Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference.
{
  "record": {
    "id": "ATTACK:enterprise:T1140",
    "title": "Deobfuscate/Decode Files or Information",
    "type": "Technique",
    "source_url": "https://attack.mitre.org/techniques/T1140",
    "snapshot": "enterprise-attack-20.0.json",
    "status": "active",
    "rights": "Source metadata only; source notices retained; no operational prose or payloads",
    "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
    "stix_id": "attack-pattern--3ccef7ae-cb5e-48f6-8302-897105fbf55c",
    "external_id": "T1140",
    "domain": "enterprise",
    "created": "2017-12-14T16:46:06.044Z",
    "modified": "2026-09-11T19:42:55.679Z",
    "version": "2.0",
    "aliases": [

    ],
    "tactics": [
      "stealth"
    ],
    "source_references": [
      {
        "source_name": "Volexity PowerDuke November 2016",
        "url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"
      },
      {
        "source_name": "Sentinel One Tainted Love 2023",
        "url": "https://www.sentinelone.com/labs/operation-tainted-love-chinese-apts-target-telcos-in-new-attacks/"
      },
      {
        "source_name": "Malwarebytes Targeted Attack against Saudi Arabia",
        "url": "https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/"
      },
      {
        "source_name": "Carbon Black Obfuscation Sept 2016",
        "url": "https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/"
      }
    ]
  },
  "assertions": [
    {
      "id": "enterprise:relationship--0133e2fc-5673-40a5-982b-9b0f441217f5",
      "subject": "ATTACK:enterprise:S9028",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0133e2fc-5673-40a5-982b-9b0f441217f5",
      "modified": "2026-04-29T14:23:05.904Z",
      "references": [
        {
          "source_name": "sentinelone operationDigitalEye Dec 2024",
          "url": "https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--017c304d-dec3-4d0e-ac60-8acfbfe41a7c",
      "subject": "ATTACK:enterprise:C0044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--017c304d-dec3-4d0e-ac60-8acfbfe41a7c",
      "modified": "2026-07-31T21:13:47.592Z",
      "references": [
        {
          "source_name": "ESET OilRig Campaigns Sep 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--01fa087f-2238-4bd6-b2d9-8fca29ac9cb0",
      "subject": "ATTACK:enterprise:S9024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--01fa087f-2238-4bd6-b2d9-8fca29ac9cb0",
      "modified": "2026-04-29T14:23:05.905Z",
      "references": [
        {
          "source_name": "JPCERT SPAWNCHIMERA Ivanti February 2025",
          "url": "https://blogs.jpcert.or.jp/en/2025/02/spawnchimera.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--026a63ae-dd3d-4ea6-8a32-c40c9b37b893",
      "subject": "ATTACK:enterprise:S0230",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--026a63ae-dd3d-4ea6-8a32-c40c9b37b893",
      "modified": "2026-04-29T14:23:05.906Z",
      "references": [
        {
          "source_name": "Proofpoint ZeroT Feb 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--026d4fb6-4683-4e64-a69c-82e39dd11b23",
      "subject": "ATTACK:enterprise:S0584",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--026d4fb6-4683-4e64-a69c-82e39dd11b23",
      "modified": "2026-04-29T14:23:05.906Z",
      "references": [
        {
          "source_name": "CISA AppleJeus Feb 2021",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa21-048a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0303acd0-64a4-4e40-b8e3-29e1c43694d2",
      "subject": "ATTACK:enterprise:S1028",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0303acd0-64a4-4e40-b8e3-29e1c43694d2",
      "modified": "2026-04-29T14:23:05.907Z",
      "references": [
        {
          "source_name": "MalwareBytes SideCopy Dec 2021",
          "url": "https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--03303147-db81-4cb3-9368-98ee4f963c1a",
      "subject": "ATTACK:enterprise:G0060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--03303147-db81-4cb3-9368-98ee4f963c1a",
      "modified": "2026-07-31T18:48:10.020Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE BUTLER Oct 2017",
          "url": "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--03b52236-a63f-4ffe-88bd-15cb5ac69a66",
      "subject": "ATTACK:enterprise:S0669",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--03b52236-a63f-4ffe-88bd-15cb5ac69a66",
      "modified": "2026-04-29T14:23:05.908Z",
      "references": [
        {
          "source_name": "MalwareBytes LazyScripter Feb 2021",
          "url": "https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--03e6a535-5c95-47e7-a369-aed653022c7c",
      "subject": "ATTACK:enterprise:S1086",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--03e6a535-5c95-47e7-a369-aed653022c7c",
      "modified": "2026-04-29T14:23:05.908Z",
      "references": [
        {
          "source_name": "Morphisec Snip3 May 2021",
          "url": "https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--045da2d4-f599-447b-931b-c11e8692fa1c",
      "subject": "ATTACK:enterprise:S0574",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--045da2d4-f599-447b-931b-c11e8692fa1c",
      "modified": "2026-04-29T14:23:05.909Z",
      "references": [
        {
          "source_name": "Unit42 BendyBear Feb 2021",
          "url": "https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0575a941-3af6-4b7b-93df-30f6001760ac",
      "subject": "ATTACK:enterprise:S0513",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0575a941-3af6-4b7b-93df-30f6001760ac",
      "modified": "2026-04-29T14:23:05.911Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0686ee2f-ff46-418b-b6e8-1766e4dc33a8",
      "subject": "ATTACK:enterprise:S0598",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0686ee2f-ff46-418b-b6e8-1766e4dc33a8",
      "modified": "2026-04-29T14:23:05.912Z",
      "references": [
        {
          "source_name": "ANSSI Sandworm January 2021",
          "url": "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--06f8a778-eebf-4d73-86d3-6ebdbf94ce46",
      "subject": "ATTACK:enterprise:S0356",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--06f8a778-eebf-4d73-86d3-6ebdbf94ce46",
      "modified": "2026-04-29T14:23:05.913Z",
      "references": [
        {
          "source_name": "Medium KONNI Jan 2020",
          "url": "https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b"
        },
        {
          "source_name": "Malwarebytes Konni Aug 2021",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--07516f04-c7aa-46c7-9cca-0f81b84043e2",
      "subject": "ATTACK:enterprise:G0010",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--07516f04-c7aa-46c7-9cca-0f81b84043e2",
      "modified": "2026-07-31T18:48:03.516Z",
      "references": [
        {
          "source_name": "ESET Turla PowerShell May 2019",
          "url": "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--075c6890-45e1-495e-a83e-b81ab05a8b4e",
      "subject": "ATTACK:enterprise:S0409",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--075c6890-45e1-495e-a83e-b81ab05a8b4e",
      "modified": "2026-04-29T14:23:05.913Z",
      "references": [
        {
          "source_name": "ESET Machete July 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--07bbfaa8-c62f-4abc-845c-55b28434d058",
      "subject": "ATTACK:enterprise:S0415",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--07bbfaa8-c62f-4abc-845c-55b28434d058",
      "modified": "2026-04-29T14:23:05.914Z",
      "references": [
        {
          "source_name": "FireEye FIN7 Oct 2019",
          "url": "https://www.fireeye.com/blog/threat-research/2019/10/mahalo-fin7-responding-to-new-tools-and-techniques.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0805f7ac-0596-4154-bf56-8eb0ee5cc635",
      "subject": "ATTACK:enterprise:S1202",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0805f7ac-0596-4154-bf56-8eb0ee5cc635",
      "modified": "2026-04-29T14:23:05.914Z",
      "references": [
        {
          "source_name": "Joint Cybersecurity Advisory LockBit 3.0 MAR 2023",
          "url": "https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"
        },
        {
          "source_name": "INCIBE-CERT LockBit MAR 2024",
          "url": "https://www.incibe.es/en/incibe-cert/blog/lockbit-response-and-recovery-actions"
        },
        {
          "source_name": "Sentinel Labs LockBit 3.0 JUL 2022",
          "url": "https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--089eeb46-323e-410b-a27b-dc5ff4467c40",
      "subject": "ATTACK:enterprise:G0087",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--089eeb46-323e-410b-a27b-dc5ff4467c40",
      "modified": "2026-07-31T18:47:53.049Z",
      "references": [
        {
          "source_name": "FBI FLASH APT39 September 2020",
          "url": "https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0924ca96-c26b-4bd1-8c50-d3c1a9e1e25b",
      "subject": "ATTACK:enterprise:S1078",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0924ca96-c26b-4bd1-8c50-d3c1a9e1e25b",
      "modified": "2026-04-29T14:23:05.916Z",
      "references": [
        {
          "source_name": "RotaJakiro 2021 netlab360 analysis",
          "url": "https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--095f6266-2535-4991-ad6b-64388513d6e7",
      "subject": "ATTACK:enterprise:S0284",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--095f6266-2535-4991-ad6b-64388513d6e7",
      "modified": "2026-04-29T14:23:05.916Z",
      "references": [
        {
          "source_name": "Security Intelligence More Eggs Aug 2019",
          "url": "https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0977c267-10f9-4e4d-a947-464359c7a4ba",
      "subject": "ATTACK:enterprise:S1066",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0977c267-10f9-4e4d-a947-464359c7a4ba",
      "modified": "2026-04-29T14:23:05.916Z",
      "references": [
        {
          "source_name": "Secureworks DarkTortilla Aug 2022",
          "url": "https://www.secureworks.com/research/darktortilla-malware-analysis"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--09e94c75-2a53-4f13-a290-a4acf5dd4e71",
      "subject": "ATTACK:enterprise:S0666",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--09e94c75-2a53-4f13-a290-a4acf5dd4e71",
      "modified": "2026-04-29T14:23:05.917Z",
      "references": [
        {
          "source_name": "ESET Gelsemium June 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0bdfdf48-6d8b-4eeb-968d-fb3a73889d17",
      "subject": "ATTACK:enterprise:S9026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0bdfdf48-6d8b-4eeb-968d-fb3a73889d17",
      "modified": "2026-04-29T14:23:05.919Z",
      "references": [
        {
          "source_name": "Trend Micro Earth Kasha Updates APR 2025",
          "url": "https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0c4af99b-e82d-422f-86da-ccc94e55d763",
      "subject": "ATTACK:enterprise:S0226",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0c4af99b-e82d-422f-86da-ccc94e55d763",
      "modified": "2026-04-29T14:23:05.920Z",
      "references": [
        {
          "source_name": "Talos Smoke Loader July 2018",
          "url": "https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html#more"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0da38f11-0e39-4505-aa05-61464113ba8f",
      "subject": "ATTACK:enterprise:S1122",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0da38f11-0e39-4505-aa05-61464113ba8f",
      "modified": "2026-04-29T14:23:05.922Z",
      "references": [
        {
          "source_name": "ESET Security Mispadu Facebook Ads 2019",
          "url": "https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"
        },
        {
          "source_name": "SCILabs Malteiro 2021",
          "url": "https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0e3d54bf-90de-450d-af1c-c4372488b4f8",
      "subject": "ATTACK:enterprise:S0611",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0e3d54bf-90de-450d-af1c-c4372488b4f8",
      "modified": "2026-04-29T14:23:05.923Z",
      "references": [
        {
          "source_name": "Mcafee Clop Aug 2019",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--102849c0-0ed7-4e85-9d0b-791bcb7ef7ab",
      "subject": "ATTACK:enterprise:S0461",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--102849c0-0ed7-4e85-9d0b-791bcb7ef7ab",
      "modified": "2026-04-29T14:23:05.926Z",
      "references": [
        {
          "source_name": "IBM TA505 April 2020",
          "url": "https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"
        },
        {
          "source_name": "Proofpoint TA505 October 2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--114934d2-1f35-461f-9a18-1ae434695b30",
      "subject": "ATTACK:enterprise:S9046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--114934d2-1f35-461f-9a18-1ae434695b30",
      "modified": "2026-10-08T22:19:20.252Z",
      "references": [
        {
          "source_name": "Claroty-IOCONTROL",
          "url": "https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"
        },
        {
          "source_name": "Dragos-2026-Year-In-Review",
          "url": "https://5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--114f4fb4-3c0a-44b0-aeaf-2e2a3ba50fa5",
      "subject": "ATTACK:enterprise:S0638",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--114f4fb4-3c0a-44b0-aeaf-2e2a3ba50fa5",
