET Ebury Feb 2014",
          "url": "https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c14c5838-0e7b-44fd-bdcc-368f5027229a",
      "subject": "ATTACK:enterprise:S1169",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c14c5838-0e7b-44fd-bdcc-368f5027229a",
      "modified": "2026-09-03T19:46:58.135Z",
      "references": [
        {
          "source_name": "ESET OilRig Campaigns Sep 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c16854fa-add6-4be3-9547-05cc479861d8",
      "subject": "ATTACK:enterprise:S0032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c16854fa-add6-4be3-9547-05cc479861d8",
      "modified": "2026-09-03T19:46:58.180Z",
      "references": [
        {
          "source_name": "Gh0stRAT ATT March 2019",
          "url": "https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c667befa-7242-47f8-bdc1-1056f62bb466",
      "subject": "ATTACK:enterprise:S0081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c667befa-7242-47f8-bdc1-1056f62bb466",
      "modified": "2026-09-03T19:46:58.219Z",
      "references": [
        {
          "source_name": "Lotus Blossom Jun 2015",
          "url": "https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cbf79556-91df-45cf-a64b-1dd01025ac8d",
      "subject": "ATTACK:enterprise:S0154",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cbf79556-91df-45cf-a64b-1dd01025ac8d",
      "modified": "2026-09-03T19:46:58.264Z",
      "references": [
        {
          "source_name": "Cobalt Strike Manual 4.3 November 2020",
          "url": "https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d1b46f3e-b25c-43c0-9ab2-ef6e5ff8270c",
      "subject": "ATTACK:enterprise:G0073",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d1b46f3e-b25c-43c0-9ab2-ef6e5ff8270c",
      "modified": "2026-09-03T19:46:58.313Z",
      "references": [
        {
          "source_name": "Unit 42 C0d0so0 Jan 2016",
          "url": "https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d4ee44c8-c389-4c02-8601-ee7c194d249e",
      "subject": "ATTACK:enterprise:S0650",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d4ee44c8-c389-4c02-8601-ee7c194d249e",
      "modified": "2026-09-03T19:46:58.359Z",
      "references": [
        {
          "source_name": "Crowdstrike Qakbot October 2020",
          "url": "https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/"
        },
        {
          "source_name": "Kaspersky QakBot September 2021",
          "url": "https://securelist.com/qakbot-technical-analysis/103931/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d514d73a-27de-409d-bff9-d7e48f2859a6",
      "subject": "ATTACK:enterprise:S0251",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d514d73a-27de-409d-bff9-d7e48f2859a6",
      "modified": "2026-09-03T19:46:58.395Z",
      "references": [
        {
          "source_name": "Accenture SNAKEMACKEREL Nov 2018",
          "url": "https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d9302591-bba1-420e-96ac-401304d37258",
      "subject": "ATTACK:enterprise:S0030",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d9302591-bba1-420e-96ac-401304d37258",
      "modified": "2026-09-03T19:46:58.432Z",
      "references": [
        {
          "source_name": "Kaspersky Carbanak",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"
        },
        {
          "source_name": "FireEye CARBANAK June 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--df2a0a3b-1a23-4148-a0f7-ed5b45a0d095",
      "subject": "ATTACK:enterprise:S0633",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--df2a0a3b-1a23-4148-a0f7-ed5b45a0d095",
      "modified": "2026-09-03T19:46:58.463Z",
      "references": [
        {
          "source_name": "GitHub Sliver HTTP",
          "url": "https://github.com/BishopFox/sliver/wiki/HTTP(S)-C2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dfaccd3c-398f-453e-8fa9-dad431bd2b0c",
      "subject": "ATTACK:enterprise:S1116",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dfaccd3c-398f-453e-8fa9-dad431bd2b0c",
      "modified": "2026-09-03T19:46:58.497Z",
      "references": [
        {
          "source_name": "Mandiant Cutting Edge January 2024",
          "url": "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e1492807-b520-412b-9df7-105aefc29deb",
      "subject": "ATTACK:enterprise:G0064",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e1492807-b520-412b-9df7-105aefc29deb",
      "modified": "2026-09-03T19:46:58.535Z",
      "references": [
        {
          "source_name": "FireEye APT33 Guardrail",
          "url": "https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e2bae8fe-a8e5-414d-b662-5fdac42f84c2",
      "subject": "ATTACK:enterprise:S9028",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e2bae8fe-a8e5-414d-b662-5fdac42f84c2",
      "modified": "2026-09-03T19:46:58.576Z",
      "references": [
        {
          "source_name": "sentinelone operationDigitalEye Dec 2024",
          "url": "https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e3af086e-a601-460b-92c4-7dfdf0d88caf",
      "subject": "ATTACK:enterprise:S1141",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e3af086e-a601-460b-92c4-7dfdf0d88caf",
      "modified": "2026-09-03T19:46:58.611Z",
      "references": [
        {