      "modified": "2026-04-29T14:23:05.927Z",
      "references": [
        {
          "source_name": "Sogeti CERT ESEC Babuk March 2021",
          "url": "https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf"
        },
        {
          "source_name": "Medium Babuk February 2021",
          "url": "https://sebdraven.medium.com/babuk-is-distributed-packed-78e2f5dd2e62"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--128e8365-7645-41fa-832e-5ff4d8639035",
      "subject": "ATTACK:enterprise:S0127",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--128e8365-7645-41fa-832e-5ff4d8639035",
      "modified": "2026-04-29T14:23:05.929Z",
      "references": [
        {
          "source_name": "Palo Alto Networks BBSRAT",
          "url": "http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1387ec64-ba36-42cd-b659-c29e708d8281",
      "subject": "ATTACK:enterprise:S0663",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1387ec64-ba36-42cd-b659-c29e708d8281",
      "modified": "2026-04-29T14:23:05.931Z",
      "references": [
        {
          "source_name": "Trend Micro Iron Tiger April 2021",
          "url": "https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--13bc2a82-c51d-4410-9e62-223df287b8f7",
      "subject": "ATTACK:enterprise:S0447",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--13bc2a82-c51d-4410-9e62-223df287b8f7",
      "modified": "2026-04-29T14:23:05.931Z",
      "references": [
        {
          "source_name": "Talos Lokibot Jan 2021",
          "url": "https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1477187e-7bd8-4622-8c2d-e5978c1fd29f",
      "subject": "ATTACK:enterprise:S0223",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1477187e-7bd8-4622-8c2d-e5978c1fd29f",
      "modified": "2026-04-29T14:23:05.932Z",
      "references": [
        {
          "source_name": "ClearSky MuddyWater Nov 2018",
          "url": "https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--198cddce-40f7-43eb-aeac-60171f111065",
      "subject": "ATTACK:enterprise:S0269",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--198cddce-40f7-43eb-aeac-60171f111065",
      "modified": "2026-04-29T14:23:05.939Z",
      "references": [
        {
          "source_name": "Unit 42 QUADAGENT July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--19f9e4af-3ad9-4d0d-b4af-db145f514be9",
      "subject": "ATTACK:enterprise:G0090",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--19f9e4af-3ad9-4d0d-b4af-db145f514be9",
      "modified": "2026-07-31T20:48:52.386Z",
      "references": [
        {
          "source_name": "Lab52 WIRTE Apr 2019",
          "url": "https://lab52.io/blog/wirte-group-attacking-the-middle-east/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1a06ec1e-319c-4229-8ec7-b368f3886791",
      "subject": "ATTACK:enterprise:S0636",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1a06ec1e-319c-4229-8ec7-b368f3886791",
      "modified": "2026-04-29T14:23:05.940Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1b1e5d59-20a4-4915-a553-4db606d8121d",
      "subject": "ATTACK:enterprise:G0078",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1b1e5d59-20a4-4915-a553-4db606d8121d",
      "modified": "2026-07-31T18:47:42.520Z",
      "references": [
        {
          "source_name": "Unit 42 Gorgon Group Aug 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1bb8999a-16c3-420d-8feb-65b104d18fd9",
      "subject": "ATTACK:enterprise:S9057",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1bb8999a-16c3-420d-8feb-65b104d18fd9",
      "modified": "2026-09-28T16:07:22.573Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549_Nov2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1bd6e148-29c0-473e-8752-66bd01e3a629",
      "subject": "ATTACK:enterprise:S1164",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1bd6e148-29c0-473e-8752-66bd01e3a629",
      "modified": "2026-04-29T14:23:05.942Z",
      "references": [
        {
          "source_name": "Palo Alto MidnightEclipse APR 2024",
          "url": "https://unit42.paloaltonetworks.com/cve-2024-3400/"
        },
        {
          "source_name": "Volexity UPSTYLE 2024",
          "url": "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1c7681f4-4dc4-4722-9fcc-a79712fe502e",
      "subject": "ATTACK:enterprise:G0094",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1c7681f4-4dc4-4722-9fcc-a79712fe502e",
      "modified": "2026-07-31T20:48:24.542Z",
      "references": [
        {
          "source_name": "Talos Kimsuky Nov 2021",
          "url": "https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"
        },
        {
          "source_name": "Securonix Kimsuky February 2025",
          "url": "https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"
        },
        {
          "source_name": "Aryaka Kimsuky July 2025",
          "url": "https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1c9d4988-d9ea-4dd5-aef1-adb0232e87a3",
      "subject": "ATTACK:enterprise:S0532",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1c9d4988-d9ea-4dd5-aef1-adb0232e87a3",
      "modified": "2026-04-29T14:23:05.944Z",
      "references": [
        {
          "source_name": "Unit 42 Lucifer June 2020",
          "url": "https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1f12b17d-366e-44b6-bc1b-cfbb2b305616",
      "subject": "ATTACK:enterprise:S9016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1f12b17d-366e-44b6-bc1b-cfbb2b305616",
      "modified": "2026-04-29T14:23:05.947Z",
      "references": [
        {
          "source_name": "Zscaler BlindEagle DEC 2025",
          "url": "https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1f67c603-a567-42d1-b1ee-48fe9564c9bc",
      "subject": "ATTACK:enterprise:S0640",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1f67c603-a567-42d1-b1ee-48fe9564c9bc",
      "modified": "2026-04-29T14:23:05.947Z",
      "references": [
        {
          "source_name": "Arxiv Avaddon Feb 2021",
          "url": "https://arxiv.org/pdf/2102.04796.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--20c3b1d7-7702-4a0b-9902-dece6e413bf1",
      "subject": "ATTACK:enterprise:S1186",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--20c3b1d7-7702-4a0b-9902-dece6e413bf1",
      "modified": "2026-04-29T14:23:05.950Z",
      "references": [
        {
          "source_name": "CCCS ArcaneDoor 2024",
          "url": "https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--21281614-d7cc-4211-9365-d318c99cb906",
      "subject": "ATTACK:enterprise:S0615",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--21281614-d7cc-4211-9365-d318c99cb906",
      "modified": "2026-04-29T14:23:05.950Z",
      "references": [
        {
          "source_name": "BlackBerry CostaRicto November 2020",
          "url": "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"
        },
        {
          "source_name": "CISA AR21-126A FIVEHANDS May 2021",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--21b4dd86-a629-4e42-944c-f5e4b90e5312",
      "subject": "ATTACK:enterprise:S1248",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--21b4dd86-a629-4e42-944c-f5e4b90e5312",
      "modified": "2026-04-29T14:23:05.951Z",
      "references": [
        {
          "source_name": "Socket BeaverTail XORIndex HexEval Contagious Interview July 2025",
          "url": "https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2310666c-87e1-45ae-bac8-2255215e858a",
      "subject": "ATTACK:enterprise:G1036",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2310666c-87e1-45ae-bac8-2255215e858a",
      "modified": "2026-07-31T18:48:24.825Z",
      "references": [
        {
          "source_name": "Microsoft Moonstone Sleet 2024",
          "url": "https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2310e7b8-a4c7-460d-a89d-8d5854c59a44",
      "subject": "ATTACK:enterprise:S1026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2310e7b8-a4c7-460d-a89d-8d5854c59a44",
      "modified": "2026-04-29T14:23:05.953Z",
      "references": [
        {
          "source_name": "SentinelOne Aoqin Dragon June 2022",
          "url": "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2329e6c4-5462-4d14-9a50-2d9272f83a09",
      "subject": "ATTACK:enterprise:S1115",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2329e6c4-5462-4d14-9a50-2d9272f83a09",
      "modified": "2026-04-29T14:23:05.953Z",
      "references": [
        {
          "source_name": "Mandiant Cutting Edge January 2024",
          "url": "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--23679538-e90c-430d-b375-6d8bbf8ec723",
      "subject": "ATTACK:enterprise:S0661",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--23679538-e90c-430d-b375-6d8bbf8ec723",
      "modified": "2026-04-29T14:23:05.953Z",
      "references": [
        {
          "source_name": "MSTIC FoggyWeb September 2021",
          "url": "https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--239cb026-369a-43f0-922c-cdc38d124430",
      "subject": "ATTACK:enterprise:S0434",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--239cb026-369a-43f0-922c-cdc38d124430",
      "modified": "2026-04-29T14:23:05.954Z",
      "references": [
        {
          "source_name": "QiAnXin APT-C-36 Feb2019",
          "url": "https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--243b5790-ce5b-45cb-80d0-55944a7e3b53",
      "subject": "ATTACK:enterprise:S9014",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--243b5790-ce5b-45cb-80d0-55944a7e3b53",
      "modified": "2026-04-29T14:23:05.955Z",
      "references": [
        {
          "source_name": "Google UNC5221 Ivanti January 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--25446e74-d461-4113-8ff9-9d6984696680",
      "subject": "ATTACK:enterprise:C0005",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--25446e74-d461-4113-8ff9-9d6984696680",
      "modified": "2026-07-31T18:47:22.374Z",
      "references": [
        {
          "source_name": "ESET Operation Spalax Jan 2021",
          "url": "https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--254dea59-0bd6-4966-9eff-d5997a7e91c1",
      "subject": "ATTACK:enterprise:S1113",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--254dea59-0bd6-4966-9eff-d5997a7e91c1",
      "modified": "2026-04-29T14:23:05.956Z",
      "references": [
        {
          "source_name": "Mandiant Pulse Secure Update May 2021",
          "url": "https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--26303f07-87f0-4740-b6ea-e81e8c01b267",
      "subject": "ATTACK:enterprise:S0456",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--26303f07-87f0-4740-b6ea-e81e8c01b267",
      "modified": "2026-04-29T14:23:05.957Z",
      "references": [
        {
          "source_name": "CheckPoint Naikon May 2020",
          "url": "https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--26a6be0e-6d53-4f54-b190-af359bfab4fc",
      "subject": "ATTACK:enterprise:S0596",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--26a6be0e-6d53-4f54-b190-af359bfab4fc",
      "modified": "2026-04-29T14:23:05.958Z",
      "references": [
        {
          "source_name": "Kaspersky ShadowPad Aug 2017",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--27d0ccf1-00df-40f5-ad96-807e54862467",
      "subject": "ATTACK:enterprise:S1076",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--27d0ccf1-00df-40f5-ad96-807e54862467",
      "modified": "2026-04-29T14:23:05.959Z",
      "references": [
        {
          "source_name": "Mandiant Suspected Turla Campaign February 2023",
          "url": "https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--283bdd5f-f356-43a2-864c-6f8211073d45",
      "subject": "ATTACK:enterprise:S0188",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--283bdd5f-f356-43a2-864c-6f8211073d45",
      "modified": "2026-04-29T14:23:05.960Z",
      "references": [
        {
          "source_name": "Symantec Sowbug Nov 2017",
          "url": "https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--28f9439e-f458-4c48-8f5c-2e58852fdf79",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--28f9439e-f458-4c48-8f5c-2e58852fdf79",
      "modified": "2026-07-31T18:47:51.801Z",
      "references": [
        {
          "source_name": "Lab52 MUSTANG PANDA PUBLOAD MAY 2023",
          "url": "https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"
        },
        {
          "source_name": "EclecticIQ Mustang Panda PlugX",
          "url": "https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"
        },
        {
          "source_name": "Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"
        },
        {
          "source_name": "Unit42 Bookworm Nov2015",
          "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
        },
        {
          "source_name": "Palo Alto Networks, Unit 42",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
        },
        {
          "source_name": "Sophos Mustang Panda PLUGX",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-government-officials"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2b062058-3345-4993-9715-6ad6e98dc2ad",
      "subject": "ATTACK:enterprise:S0436",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2b062058-3345-4993-9715-6ad6e98dc2ad",
      "modified": "2026-04-29T14:23:05.963Z",
      "references": [
        {
          "source_name": "JPCert TSCookie March 2018",
          "url": "https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2ca546e0-6a3f-4a9f-82c3-2e41ffa67b79",
      "subject": "ATTACK:enterprise:S0575",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2ca546e0-6a3f-4a9f-82c3-2e41ffa67b79",
      "modified": "2026-04-29T14:23:05.965Z",
      "references": [
        {
          "source_name": "Cybereason Conti Jan 2021",
          "url": "https://www.cybereason.com/blog/cybereason-vs.-conti-ransomware"
        },
        {
          "source_name": "CarbonBlack Conti July 2020",
          "url": "https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2d822996-4574-402d-8d0f-1cfc0e963850",
      "subject": "ATTACK:enterprise:S0236",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2d822996-4574-402d-8d0f-1cfc0e963850",
      "modified": "2026-04-29T14:23:05.966Z",
      "references": [
        {
          "source_name": "Symantec Orangeworm April 2018",
          "url": "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2e2e3a71-51b6-4779-a376-a9cc2750b5da",
      "subject": "ATTACK:enterprise:S0629",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2e2e3a71-51b6-4779-a376-a9cc2750b5da",
      "modified": "2026-04-29T14:23:05.967Z",
      "references": [
        {
          "source_name": "Bitdefender Naikon April 2021",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--309652a1-45a4-4479-9e84-dfab33d0a1f5",
      "subject": "ATTACK:enterprise:S0255",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--309652a1-45a4-4479-9e84-dfab33d0a1f5",
      "modified": "2026-04-29T14:23:05.978Z",
      "references": [
        {
          "source_name": "Rancor Unit42 June 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--31fa2481-0b4f-40d4-b438-1d04a7eb0888",
      "subject": "ATTACK:enterprise:S0361",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--31fa2481-0b4f-40d4-b438-1d04a7eb0888",
      "modified": "2026-04-29T14:23:05.982Z",
      "references": [
        {
          "source_name": "Microsoft Expand Utility",
          "url": "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/expand"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--33d24077-13af-4e14-ba79-87ca145c5383",
      "subject": "ATTACK:enterprise:S0354",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--33d24077-13af-4e14-ba79-87ca145c5383",
      "modified": "2026-04-29T14:23:05.988Z",
      "references": [
        {
          "source_name": "Cybereason Cobalt Kitty 2017",
          "url": "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--340825b1-a2db-4be1-943a-9b529842ae18",
      "subject": "ATTACK:enterprise:S1224",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--340825b1-a2db-4be1-943a-9b529842ae18",
      "modified": "2026-04-29T14:23:05.988Z",
      "references": [
        {
          "source_name": "Mandiant Fortinet Zero Day",
          "url": "https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3471a32a-47fc-4ba7-ac67-887d9872e316",
      "subject": "ATTACK:enterprise:S1039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3471a32a-47fc-4ba7-ac67-887d9872e316",
      "modified": "2026-04-29T14:23:05.989Z",
      "references": [
        {
          "source_name": "Proofpoint Bumblebee April 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"
        },
        {
          "source_name": "Medium Ali Salem Bumblebee April 2022",
          "url": "https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--347aa8dd-7fb9-45b0-9472-6894b881ebf1",
      "subject": "ATTACK:enterprise:G1030",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--347aa8dd-7fb9-45b0-9472-6894b881ebf1",
      "modified": "2026-07-31T18:48:14.620Z",
      "references": [
        {
          "source_name": "SentinelOne Agrius 2021",
          "url": "https://assets.sentinelone.com/sentinellabs/evol-agrius"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--347ee2ed-7def-45ac-9935-063a679859ae",
      "subject": "ATTACK:enterprise:S0355",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--347ee2ed-7def-45ac-9935-063a679859ae",
      "modified": "2026-04-29T14:23:05.989Z",
      "references": [
        {
          "source_name": "Unit 42 Nokki Oct 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--352e6e5a-f1e0-46f8-826a-978981f6d893",
      "subject": "ATTACK:enterprise:G0004",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--352e6e5a-f1e0-46f8-826a-978981f6d893",
      "modified": "2026-07-31T18:48:00.539Z",
      "references": [
        {
          "source_name": "Microsoft NICKEL December 2021",
          "url": "https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--353dd407-0850-4bc4-a447-cd1b708b3833",
      "subject": "ATTACK:enterprise:S0635",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--353dd407-0850-4bc4-a447-cd1b708b3833",
      "modified": "2026-04-29T14:23:05.991Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--356aa4b0-e6c2-4ef7-a3b2-837c25c283b3",
      "subject": "ATTACK:enterprise:S1041",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--356aa4b0-e6c2-4ef7-a3b2-837c25c283b3",
      "modified": "2026-04-29T14:23:05.991Z",
      "references": [
        {
          "source_name": "Bitdefender FunnyDream Campaign November 2020",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3733dda5-9dd9-43d1-ac3a-24f1b5fb86e7",
      "subject": "ATTACK:enterprise:S0344",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3733dda5-9dd9-43d1-ac3a-24f1b5fb86e7",
      "modified": "2026-04-29T14:23:05.995Z",
      "references": [
        {
          "source_name": "Unit42 Azorult Nov 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"
        },
        {
          "source_name": "Proofpoint Azorult July 2018",
          "url": "https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--383301a1-1cf9-4a74-ab22-2ed1a8c2a42b",
      "subject": "ATTACK:enterprise:S0373",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--383301a1-1cf9-4a74-ab22-2ed1a8c2a42b",
      "modified": "2026-04-29T14:23:05.997Z",
      "references": [
        {
          "source_name": "Cybereason Astaroth Feb 2019",
          "url": "https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research"
        },
        {
          "source_name": "Securelist Brazilian Banking Malware July 2020",
          "url": "https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--386f2d28-9b7b-43b7-bc06-d7d8ffc644e2",
      "subject": "ATTACK:enterprise:S0650",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--386f2d28-9b7b-43b7-bc06-d7d8ffc644e2",
      "modified": "2026-04-29T14:23:05.997Z",
      "references": [
        {
          "source_name": "Cyberint Qakbot May 2021",
          "url": "https://blog.cyberint.com/qakbot-banking-trojan"
        },
        {
          "source_name": "ATT QakBot April 2021",
          "url": "https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"
        },
        {
          "source_name": "Kaspersky QakBot September 2021",
          "url": "https://securelist.com/qakbot-technical-analysis/103931/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--38d896b7-6e7a-44e0-9b52-77da42dd59f6",
      "subject": "ATTACK:enterprise:S1142",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--38d896b7-6e7a-44e0-9b52-77da42dd59f6",
      "modified": "2026-04-29T14:23:05.998Z",
      "references": [
        {
          "source_name": "ESET Turla Lunar toolset May 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3921c748-c29e-4c2f-b5cb-bcc7c0237219",
      "subject": "ATTACK:enterprise:S0603",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3921c748-c29e-4c2f-b5cb-bcc7c0237219",
      "modified": "2026-04-29T14:23:05.998Z",
      "references": [
        {
          "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
          "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3967e156-2135-4416-b3c3-79372d19d610",
      "subject": "ATTACK:enterprise:S0457",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3967e156-2135-4416-b3c3-79372d19d610",
      "modified": "2026-04-29T14:23:05.999Z",
      "references": [
        {
          "source_name": "Sophos Netwalker May 2020",
          "url": "https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--39742f2e-0cba-4315-b2c5-fd8d8e604413",
      "subject": "ATTACK:enterprise:S1213",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--39742f2e-0cba-4315-b2c5-fd8d8e604413",
      "modified": "2026-04-29T14:23:05.999Z",
      "references": [
        {
          "source_name": "Netskope LummaStealer 2025",
          "url": "https://www.netskope.com/blog/lumma-stealer-fake-captchas-new-techniques-to-evade-detection"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--397cb08d-0466-4f92-8317-73da637dcded",
      "subject": "ATTACK:enterprise:S9010",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--397cb08d-0466-4f92-8317-73da637dcded",
      "modified": "2026-04-29T14:23:05.999Z",
      "references": [
        {
          "source_name": "Koi Glassworm New Tricks December 2025",
          "url": "https://www.koi.ai/blog/glassworm-goes-mac-fresh-infrastructure-new-tricks"
        },
        {
          "source_name": "Koi Glassworm InvisibleCode October 2025",
          "url": "https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace"
        },
        {
          "source_name": "Socket GlassWorm January 2026",
          "url": "https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--39adf593-14d2-42c7-a9e3-957ada5ec5b1",
      "subject": "ATTACK:enterprise:S9025",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--39adf593-14d2-42c7-a9e3-957ada5ec5b1",
      "modified": "2026-04-29T14:23:05.999Z",
      "references": [
        {
          "source_name": "Trend Micro Earth Kasha NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--39e0a84e-24de-4b0f-a0e4-3a821b8f963a",
      "subject": "ATTACK:enterprise:S1030",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--39e0a84e-24de-4b0f-a0e4-3a821b8f963a",
      "modified": "2026-04-29T14:23:05.999Z",
      "references": [
        {
          "source_name": "ZScaler Squirrelwaffle Sep 2021",
          "url": "https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"
        },
        {
          "source_name": "Netskope Squirrelwaffle Oct 2021",
          "url": "https://www.netskope.com/blog/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3a6a72e8-0637-41db-b455-6b5d629aba28",
      "subject": "ATTACK:enterprise:S0622",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3a6a72e8-0637-41db-b455-6b5d629aba28",
      "modified": "2026-04-29T14:23:06.001Z",
      "references": [
        {
          "source_name": "Malwarebytes Kimsuky June 2021",
          "url": "https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3c7d55d0-6f53-4e2f-8504-9a298d275286",
      "subject": "ATTACK:enterprise:S9036",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3c7d55d0-6f53-4e2f-8504-9a298d275286",
      "modified": "2026-04-29T14:23:06.006Z",
      "references": [
        {
          "source_name": "ESET_MuddyWater_Dec2025",
          "url": "https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3c8467e6-0878-4c62-afe6-55f124872089",
      "subject": "ATTACK:enterprise:S0469",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3c8467e6-0878-4c62-afe6-55f124872089",
      "modified": "2026-04-29T14:23:06.007Z",
      "references": [
        {
          "source_name": "Trend Micro Tick November 2019",
          "url": "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3cadf7f7-481c-45e4-b64b-ed03b349be20",
      "subject": "ATTACK:enterprise:S9011",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3cadf7f7-481c-45e4-b64b-ed03b349be20",
      "modified": "2026-04-29T14:23:06.007Z",
      "references": [
        {
          "source_name": "Google UNC5221 Ivanti April 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3cd2c187-587c-4969-957d-122ce654fc2a",
      "subject": "ATTACK:enterprise:S0264",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3cd2c187-587c-4969-957d-122ce654fc2a",
      "modified": "2026-04-29T14:23:06.008Z",
      "references": [
        {
          "source_name": "Unit 42 OopsIE! Feb 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3e0509c4-02e0-4f07-9b8c-7c51687494cf",
      "subject": "ATTACK:enterprise:S1245",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3e0509c4-02e0-4f07-9b8c-7c51687494cf",
      "modified": "2026-04-29T14:23:06.009Z",
      "references": [
        {
          "source_name": "ESET Contagious Interview BeaverTail InvisibleFerret February 2025",
          "url": "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3f2be4a4-b7fb-4845-af50-34ca28f03ab3",
      "subject": "ATTACK:enterprise:G0082",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3f2be4a4-b7fb-4845-af50-34ca28f03ab3",
      "modified": "2026-09-30T21:29:24.664Z",
      "references": [
        {
          "source_name": "MIcrosoft Mastra npm Compromise JUN 2026",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"
        },
        {
          "source_name": "1 - appv",
          "url": "https://securelist.com/bluenoroff-methods-bypass-motw/108383/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3f55cf61-8cbe-48ac-904f-299030d02dc3",
      "subject": "ATTACK:enterprise:S9027",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3f55cf61-8cbe-48ac-904f-299030d02dc3",
      "modified": "2026-04-29T14:23:06.011Z",
      "references": [
        {
          "source_name": "Trend Micro Earth Kasha Anel NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--42f5a98f-bf34-4b60-ac0c-dfca896c8235",
      "subject": "ATTACK:enterprise:G1017",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--42f5a98f-bf34-4b60-ac0c-dfca896c8235",
      "modified": "2026-07-31T18:47:40.186Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE SILHOUETTE May 2023",
          "url": "https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--43c68bb8-28e2-4ee0-91aa-ffc16dcc45bc",
      "subject": "ATTACK:enterprise:S1051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--43c68bb8-28e2-4ee0-91aa-ffc16dcc45bc",
      "modified": "2026-04-29T14:23:06.018Z",
      "references": [
        {
          "source_name": "Mandiant APT41",
          "url": "https://www.mandiant.com/resources/apt41-us-state-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--441fa206-c1cf-40dd-850e-897adcf4776f",
      "subject": "ATTACK:enterprise:S9001",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--441fa206-c1cf-40dd-850e-897adcf4776f",
      "modified": "2026-04-29T14:23:06.018Z",
      "references": [
        {
          "source_name": "AhnLab_SystemBC_Apr2022",
          "url": "https://asec.ahnlab.com/en/33600/"
        },
        {
          "source_name": "Lumen_SystemBC_Sept2025",
          "url": "https://blog.lumen.com/systembc-bringing-the-noise/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--44caec3d-e8d3-48b6-9991-f5b164370538",
      "subject": "ATTACK:enterprise:S1119",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--44caec3d-e8d3-48b6-9991-f5b164370538",
      "modified": "2026-04-29T14:23:06.019Z",
      "references": [
        {
          "source_name": "Mandiant Cutting Edge Part 2 January 2024",
          "url": "https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--45e9de66-7203-48e9-bd9b-096c289f35db",
      "subject": "ATTACK:enterprise:S0430",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--45e9de66-7203-48e9-bd9b-096c289f35db",
      "modified": "2026-04-29T14:23:06.021Z",
      "references": [
        {
          "source_name": "Chronicle Winnti for Linux May 2019",
          "url": "https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--45f7f495-2de8-4f78-87ec-14201cfc1d46",
      "subject": "ATTACK:enterprise:S0674",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--45f7f495-2de8-4f78-87ec-14201cfc1d46",
      "modified": "2026-04-29T14:23:06.021Z",
      "references": [
        {
          "source_name": "Check Point APT35 CharmPower January 2022",
          "url": "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4800e509-0653-4895-a9f0-e0b538592875",
      "subject": "ATTACK:enterprise:S0377",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4800e509-0653-4895-a9f0-e0b538592875",
      "modified": "2026-04-29T14:23:06.023Z",
      "references": [
        {
          "source_name": "ESET Ebury Oct 2017",
          "url": "https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4975b6f9-c542-4ad9-bfeb-6182c4db895f",
      "subject": "ATTACK:enterprise:S1060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4975b6f9-c542-4ad9-bfeb-6182c4db895f",
      "modified": "2026-04-29T14:23:06.025Z",
      "references": [
        {
          "source_name": "SentinelLabs Metador Sept 2022",
          "url": "https://assets.sentinelone.com/sentinellabs22/metador#page=1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--497aec05-cb34-424d-943f-4fdfbf2585b4",
      "subject": "ATTACK:enterprise:G0021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--497aec05-cb34-424d-943f-4fdfbf2585b4",
      "modified": "2026-07-31T18:48:23.682Z",
      "references": [
        {
          "source_name": "Kaspersky MoleRATs April 2019",
          "url": "https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--49c8b6c8-9c61-45d1-b7d0-aa778f58f055",
      "subject": "ATTACK:enterprise:C0058",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--49c8b6c8-9c61-45d1-b7d0-aa778f58f055",
      "modified": "2026-07-31T18:47:18.224Z",
      "references": [
        {
          "source_name": "Palo Alto SharePoint Vulnerabilities JUL 2025",
          "url": "https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--49f9b769-57d1-4d73-8194-59b584a72c1b",
      "subject": "ATTACK:enterprise:S0268",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--49f9b769-57d1-4d73-8194-59b584a72c1b",
      "modified": "2026-04-29T14:23:06.026Z",
      "references": [
        {
          "source_name": "Unit 42 Bisonal July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-attacks-russia-south-korea/"
        },
        {
          "source_name": "Talos Bisonal Mar 2020",
          "url": "https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4a8098a6-da49-4a36-805b-acce98efa827",
      "subject": "ATTACK:enterprise:C0017",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4a8098a6-da49-4a36-805b-acce98efa827",
      "modified": "2026-07-31T21:12:31.205Z",
      "references": [
        {
          "source_name": "Mandiant APT41",
          "url": "https://www.mandiant.com/resources/apt41-us-state-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4b3f0b38-d4e2-49e8-a8f9-6a186c31967f",
      "subject": "ATTACK:enterprise:G0012",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4b3f0b38-d4e2-49e8-a8f9-6a186c31967f",
      "modified": "2026-07-31T18:48:11.925Z",
      "references": [
        {
          "source_name": "Securelist Darkhotel Aug 2015",
          "url": "https://securelist.com/darkhotels-attacks-in-2015/71713/"
        },
        {
          "source_name": "Microsoft DUBNIUM July 2016",
          "url": "https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4ca73e82-4e56-4044-a21a-d613a80f171c",
      "subject": "ATTACK:enterprise:S0352",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4ca73e82-4e56-4044-a21a-d613a80f171c",
      "modified": "2026-04-29T14:23:06.030Z",
      "references": [
        {
          "source_name": "Unit42 OceanLotus 2017",
          "url": "https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4e3a250d-c168-4544-82c5-3b1414be826d",
      "subject": "ATTACK:enterprise:S1032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4e3a250d-c168-4544-82c5-3b1414be826d",
      "modified": "2026-04-29T14:23:06.032Z",
      "references": [
        {
          "source_name": "Checkpoint MosesStaff Nov 2021",
          "url": "https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4f89d6c4-29ec-4777-bbc9-b0ea78064c42",
      "subject": "ATTACK:enterprise:S0448",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4f89d6c4-29ec-4777-bbc9-b0ea78064c42",
      "modified": "2026-04-29T14:23:06.034Z",
      "references": [
        {
          "source_name": "McAfee Sharpshooter December 2018",
          "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4ffef54e-be6b-40cf-9446-d886f298d79c",
      "subject": "ATTACK:enterprise:S0115",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4ffef54e-be6b-40cf-9446-d886f298d79c",
      "modified": "2026-04-29T14:23:06.034Z",
      "references": [
        {
          "source_name": "Proofpoint Operation Transparent Tribe March 2016",
          "url": "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--512b3fed-39aa-407d-b274-5a65229688b7",
      "subject": "ATTACK:enterprise:S0678",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--512b3fed-39aa-407d-b274-5a65229688b7",
      "modified": "2026-04-29T14:23:06.036Z",
      "references": [
        {
          "source_name": "McAfee Lazarus Nov 2020",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5149c8de-5790-4f52-8527-1e2aac11b381",
      "subject": "ATTACK:enterprise:S1235",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5149c8de-5790-4f52-8527-1e2aac11b381",
      "modified": "2026-04-29T14:23:06.036Z",
      "references": [
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5179c603-0184-455d-8de6-5a2dbda3bccc",
      "subject": "ATTACK:enterprise:C0063",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5179c603-0184-455d-8de6-5a2dbda3bccc",
      "modified": "2026-07-31T20:48:19.624Z",
      "references": [
        {
          "source_name": "CERT Polska",
          "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--52893247-a6d6-4119-881a-09e10121edf5",
      "subject": "ATTACK:enterprise:S1027",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--52893247-a6d6-4119-881a-09e10121edf5",
      "modified": "2026-04-29T14:23:06.038Z",
      "references": [
        {
          "source_name": "SentinelOne Aoqin Dragon June 2022",
          "url": "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--52a5b303-b759-424e-86b8-5c855976e5ea",
      "subject": "ATTACK:enterprise:G1006",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--52a5b303-b759-424e-86b8-5c855976e5ea",
      "modified": "2026-07-31T20:48:48.194Z",
      "references": [
        {
          "source_name": "TrendMicro EarthLusca 2022",
          "url": "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--53b64a61-b521-4767-9c3a-bb73d518aa15",
      "subject": "ATTACK:enterprise:S0667",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--53b64a61-b521-4767-9c3a-bb73d518aa15",
      "modified": "2026-04-29T14:23:06.039Z",
      "references": [
        {
          "source_name": "ESET Gelsemium June 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5412525e-cba5-4fa1-89ff-7e6fa2b92e24",
      "subject": "ATTACK:enterprise:S0239",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5412525e-cba5-4fa1-89ff-7e6fa2b92e24",
      "modified": "2026-04-29T14:23:06.040Z",
      "references": [
        {
          "source_name": "US-CERT Bankshot Dec 2017",
          "url": "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--54c703f9-67ef-4622-afed-0ebbd2563e9e",
      "subject": "ATTACK:enterprise:S0257",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--54c703f9-67ef-4622-afed-0ebbd2563e9e",
      "modified": "2026-04-29T14:23:06.041Z",
      "references": [
        {
          "source_name": "Unit 42 VERMIN Jan 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--54d9e07f-eff6-41e9-8821-3bb7ac657c8c",
      "subject": "ATTACK:enterprise:S0395",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--54d9e07f-eff6-41e9-8821-3bb7ac657c8c",
      "modified": "2026-04-29T14:23:06.041Z",
      "references": [
        {
          "source_name": "ESET LightNeuron May 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--54e76e33-91b4-409f-a784-7e181f82b216",
      "subject": "ATTACK:enterprise:S0487",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--54e76e33-91b4-409f-a784-7e181f82b216",
      "modified": "2026-04-29T14:23:06.041Z",
      "references": [
        {
          "source_name": "ESET ForSSHe December 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--55fc98ea-8269-4ac7-9209-9013de03c955",
      "subject": "ATTACK:enterprise:S1117",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--55fc98ea-8269-4ac7-9209-9013de03c955",
      "modified": "2026-04-29T14:23:06.043Z",
      "references": [
        {
          "source_name": "Volexity Ivanti Zero-Day Exploitation January 2024",
          "url": "https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--566d783a-2d86-4b9a-8ca0-5013de5f7fb4",
      "subject": "ATTACK:enterprise:S0189",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--566d783a-2d86-4b9a-8ca0-5013de5f7fb4",
      "modified": "2026-04-29T14:23:06.043Z",
      "references": [
        {
          "source_name": "OilRig New Delivery Oct 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--568ad9ef-8cbc-4274-b99e-a33c455096cb",
      "subject": "ATTACK:enterprise:G1046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--568ad9ef-8cbc-4274-b99e-a33c455096cb",
      "modified": "2026-07-31T18:47:47.898Z",
      "references": [
        {
          "source_name": "rapid7-email-bombing",
          "url": "https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--57388233-1b28-4ae4-b92b-f5eb7d47d6f0",
      "subject": "ATTACK:enterprise:S9041",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--57388233-1b28-4ae4-b92b-f5eb7d47d6f0",
      "modified": "2026-07-08T18:09:28.958Z",
      "references": [
        {
          "source_name": "Aqua Security Blog Trivy Compromise APR 2026",
          "url": "https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--57861b9c-0d72-4c5d-8240-5fd038acf454",
      "subject": "ATTACK:enterprise:S9042",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--57861b9c-0d72-4c5d-8240-5fd038acf454",
      "modified": "2026-07-27T20:14:19.766Z",
      "references": [
        {
          "source_name": "Aikido TeamPCP Trivy MAR 2026",
          "url": "https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--582215ef-b7dd-43c3-a4ca-3a4a14edde59",
      "subject": "ATTACK:enterprise:S1085",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--582215ef-b7dd-43c3-a4ca-3a4a14edde59",
      "modified": "2026-04-29T14:23:06.045Z",
      "references": [
        {
          "source_name": "Symantec FIN8 Jul 2023",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--584bbe94-c7bf-4039-970c-545da4e2bf92",
      "subject": "ATTACK:enterprise:G0128",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--584bbe94-c7bf-4039-970c-545da4e2bf92",
      "modified": "2026-07-31T18:47:52.252Z",
      "references": [
        {
          "source_name": "Check Point APT31 February 2021",
          "url": "https://research.checkpoint.com/2021/the-story-of-jian/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--58545f9a-d2cf-4466-bc7f-9cdbdce25d70",
      "subject": "ATTACK:enterprise:G0069",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--58545f9a-d2cf-4466-bc7f-9cdbdce25d70",
      "modified": "2026-07-31T20:48:29.835Z",
      "references": [
        {
          "source_name": "ClearSky MuddyWater Nov 2018",
          "url": "https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"
        },
        {
          "source_name": "Talos MuddyWater Jan 2022",
          "url": "https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"
        },
        {
          "source_name": "FireEye MuddyWater Mar 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"
        },
        {
          "source_name": "MuddyWater TrendMicro June 2018",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/another-potential-muddywater-campaign-uses-powershell-based-prb-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5918cee6-c2f1-41be-ab96-36f3d17e5293",
      "subject": "ATTACK:enterprise:S0160",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5918cee6-c2f1-41be-ab96-36f3d17e5293",
      "modified": "2026-04-29T14:23:06.047Z",
      "references": [
        {
          "source_name": "Malwarebytes Targeted Attack against Saudi Arabia",
          "url": "https://blog.malwarebytes.com/cybercrime/social-engineering-cybercrime/2017/03/new-targeted-attack-saudi-arabia-government/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5998186f-20af-4b30-8ae7-4d4648d96327",
      "subject": "ATTACK:enterprise:S1059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5998186f-20af-4b30-8ae7-4d4648d96327",
      "modified": "2026-04-29T14:23:06.047Z",
      "references": [
        {
          "source_name": "SentinelLabs Metador Sept 2022",
          "url": "https://assets.sentinelone.com/sentinellabs22/metador#page=1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--59b93237-62e9-42bf-a3a4-8dc2148464f2",
      "subject": "ATTACK:enterprise:S1179",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--59b93237-62e9-42bf-a3a4-8dc2148464f2",
      "modified": "2026-04-29T14:23:06.047Z",
      "references": [
        {
          "source_name": "Microsoft BlackByte 2023",
          "url": "https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5a56f203-5537-4dd1-a08d-db4526bf75bd",
      "subject": "ATTACK:enterprise:S1160",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5a56f203-5537-4dd1-a08d-db4526bf75bd",
      "modified": "2026-04-29T14:23:06.048Z",
      "references": [
        {
          "source_name": "Bitsight Latrodectus June 2024",
          "url": "https://www.bitsight.com/blog/latrodectus-are-you-coming-back"
        },
        {
          "source_name": "Latrodectus APR 2024",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"
        },
        {
          "source_name": "Elastic Latrodectus May 2024",
          "url": "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5b928b39-ce48-47b8-82bc-d4ec63b1e3f4",
      "subject": "ATTACK:enterprise:S0011",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5b928b39-ce48-47b8-82bc-d4ec63b1e3f4",
      "modified": "2026-04-29T14:23:06.050Z",
      "references": [
        {
          "source_name": "CISA MAR-10292089-1.v2 TAIDOOR August 2021",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5bb98e61-548f-4ba0-9a25-50cbca531826",
      "subject": "ATTACK:enterprise:S1228",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5bb98e61-548f-4ba0-9a25-50cbca531826",
      "modified": "2026-04-29T14:23:06.050Z",
      "references": [
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "Lab52 MUSTANG PANDA PUBLOAD MAY 2023",
          "url": "https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        },
        {
          "source_name": "Palo Alto Networks, Unit 42",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5e53c0fb-e7f9-4b6d-a0a0-b7c64b5a3b6e",
      "subject": "ATTACK:enterprise:S1149",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5e53c0fb-e7f9-4b6d-a0a0-b7c64b5a3b6e",
      "modified": "2026-04-29T14:23:06.054Z",
      "references": [
        {
          "source_name": "Mandiant ROADSWEEP August 2022",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--60061356-7b82-4bd0-b9bc-ae1518753f3a",
      "subject": "ATTACK:enterprise:S1168",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--60061356-7b82-4bd0-b9bc-ae1518753f3a",
      "modified": "2026-04-29T14:23:06.056Z",
      "references": [
        {
          "source_name": "ESET OilRig Downloaders DEC 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"
        },
        {
          "source_name": "ESET OilRig Campaigns Sep 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--609f941d-2768-4e1f-9286-774a954a8bdb",
      "subject": "ATTACK:enterprise:S9018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--609f941d-2768-4e1f-9286-774a954a8bdb",
      "modified": "2026-04-29T14:23:06.056Z",
      "references": [
        {
          "source_name": "Check Point Blind Eagle MAR 2025",
          "url": "https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"
        },
        {
          "source_name": "Palo Alto HeartCrypt DEC 2024",
          "url": "https://unit42.paloaltonetworks.com/packer-as-a-service-heartcrypt-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--613c0bcd-d165-472b-adc8-1e547edb13af",
      "subject": "ATTACK:enterprise:S1141",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--613c0bcd-d165-472b-adc8-1e547edb13af",
      "modified": "2026-04-29T14:23:06.057Z",
      "references": [
        {
          "source_name": "ESET Turla Lunar toolset May 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--627ec847-1807-4e99-b968-f1ab412d17d1",
      "subject": "ATTACK:enterprise:S1110",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--627ec847-1807-4e99-b968-f1ab412d17d1",
      "modified": "2026-04-29T14:23:06.059Z",
      "references": [
        {
          "source_name": "Mandiant Pulse Secure Zero-Day April 2021",
          "url": "https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--63b6fd1d-65a7-4c94-8045-16fd198802f1",
      "subject": "ATTACK:enterprise:S0495",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--63b6fd1d-65a7-4c94-8045-16fd198802f1",
      "modified": "2026-04-29T14:23:06.061Z",
      "references": [
        {
          "source_name": "Unit42 RDAT July 2020",
          "url": "https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--64eeba9b-c972-4671-bb08-fca6d2445b8a",
      "subject": "ATTACK:enterprise:S1153",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--64eeba9b-c972-4671-bb08-fca6d2445b8a",
      "modified": "2026-04-29T14:23:06.062Z",
      "references": [
        {
          "source_name": "Kandji Cuckoo April 2024",
          "url": "https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"
        },
        {
          "source_name": "SentinelOne Cuckoo Stealer May 2024",
          "url": "https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--657ef43d-5d67-4699-8308-0ec83ff16485",
      "subject": "ATTACK:enterprise:S9052",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--657ef43d-5d67-4699-8308-0ec83ff16485",
      "modified": "2026-09-24T18:39:07.917Z",
      "references": [
        {
          "source_name": "CheckPoint_NimbusManticore_May2026",
          "url": "https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--66044dfc-ab9a-4de4-a20b-cfed6d3f6236",
      "subject": "ATTACK:enterprise:S0554",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--66044dfc-ab9a-4de4-a20b-cfed6d3f6236",
      "modified": "2026-04-29T14:23:06.064Z",
      "references": [
        {
          "source_name": "NHS Digital Egregor Nov 2020",
          "url": "https://digital.nhs.uk/cyber-alerts/2020/cc-3681#summary"
        },
        {
          "source_name": "Cybereason Egregor Nov 2020",
          "url": "https://www.cybereason.com/blog/cybereason-vs-egregor-ransomware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--66c646e5-2364-4d26-bd03-56e5544553d3",
      "subject": "ATTACK:enterprise:S9021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--66c646e5-2364-4d26-bd03-56e5544553d3",
      "modified": "2026-04-29T14:23:06.065Z",
      "references": [
        {
          "source_name": "Kaspersky LODEINFO OCT 2022",
          "url": "https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--67469b79-67e2-4932-9776-b09a82871723",
      "subject": "ATTACK:enterprise:G0049",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--67469b79-67e2-4932-9776-b09a82871723",
      "modified": "2026-07-31T20:48:35.551Z",
      "references": [
        {
          "source_name": "FireEye APT34 Dec 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
        },
        {
          "source_name": "OilRig New Delivery Oct 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"
        },
        {
          "source_name": "Unit 42 OopsIE! Feb 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"
        },
        {
          "source_name": "Crowdstrike GTR2020 Mar 2020",
          "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--677e51a3-11ba-4685-8374-f5a21677f37d",
      "subject": "ATTACK:enterprise:S1212",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--677e51a3-11ba-4685-8374-f5a21677f37d",
      "modified": "2026-04-29T14:23:06.066Z",
      "references": [
        {
          "source_name": "Group-IB RansomHub FEB 2025",
          "url": "https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--68166b59-ac4b-4bdc-928d-01e945611a5e",
      "subject": "ATTACK:enterprise:S9019",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--68166b59-ac4b-4bdc-928d-01e945611a5e",
      "modified": "2026-04-29T14:23:06.067Z",
      "references": [
        {
          "source_name": "Check Point Blind Eagle MAR 2025",
          "url": "https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"
        },
        {
          "source_name": "Zscaler PureCrypter JUN 2022",
          "url": "https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--68501e6a-dba6-4a77-a711-99ca6918a2dd",
      "subject": "ATTACK:enterprise:S1159",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--68501e6a-dba6-4a77-a711-99ca6918a2dd",
      "modified": "2026-04-29T14:23:06.067Z",
      "references": [
        {
          "source_name": "Google Cloud APT41 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--68896b85-a0ed-4b99-a776-dbdd3092ac07",
      "subject": "ATTACK:enterprise:S0634",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--68896b85-a0ed-4b99-a776-dbdd3092ac07",
      "modified": "2026-04-29T14:23:06.067Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--68cfc5f9-3c65-4f24-8018-cf811d7b6c9f",
      "subject": "ATTACK:enterprise:S0482",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--68cfc5f9-3c65-4f24-8018-cf811d7b6c9f",
      "modified": "2026-04-29T14:23:06.068Z",
      "references": [
        {
          "source_name": "MacKeeper Bundlore Apr 2019",
          "url": "https://mackeeper.com/blog/post/610-macos-bundlore-adware-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--69563781-6287-402d-926d-c671005ee240",
      "subject": "ATTACK:enterprise:S1222",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--69563781-6287-402d-926d-c671005ee240",
      "modified": "2026-04-29T14:23:06.068Z",
      "references": [
        {
          "source_name": "Google Cloud Mandiant UNC3886 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6b66277b-be7b-484b-86f4-fd97c7a4d4b7",
      "subject": "ATTACK:enterprise:S1221",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6b66277b-be7b-484b-86f4-fd97c7a4d4b7",
      "modified": "2026-04-29T14:23:06.071Z",
      "references": [
        {
          "source_name": "Google Cloud Mandiant UNC3886 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6cb89bfe-73f6-47d8-beb5-f8b2d66e0bfd",
      "subject": "ATTACK:enterprise:S0398",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6cb89bfe-73f6-47d8-beb5-f8b2d66e0bfd",
      "modified": "2026-04-29T14:23:06.073Z",
      "references": [
        {
          "source_name": "Trend Micro DRBControl February 2020",
          "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
        },
        {
          "source_name": "Trend Micro Iron Tiger April 2021",
          "url": "https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6d1074cb-a9eb-4237-b8b2-d823cfa1408b",
      "subject": "ATTACK:enterprise:S0024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6d1074cb-a9eb-4237-b8b2-d823cfa1408b",
      "modified": "2026-04-29T14:23:06.073Z",
      "references": [
        {
          "source_name": "Symantec Dyre June 2015",
          "url": "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/dyre-emerging-threat.pdf"
        },
        {
          "source_name": "Malwarebytes Dyreza November 2015",
          "url": "https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6e73108a-836f-47ad-b88a-6b9a70ebcb7b",
      "subject": "ATTACK:enterprise:S0579",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6e73108a-836f-47ad-b88a-6b9a70ebcb7b",
      "modified": "2026-04-29T14:23:06.075Z",
      "references": [
        {
          "source_name": "Trend Micro Waterbear December 2019",
          "url": "https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6ee02f06-6250-4c75-b20f-c3271442f59e",
      "subject": "ATTACK:enterprise:S0386",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6ee02f06-6250-4c75-b20f-c3271442f59e",
      "modified": "2026-04-29T14:23:06.076Z",
      "references": [
        {
          "source_name": "ProofPoint Ursnif Aug 2016",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6f64c3b9-7882-4bcf-9ff2-3dcce03cf632",
      "subject": "ATTACK:enterprise:S0401",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6f64c3b9-7882-4bcf-9ff2-3dcce03cf632",
      "modified": "2026-04-29T14:23:06.077Z",
      "references": [
        {
          "source_name": "ANSSI Sandworm January 2021",
          "url": "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--708ac02f-8419-43bd-a6d6-682e28faa507",
      "subject": "ATTACK:enterprise:S1150",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--708ac02f-8419-43bd-a6d6-682e28faa507",
      "modified": "2026-04-29T14:23:06.079Z",
      "references": [
        {
          "source_name": "CISA Iran Albanian Attacks September 2022",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a"
        },
        {
          "source_name": "Mandiant ROADSWEEP August 2022",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--70b94aa6-7cf1-4cf5-b00b-aed156036f1e",
      "subject": "ATTACK:enterprise:S0473",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--70b94aa6-7cf1-4cf5-b00b-aed156036f1e",
      "modified": "2026-04-29T14:23:06.079Z",
      "references": [
        {
          "source_name": "Trend Micro Tick November 2019",
          "url": "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--73622af3-6412-4fb9-b0ba-6a127c0db558",
      "subject": "ATTACK:enterprise:C0024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--73622af3-6412-4fb9-b0ba-6a127c0db558",
      "modified": "2026-07-31T18:47:26.695Z",
      "references": [
        {
          "source_name": "Symantec RAINDROP January 2021",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--737d4acc-c65c-45a3-ba69-6bf605dffa22",
      "subject": "ATTACK:enterprise:C0051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--737d4acc-c65c-45a3-ba69-6bf605dffa22",
      "modified": "2026-07-31T21:11:46.094Z",
      "references": [
        {
          "source_name": "Nearest Neighbor Volexity",
          "url": "https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--748cd538-d2a0-470c-b6fb-68e73b8069b1",
      "subject": "ATTACK:enterprise:S1053",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--748cd538-d2a0-470c-b6fb-68e73b8069b1",
      "modified": "2026-04-29T14:23:06.085Z",
      "references": [
        {
          "source_name": "Malwarebytes AvosLocker Jul 2021",
          "url": "https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--74e1dbd9-baad-488f-9b30-4430420e15d3",
      "subject": "ATTACK:enterprise:S0388",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--74e1dbd9-baad-488f-9b30-4430420e15d3",
      "modified": "2026-04-29T14:23:06.085Z",
      "references": [
        {
          "source_name": "TrendMicro TropicTrooper 2015",
          "url": "https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--74efbb05-7272-4cf4-9fa7-5720e8bfe26d",
      "subject": "ATTACK:enterprise:S1199",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--74efbb05-7272-4cf4-9fa7-5720e8bfe26d",
      "modified": "2026-04-29T14:23:06.085Z",
      "references": [
        {
          "source_name": "Palo Alto Lockbit 2.0 JUN 2022",
          "url": "https://unit42.paloaltonetworks.com/lockbit-2-ransomware/"
        },
        {
          "source_name": "FBI Lockbit 2.0 FEB 2022",
          "url": "https://www.ic3.gov/CSA/2022/220204.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--753b0a84-4455-4706-babf-f9bf75e530be",
      "subject": "ATTACK:enterprise:S1022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--753b0a84-4455-4706-babf-f9bf75e530be",
      "modified": "2026-04-29T14:23:06.085Z",
      "references": [
        {
          "source_name": "CrowdStrike IceApple May 2022",
          "url": "https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7562ef46-c452-4338-9e06-3afdcf2c0e04",
      "subject": "ATTACK:enterprise:S0470",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7562ef46-c452-4338-9e06-3afdcf2c0e04",
      "modified": "2026-04-29T14:23:06.086Z",
      "references": [
        {
          "source_name": "Trend Micro Tick November 2019",
          "url": "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--77b9e1c5-8241-4260-8125-4bc2e1206b9c",
      "subject": "ATTACK:enterprise:S0263",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--77b9e1c5-8241-4260-8125-4bc2e1206b9c",
      "modified": "2026-04-29T14:23:06.089Z",
      "references": [
        {
          "source_name": "US-CERT TYPEFRAME June 2018",
          "url": "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--78160020-3c63-4e60-81f4-f6438bfbd6a4",
      "subject": "ATTACK:enterprise:S1100",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--78160020-3c63-4e60-81f4-f6438bfbd6a4",
      "modified": "2026-04-29T14:23:06.089Z",
      "references": [
        {
          "source_name": "Kaspersky ToddyCat June 2022",
          "url": "https://securelist.com/toddycat/106799/"
        },
        {
          "source_name": "Kaspersky ToddyCat Check Logs October 2023",
          "url": "https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--799e9c4b-2f06-4917-8f91-aa1c7773f56b",
      "subject": "ATTACK:enterprise:S1244",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--799e9c4b-2f06-4917-8f91-aa1c7773f56b",
      "modified": "2026-04-29T14:23:06.092Z",
      "references": [
        {
          "source_name": "Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024",
          "url": "https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"
        },
        {
          "source_name": "Security Scorecard Medusa Ransomware January 2024",
          "url": "https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7aab5534-4c3b-4812-a612-eccee79396f6",
      "subject": "ATTACK:enterprise:S1210",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7aab5534-4c3b-4812-a612-eccee79396f6",
      "modified": "2026-04-29T14:23:06.093Z",
      "references": [
        {
          "source_name": "Cisco LotusBlossom 2025",
          "url": "https://blog.talosintelligence.com/lotus-blossom-espionage-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7ae8b9cf-2524-4861-8246-394a96339f49",
      "subject": "ATTACK:enterprise:S1143",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7ae8b9cf-2524-4861-8246-394a96339f49",
      "modified": "2026-04-29T14:23:06.094Z",
      "references": [
        {
          "source_name": "ESET Turla Lunar toolset May 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7b292c68-de29-4db0-8f07-67028da4a595",
      "subject": "ATTACK:enterprise:S9015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7b292c68-de29-4db0-8f07-67028da4a595",
      "modified": "2026-04-29T14:23:06.094Z",
      "references": [
        {
          "source_name": "CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025",
          "url": "https://www.crowdstrike.com/en-us/blog/warp-panda-cloud-threats/"
        },
        {
          "source_name": "CISA BRICKSTORM UNC5221 AR25-338A February 2026",
          "url": "https://www.cisa.gov/news-events/analysis-reports/ar25-338a"
        },
        {
          "source_name": "Picus Security BRICKSTORM UNC5221 October 2025",
          "url": "https://www.picussecurity.com/resource/blog/brickstorm-malware-unc5221-targets-tech-and-legal-sectors-in-the-united-states"
        },
        {
          "source_name": "Resecurity UNC5221 BRICKSTORM F5 Big-IP October 2025",
          "url": "https://www.resecurity.com/blog/article/f5-big-ip-source-code-leak-tied-to-state-linked-campaigns-using-brickstorm-backdoor"
        },
        {
          "source_name": "Google BRICKSTORM September 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7b695677-86d7-4de6-bce7-970ac2207d77",
      "subject": "ATTACK:enterprise:S9031",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7b695677-86d7-4de6-bce7-970ac2207d77",
      "modified": "2026-04-29T14:23:06.094Z",
      "references": [
        {
          "source_name": "Palo Alto Ashen Lepus DEC 2025",
          "url": "https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7bfbdba0-2f18-4697-bf86-294bda685df5",
      "subject": "ATTACK:enterprise:S1226",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7bfbdba0-2f18-4697-bf86-294bda685df5",
      "modified": "2026-04-29T14:23:06.095Z",
      "references": [
        {
          "source_name": "Unit42 Bookworm Nov2015",
          "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
        },
        {
          "source_name": "Palo Alto Networks, Unit 42",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7ce7aa48-afa9-4eb6-8bc2-8f04fd6cf00e",
      "subject": "ATTACK:enterprise:S0147",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7ce7aa48-afa9-4eb6-8bc2-8f04fd6cf00e",
      "modified": "2026-04-29T14:23:06.096Z",
      "references": [
        {
          "source_name": "Microsoft Actinium February 2022",
          "url": "https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7cf769d6-3d2d-44a8-a8d0-dbf1da1f98d4",
      "subject": "ATTACK:enterprise:S9035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7cf769d6-3d2d-44a8-a8d0-dbf1da1f98d4",
      "modified": "2026-04-29T14:23:06.096Z",
      "references": [
        {
          "source_name": "Splunk LAMEHUG SEP 2025",
          "url": "https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7d37a0f1-1aea-456c-ade6-6d463a14fc14",
      "subject": "ATTACK:enterprise:S1047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7d37a0f1-1aea-456c-ade6-6d463a14fc14",
      "modified": "2026-04-29T14:23:06.097Z",
      "references": [
        {
          "source_name": "DHS CISA AA22-055A MuddyWater February 2022",
          "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7d4609c1-6f92-44e4-8580-158bb2c91426",
      "subject": "ATTACK:enterprise:S1247",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7d4609c1-6f92-44e4-8580-158bb2c91426",
      "modified": "2026-04-29T14:23:06.097Z",
      "references": [
        {
          "source_name": "ESET Embargo Ransomware October 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/embargo-ransomware-rocknrust/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7e4db234-1923-4bfb-ab32-284f31182c76",
      "subject": "ATTACK:enterprise:S0367",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7e4db234-1923-4bfb-ab32-284f31182c76",
      "modified": "2026-04-29T14:23:06.098Z",
      "references": [
        {
          "source_name": "Binary Defense Emotes Wi-Fi Spreader",
          "url": "https://www.binarydefense.com/resources/blog/emotet-evolves-with-new-wi-fi-spreader/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7e941100-b4aa-43fa-a7c5-328fb211ecce",
      "subject": "ATTACK:enterprise:S0670",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7e941100-b4aa-43fa-a7c5-328fb211ecce",
      "modified": "2026-04-29T14:23:06.098Z",
      "references": [
        {
          "source_name": "Check Point Warzone Feb 2020",
          "url": "https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7ee1407c-ee33-47bc-824a-6f0dcd385462",
      "subject": "ATTACK:enterprise:S1063",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7ee1407c-ee33-47bc-824a-6f0dcd385462",
      "modified": "2026-04-29T14:23:06.099Z",
      "references": [
        {
          "source_name": "Palo Alto Brute Ratel July 2022",
          "url": "https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--817dc3ce-3e77-4e91-a9e4-9c8c8579e722",
      "subject": "ATTACK:enterprise:S0690",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--817dc3ce-3e77-4e91-a9e4-9c8c8579e722",
      "modified": "2026-04-29T14:23:06.102Z",
      "references": [
        {
          "source_name": "Objective See Green Lambert for OSX Oct 2021",
          "url": "https://objective-see.com/blog/blog_0x68.html"
        },
        {
          "source_name": "Glitch-Cat Green Lambert ATTCK Oct 2021",
          "url": "https://web.archive.org/web/20211018145402/https://www.glitch-cat.com/blog/green-lambert-and-attack"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8183d862-5383-4a42-acbd-be58e120cb25",
      "subject": "ATTACK:enterprise:S0279",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8183d862-5383-4a42-acbd-be58e120cb25",
      "modified": "2026-04-29T14:23:06.103Z",
      "references": [
        {
          "source_name": "objsee mac malware 2017",
          "url": "https://objective-see.com/blog/blog_0x25.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--81a70e7b-e4be-4856-9832-a893d4df2e1a",
      "subject": "ATTACK:enterprise:S1138",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--81a70e7b-e4be-4856-9832-a893d4df2e1a",
      "modified": "2026-04-29T14:23:06.103Z",
      "references": [
        {
          "source_name": "SentinelOne Gootloader June 2021",
          "url": "https://www.sentinelone.com/labs/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets/"
        },
        {
          "source_name": "Sophos Gootloader",
          "url": "https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--821c06ba-1cdc-40a7-bd4a-97e996bb973e",
      "subject": "ATTACK:enterprise:S1139",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--821c06ba-1cdc-40a7-bd4a-97e996bb973e",
      "modified": "2026-06-12T19:52:54.217Z",
      "references": [
        {
          "source_name": "Cybereason INC Ransomware November 2023",
          "url": "https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8265aa36-4e63-4ee9-8cfe-4ed82839efce",
      "subject": "ATTACK:enterprise:S0641",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8265aa36-4e63-4ee9-8cfe-4ed82839efce",
      "modified": "2026-04-29T14:23:06.104Z",
      "references": [
        {
          "source_name": "ESET Kobalos Jan 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--843aedaa-bbf0-4f29-bcfd-bd226ca7ef31",
      "subject": "ATTACK:enterprise:S0414",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--843aedaa-bbf0-4f29-bcfd-bd226ca7ef31",
      "modified": "2026-04-29T14:23:06.106Z",
      "references": [
        {
          "source_name": "CISA AA20-301A Kimsuky",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-301a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--848313af-f9c3-4b51-a24a-d2e88487ab53",
      "subject": "ATTACK:enterprise:S0335",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--848313af-f9c3-4b51-a24a-d2e88487ab53",
      "modified": "2026-04-29T14:23:06.106Z",
      "references": [
        {
          "source_name": "Accenture HyperStack October 2020",
          "url": "https://web.archive.org/web/20201101015247/https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity"
        },
        {
          "source_name": "ESET Carbon Mar 2017",
          "url": "https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8580c1e0-84fd-4da9-a9e8-1ae17f1b67d2",
      "subject": "ATTACK:enterprise:S0697",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8580c1e0-84fd-4da9-a9e8-1ae17f1b67d2",
      "modified": "2026-04-29T14:23:06.108Z",
      "references": [
        {
          "source_name": "Crowdstrike DriveSlayer February 2022",
          "url": "https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--85b0be36-c9fb-4359-b9b6-4e13300e374b",
      "subject": "ATTACK:enterprise:S0375",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--85b0be36-c9fb-4359-b9b6-4e13300e374b",
      "modified": "2026-04-29T14:23:06.108Z",
      "references": [
        {
          "source_name": "Securelist Remexi Jan 2019",
          "url": "https://securelist.com/chafer-used-remexi-malware/89538/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8631491d-bda8-4eee-93ec-5f3fc6340c3f",
      "subject": "ATTACK:enterprise:S0032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8631491d-bda8-4eee-93ec-5f3fc6340c3f",
      "modified": "2026-04-29T14:23:06.108Z",
      "references": [
        {
          "source_name": "Gh0stRAT ATT March 2019",
          "url": "https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--86bcc5c3-456e-4bac-a419-54f54af80325",
      "subject": "ATTACK:enterprise:G0047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--86bcc5c3-456e-4bac-a419-54f54af80325",
      "modified": "2026-07-31T18:47:47.811Z",
      "references": [
        {
          "source_name": "ESET Gamaredon June 2020",
          "url": "https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"
        },
        {
          "source_name": "TrendMicro Gamaredon April 2020",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"
        },
        {
          "source_name": "ESET Gamaredon Sept2024",
          "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"
        },
        {
          "source_name": "unit42_gamaredon_dec2022",
          "url": "https://unit42.paloaltonetworks.com/trident-ursa/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--883822b2-c788-4a60-b9ad-e73e363b1ea6",
      "subject": "ATTACK:enterprise:S1065",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--883822b2-c788-4a60-b9ad-e73e363b1ea6",
      "modified": "2026-04-29T14:23:06.111Z",
      "references": [
        {
          "source_name": "MalwareBytes WoodyRAT Aug 2022",
          "url": "https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--887d8582-e9a4-4058-a917-4dea8dc3ab8c",
      "subject": "ATTACK:enterprise:S9043",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--887d8582-e9a4-4058-a917-4dea8dc3ab8c",
      "modified": "2026-07-29T19:12:36.848Z",
      "references": [
        {
          "source_name": "Trend Micro TeamPCP MAY 2026",
          "url": "https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8a2fbf8a-a05c-44d7-a270-afe092de9db5",
      "subject": "ATTACK:enterprise:S0402",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8a2fbf8a-a05c-44d7-a270-afe092de9db5",
      "modified": "2026-04-29T14:23:06.114Z",
      "references": [
        {
          "source_name": "Carbon Black Shlayer Feb 2019",
          "url": "https://blogs.vmware.com/security/2020/02/vmware-carbon-black-tau-threat-analysis-shlayer-macos.html"
        },
        {
          "source_name": "sentinelone shlayer to zshlayer",
          "url": "https://www.sentinelone.com/blog/coming-out-of-your-shell-from-shlayer-to-zshlayer/"
        },
        {
          "source_name": "20 macOS Common Tools and Techniques",
          "url": "https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8a36b1bf-52a8-4e93-bac2-e28c60b7d64d",
      "subject": "ATTACK:enterprise:S1050",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8a36b1bf-52a8-4e93-bac2-e28c60b7d64d",
      "modified": "2026-04-29T14:23:06.114Z",
      "references": [
        {
          "source_name": "Bitdefender FunnyDream Campaign November 2020",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8a3a6312-e5fc-44bd-858c-886d0aa8b7c7",
      "subject": "ATTACK:enterprise:S1239",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8a3a6312-e5fc-44bd-858c-886d0aa8b7c7",
      "modified": "2026-04-29T14:23:06.114Z",
      "references": [
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "Trend Micro Mustang Panda Earth Preta Toneshell February 2025",
          "url": "https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"
        },
        {
          "source_name": "2022 November_TrendMicro_Earth Preta_Toneshell_Pubload",
          "url": "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
        },
        {
          "source_name": "Zscaler",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
        },
        {
          "source_name": "Unit42 Chinese VSCode 06 September 2024",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8bba06f3-fac2-4484-a177-53d5716f80a6",
      "subject": "ATTACK:enterprise:G0092",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8bba06f3-fac2-4484-a177-53d5716f80a6",
      "modified": "2026-07-31T18:48:05.668Z",
      "references": [
        {
          "source_name": "NCC Group TA505",
          "url": "https://research.nccgroup.com/2020/11/18/ta505-a-brief-history-of-their-time/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8bed4012-0b27-409b-8236-1b5238dd477d",
      "subject": "ATTACK:enterprise:S0492",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8bed4012-0b27-409b-8236-1b5238dd477d",
      "modified": "2026-04-29T14:23:06.116Z",
      "references": [
        {
          "source_name": "Unit42 CookieMiner Jan 2019",
          "url": "https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8cd609cc-a203-424e-bcea-264dd83f4d5a",
      "subject": "ATTACK:enterprise:S1219",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8cd609cc-a203-424e-bcea-264dd83f4d5a",
      "modified": "2026-04-29T14:23:06.117Z",
      "references": [
        {
          "source_name": "Google Cloud Mandiant UNC3886 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8e2b7383-c6dc-40c1-bb88-3176ff98c9dc",
      "subject": "ATTACK:enterprise:S0547",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8e2b7383-c6dc-40c1-bb88-3176ff98c9dc",
      "modified": "2026-04-29T14:23:06.119Z",
      "references": [
        {
          "source_name": "Cybereason Molerats Dec 2020",
          "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8ea64034-60a6-466d-9434-19d05180626c",
      "subject": "ATTACK:enterprise:S0511",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8ea64034-60a6-466d-9434-19d05180626c",
      "modified": "2026-04-29T14:23:06.119Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8fe32611-4206-4bef-9698-dbcefde08090",
      "subject": "ATTACK:enterprise:S0140",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8fe32611-4206-4bef-9698-dbcefde08090",
      "modified": "2026-04-29T14:23:06.121Z",
      "references": [
        {
          "source_name": "Unit 42 Shamoon3 2018",
          "url": "https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9021cef7-4b93-443c-a166-20a659fb6b56",
      "subject": "ATTACK:enterprise:S9050",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9021cef7-4b93-443c-a166-20a659fb6b56",
      "modified": "2026-09-11T19:42:55.102Z",
      "references": [
        {
          "source_name": "Cyfirma_Vidar_June2024",
          "url": "https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9191026d-2410-4e6d-98fe-26786a5b8bf1",
      "subject": "ATTACK:enterprise:G0027",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9191026d-2410-4e6d-98fe-26786a5b8bf1",
      "modified": "2026-07-31T18:48:29.336Z",
      "references": [
        {
          "source_name": "Securelist LuckyMouse June 2018",
          "url": "https://securelist.com/luckymouse-hits-national-data-center/86083/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--921c2a85-eab7-4cfc-9ac5-98a463262c17",
      "subject": "ATTACK:enterprise:G0007",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--921c2a85-eab7-4cfc-9ac5-98a463262c17",
      "modified": "2026-07-31T20:48:44.944Z",
      "references": [
        {
          "source_name": "Unit 42 Sofacy Feb 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"
        },
        {
          "source_name": "Palo Alto Sofacy 06-2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--92bab2d2-bb5a-4102-a9ec-7630153cac50",
      "subject": "ATTACK:enterprise:S1158",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--92bab2d2-bb5a-4102-a9ec-7630153cac50",
      "modified": "2026-04-29T14:23:06.125Z",
      "references": [
        {
          "source_name": "Google Cloud APT41 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--94f5837a-6e62-4402-ad2e-b7ef7f3c60d9",
      "subject": "ATTACK:enterprise:G0046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--94f5837a-6e62-4402-ad2e-b7ef7f3c60d9",
      "modified": "2026-07-31T20:48:32.051Z",
      "references": [
        {
          "source_name": "Gemini_FIN7_Jan2022",
          "url": "https://geminiadvisory.io/fin7-flash-drives-spread-remote-access-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--950d2e53-296a-491e-aadf-8cc5d04df41b",
      "subject": "ATTACK:enterprise:S1097",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--950d2e53-296a-491e-aadf-8cc5d04df41b",
      "modified": "2026-04-29T14:23:06.128Z",
      "references": [
        {
          "source_name": "SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022",
          "url": "https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--952412b3-a7b1-402c-a92e-96830df4d14b",
      "subject": "ATTACK:enterprise:S0468",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--952412b3-a7b1-402c-a92e-96830df4d14b",
      "modified": "2026-04-29T14:23:06.128Z",
      "references": [
        {
          "source_name": "Trend Micro Skidmap",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--959092cf-5647-4c25-b64e-3e84061511a5",
      "subject": "ATTACK:enterprise:S0240",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--959092cf-5647-4c25-b64e-3e84061511a5",
      "modified": "2026-04-29T14:23:06.129Z",
      "references": [
        {
          "source_name": "Volexity InkySquid RokRAT August 2021",
          "url": "https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"
        },
        {
          "source_name": "Malwarebytes RokRAT VBA January 2021",
          "url": "https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--95fc8b91-eda2-49e9-b2fb-b3cdfacc0eaa",
      "subject": "ATTACK:enterprise:S0623",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--95fc8b91-eda2-49e9-b2fb-b3cdfacc0eaa",
      "modified": "2026-04-29T14:23:06.129Z",
      "references": [
        {
          "source_name": "Unit 42 Siloscape Jun 2021",
          "url": "https://unit42.paloaltonetworks.com/siloscape/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--97323d60-9623-4b3e-8ff9-50370fef4e5b",
      "subject": "ATTACK:enterprise:S0443",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--97323d60-9623-4b3e-8ff9-50370fef4e5b",
      "modified": "2026-04-29T14:23:06.131Z",
      "references": [
        {
          "source_name": "FireEye MESSAGETAP October 2019",
          "url": "https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-is-reading-your-text-messages.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--980a5f66-14d7-42c6-82f7-ef96cbab77bb",
      "subject": "ATTACK:enterprise:S0444",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--980a5f66-14d7-42c6-82f7-ef96cbab77bb",
      "modified": "2026-04-29T14:23:06.132Z",
      "references": [
        {
          "source_name": "FOX-IT May 2016 Mofang",
          "url": "https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--994846d3-7130-4374-bd6e-278ad870fa94",
      "subject": "ATTACK:enterprise:S0502",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--994846d3-7130-4374-bd6e-278ad870fa94",
      "modified": "2026-04-29T14:23:06.134Z",
      "references": [
        {
          "source_name": "NSA/FBI Drovorub August 2020",
          "url": "https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--99e6e6cb-c19e-4689-8c92-b5429c709b91",
      "subject": "ATTACK:enterprise:S0588",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--99e6e6cb-c19e-4689-8c92-b5429c709b91",
      "modified": "2026-04-29T14:23:06.135Z",
      "references": [
        {
          "source_name": "MSTIC NOBELIUM Mar 2021",
          "url": "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"
        },
        {
          "source_name": "FireEye SUNSHUTTLE Mar 2021",
          "url": "https://www.fireeye.com/blog/threat-research/2021/03/sunshuttle-second-stage-backdoor-targeting-us-based-entity.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9a36085f-d0a9-41f2-a9cf-97e81c286ef2",
      "subject": "ATTACK:enterprise:S0576",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9a36085f-d0a9-41f2-a9cf-97e81c286ef2",
      "modified": "2026-04-29T14:23:06.135Z",
      "references": [
        {
          "source_name": "IBM MegaCortex",
          "url": "https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9a74aca4-4a5e-4a12-bd98-6a4d2df1b1a1",
      "subject": "ATTACK:enterprise:G0139",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9a74aca4-4a5e-4a12-bd98-6a4d2df1b1a1",
      "modified": "2026-07-31T18:47:49.792Z",
      "references": [
        {
          "source_name": "Cisco Talos Intelligence Group",
          "url": "https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9ac9c832-68cb-48ce-85eb-f0b8334fe48d",
      "subject": "ATTACK:enterprise:G1035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9ac9c832-68cb-48ce-85eb-f0b8334fe48d",
      "modified": "2026-07-31T18:48:03.147Z",
      "references": [
        {
          "source_name": "ESET WinterVivern 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9b8ff6e6-8b67-4182-9752-fa1cf15c0485",
      "subject": "ATTACK:enterprise:S0681",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9b8ff6e6-8b67-4182-9752-fa1cf15c0485",
      "modified": "2026-04-29T14:23:06.137Z",
      "references": [
        {
          "source_name": "BiZone Lizar May 2021",
          "url": "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"
        },
        {
          "source_name": "SekoiaBourhis_DiceLoader_Feb2024",
          "url": "https://blog.sekoia.io/unveiling-the-intricacies-of-diceloader/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9d293200-1425-4a77-8a2e-75a1ffb78310",
      "subject": "ATTACK:enterprise:S0647",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9d293200-1425-4a77-8a2e-75a1ffb78310",
      "modified": "2026-04-29T14:23:06.139Z",
      "references": [
        {
          "source_name": "ESET BackdoorDiplomacy Jun 2021",
          "url": "https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9dcec42b-174d-4b74-8aab-c5727a71c25c",
      "subject": "ATTACK:enterprise:S0610",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9dcec42b-174d-4b74-8aab-c5727a71c25c",
      "modified": "2026-04-29T14:23:06.140Z",
      "references": [
        {
          "source_name": "Check Point APT34 April 2021",
          "url": "https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a0ff37b8-1a73-45dd-a645-fe2a43fad9f6",
      "subject": "ATTACK:enterprise:S0496",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a0ff37b8-1a73-45dd-a645-fe2a43fad9f6",
      "modified": "2026-04-29T14:23:06.144Z",
      "references": [
        {
          "source_name": "G Data Sodinokibi June 2019",
          "url": "https://www.gdatasoftware.com/blog/2019/06/31724-strange-bits-sodinokibi-spam-cinarat-and-fake-g-data"
        },
        {
          "source_name": "Kaspersky Sodin July 2019",
          "url": "https://securelist.com/sodin-ransomware/91473/"
        },
        {
          "source_name": "Cylance Sodinokibi July 2019",
          "url": "https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"
        },
        {
          "source_name": "McAfee Sodinokibi October 2019",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"
        },
        {
          "source_name": "Intel 471 REvil March 2020",
          "url": "https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"
        },
        {
          "source_name": "Secureworks REvil September 2019",
          "url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a1e3d08f-cec9-48df-b377-6f0d0d223e3b",
      "subject": "ATTACK:enterprise:S1240",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a1e3d08f-cec9-48df-b377-6f0d0d223e3b",
      "modified": "2026-04-29T14:23:06.145Z",
      "references": [
        {
          "source_name": "Splunk RedLine Stealer June 2023",
          "url": "https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a2644706-c75e-47b9-8167-f9db9481262e",
      "subject": "ATTACK:enterprise:S1223",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a2644706-c75e-47b9-8167-f9db9481262e",
      "modified": "2026-04-29T14:23:06.146Z",
      "references": [
        {
          "source_name": "Mandiant Fortinet Zero Day",
          "url": "https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a4105315-b63d-47c9-9526-3dd388d892b4",
      "subject": "ATTACK:enterprise:S0331",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a4105315-b63d-47c9-9526-3dd388d892b4",
      "modified": "2026-04-29T14:23:06.148Z",
      "references": [
        {
          "source_name": "Malwarebytes Agent Tesla April 2020",
          "url": "https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a412040d-d8ed-48b4-979c-7cbc6f9ced1c",
      "subject": "ATTACK:enterprise:S1016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a412040d-d8ed-48b4-979c-7cbc6f9ced1c",
      "modified": "2026-04-29T14:23:06.148Z",
      "references": [
        {
          "source_name": "ESET DazzleSpy Jan 2022",
          "url": "https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a4cc226c-2858-4040-a90d-5cf1297fd78c",
      "subject": "ATTACK:enterprise:S1052",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a4cc226c-2858-4040-a90d-5cf1297fd78c",
      "modified": "2026-04-29T14:23:06.149Z",
      "references": [
        {
          "source_name": "Mandiant APT41",
          "url": "https://www.mandiant.com/resources/apt41-us-state-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a511a41e-0ab0-4088-8617-5de975b5d9a8",
      "subject": "ATTACK:enterprise:S0515",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a511a41e-0ab0-4088-8617-5de975b5d9a8",
      "modified": "2026-04-29T14:23:06.150Z",
      "references": [
        {
          "source_name": "CISA WellMail July 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198c"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a575b110-f622-4813-9fa7-bef6287bcb7b",
      "subject": "ATTACK:enterprise:C0021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a575b110-f622-4813-9fa7-bef6287bcb7b",
      "modified": "2026-07-31T18:47:24.534Z",
      "references": [
        {
          "source_name": "FireEye APT29 Nov 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html"
        },
        {
          "source_name": "Microsoft Unidentified Dec 2018",
          "url": "https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a6944696-304c-4813-8285-56275e926f9f",
      "subject": "ATTACK:enterprise:S0369",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a6944696-304c-4813-8285-56275e926f9f",
      "modified": "2026-04-29T14:23:06.152Z",
      "references": [
        {
          "source_name": "CoinTicker 2019",
          "url": "https://blog.malwarebytes.com/threat-analysis/2018/10/mac-cryptocurrency-ticker-app-installs-backdoors/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a6bb9c7f-3e1c-429a-a81d-0d446f4abe9a",
      "subject": "ATTACK:enterprise:S0673",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a6bb9c7f-3e1c-429a-a81d-0d446f4abe9a",
      "modified": "2026-04-29T14:23:06.152Z",
      "references": [
        {
          "source_name": "Prevailion DarkWatchman 2021",
          "url": "https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a6bf495a-9769-433b-8754-e57f5e9045b7",
      "subject": "ATTACK:enterprise:S0546",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a6bf495a-9769-433b-8754-e57f5e9045b7",
      "modified": "2026-04-29T14:23:06.152Z",
      "references": [
        {
          "source_name": "BleepingComputer Molerats Dec 2020",
          "url": "https://www.bleepingcomputer.com/news/security/hacking-group-s-new-malware-abuses-google-and-facebook-services/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a6ddb76d-4317-4cfd-9e1d-57d8a0c5fb21",
      "subject": "ATTACK:enterprise:G0045",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a6ddb76d-4317-4cfd-9e1d-57d8a0c5fb21",
      "modified": "2026-07-31T18:47:44.310Z",
      "references": [
        {
          "source_name": "Accenture Hogfish April 2018",
          "url": "http://web.archive.org/web/20220810112638/https:/www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
        },
        {
          "source_name": "FireEye APT10 Sept 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a7f61ae3-bbeb-40c8-86c9-bed3cf1e1953",
      "subject": "ATTACK:enterprise:S1111",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a7f61ae3-bbeb-40c8-86c9-bed3cf1e1953",
      "modified": "2026-04-29T14:23:06.154Z",
      "references": [
        {
          "source_name": "Ensilo Darkgate 2018",
          "url": "https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"
        },
        {
          "source_name": "Trellix Darkgate 2023",
          "url": "https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a8bf6c5d-6201-4d5e-883f-4818d721e247",
      "subject": "ATTACK:enterprise:S9032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a8bf6c5d-6201-4d5e-883f-4818d721e247",
      "modified": "2026-04-29T14:23:06.155Z",
      "references": [
        {
          "source_name": "ESET_MuddyWater_Dec2025",
          "url": "https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a91a486b-4119-44e1-9fcf-c746849947e8",
      "subject": "ATTACK:enterprise:S1134",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a91a486b-4119-44e1-9fcf-c746849947e8",
      "modified": "2026-04-29T14:23:06.155Z",
      "references": [
        {
          "source_name": "SentinelOne Agrius 2021",
          "url": "https://assets.sentinelone.com/sentinellabs/evol-agrius"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--aafa7447-cb73-4309-ac75-5326ab0d1079",
      "subject": "ATTACK:enterprise:S0589",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--aafa7447-cb73-4309-ac75-5326ab0d1079",
      "modified": "2026-04-29T14:23:06.158Z",
      "references": [
        {
          "source_name": "MSTIC NOBELIUM Mar 2021",
          "url": "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ab5fd28f-c304-46a2-a07d-c037dc67ba2c",
      "subject": "ATTACK:enterprise:S1232",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ab5fd28f-c304-46a2-a07d-c037dc67ba2c",
      "modified": "2026-04-29T14:23:06.158Z",
      "references": [
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--abeb8fca-e470-4119-a07f-a6ec2f4b4667",
      "subject": "ATTACK:enterprise:S0637",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--abeb8fca-e470-4119-a07f-a6ec2f4b4667",
      "modified": "2026-04-29T14:23:06.159Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--abece522-51dc-4904-b0f9-585db7fb0223",
      "subject": "ATTACK:enterprise:S0517",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--abece522-51dc-4904-b0f9-585db7fb0223",
      "modified": "2026-04-29T14:23:06.159Z",
      "references": [
        {
          "source_name": "Trustwave Pillowmint June 2020",
          "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ac47da26-22ae-43b9-947b-ed4ea6943d42",
      "subject": "ATTACK:enterprise:G0032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ac47da26-22ae-43b9-947b-ed4ea6943d42",
      "modified": "2026-07-31T20:48:47.045Z",
      "references": [
        {
          "source_name": "Qualys LolZarus",
          "url": "https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"
        },
        {
          "source_name": "Lazarus APT January 2022",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ac5693ea-3d10-47bd-b91b-a65177dd5462",
      "subject": "ATTACK:enterprise:S0601",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ac5693ea-3d10-47bd-b91b-a65177dd5462",
      "modified": "2026-04-29T14:23:06.159Z",
      "references": [
        {
          "source_name": "Unit 42 Hildegard Malware",
          "url": "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--acedb80d-7646-4c2f-a4e2-3623410823e9",
      "subject": "ATTACK:enterprise:S9007",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--acedb80d-7646-4c2f-a4e2-3623410823e9",
      "modified": "2026-04-29T14:23:06.160Z",
      "references": [
        {
          "source_name": "Gen Digital Kimsuky HTTPTroy October 2025",
          "url": "https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ad472921-19b8-43ac-9b22-1ebb4f353b66",
      "subject": "ATTACK:enterprise:S9029",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ad472921-19b8-43ac-9b22-1