          "source_name": "ESET Turla Lunar toolset May 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e3cf2c8a-2203-4ab4-9b37-1f0f27ea9240",
      "subject": "ATTACK:enterprise:G1045",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e3cf2c8a-2203-4ab4-9b37-1f0f27ea9240",
      "modified": "2026-09-22T21:20:29.279Z",
      "references": [
        {
          "source_name": "CISA_AA25-239ASaltTyphoon_Sept2025",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e48c9be7-6a02-4170-a63a-204c6308a825",
      "subject": "ATTACK:enterprise:S1037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e48c9be7-6a02-4170-a63a-204c6308a825",
      "modified": "2026-09-03T19:46:58.643Z",
      "references": [
        {
          "source_name": "DHS CISA AA22-055A MuddyWater February 2022",
          "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e550d34c-3828-416b-92ec-a7a6f9524823",
      "subject": "ATTACK:enterprise:S0674",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e550d34c-3828-416b-92ec-a7a6f9524823",
      "modified": "2026-09-03T19:46:58.683Z",
      "references": [
        {
          "source_name": "Check Point APT35 CharmPower January 2022",
          "url": "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e68ff1c2-ef03-486b-96df-167a1652a97b",
      "subject": "ATTACK:enterprise:S0170",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e68ff1c2-ef03-486b-96df-167a1652a97b",
      "modified": "2026-09-03T19:46:58.710Z",
      "references": [
        {
          "source_name": "Palo Alto OilRig May 2016",
          "url": "http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ee6e6954-706f-4b19-9081-f9603c3f9e3e",
      "subject": "ATTACK:enterprise:S1018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ee6e6954-706f-4b19-9081-f9603c3f9e3e",
      "modified": "2026-09-03T19:46:58.740Z",
      "references": [
        {
          "source_name": "Malwarebytes Saint Bot April 2021",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ef09248a-8356-4636-88da-a58e17e72a45",
      "subject": "ATTACK:enterprise:S1076",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ef09248a-8356-4636-88da-a58e17e72a45",
      "modified": "2026-09-03T19:46:58.763Z",
      "references": [
        {
          "source_name": "Mandiant Suspected Turla Campaign February 2023",
          "url": "https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f1bd5050-739b-4a22-a1a6-f80e70cb8192",
      "subject": "ATTACK:enterprise:S0458",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f1bd5050-739b-4a22-a1a6-f80e70cb8192",
      "modified": "2026-09-03T19:46:58.792Z",
      "references": [
        {
          "source_name": "Antiy CERT Ramsay April 2020",
          "url": "https://www.programmersought.com/article/62493896999/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f4d0878b-5e03-439b-84b4-3909a1962016",
      "subject": "ATTACK:enterprise:M1031",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f4d0878b-5e03-439b-84b4-3909a1962016",
      "modified": "2026-09-03T19:46:58.817Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f8fe4311-f367-42bb-a51d-688753d0218b",
      "subject": "ATTACK:enterprise:G0125",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f8fe4311-f367-42bb-a51d-688753d0218b",
      "modified": "2026-09-03T19:46:58.845Z",
      "references": [
        {
          "source_name": "Microsoft HAFNIUM March 2020",
          "url": "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fcdffbd7-5e2c-40ec-8444-b707fb4947d3",
      "subject": "ATTACK:enterprise:S1117",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fcdffbd7-5e2c-40ec-8444-b707fb4947d3",
      "modified": "2026-09-03T19:46:58.876Z",
      "references": [
        {
          "source_name": "Volexity Ivanti Zero-Day Exploitation January 2024",
          "url": "https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ff314a48-663e-4ccd-969e-1b66ab220ee1",
      "subject": "ATTACK:enterprise:S0332",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1132.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ff314a48-663e-4ccd-969e-1b66ab220ee1",
      "modified": "2026-09-03T19:46:58.904Z",
      "references": [
        {
          "source_name": "Check Point Blind Eagle MAR 2025",
          "url": "https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    }
  ],
  "source_snapshot": {
    "file": "enterprise-attack-20.0.json",
    "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
    "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352",
    "bytes": 55271014,
    "checked_at": "2026-10-16T03:31:39Z"
  },
  "notices_url": "https://aol.pm/source-notices.txt",
  "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"
}

License
-------
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,
development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce
MITRE's copyright designation and this license in any such copy.

"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

Disclaimers
-----------
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part
of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover
full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or
variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE
ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,
AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE.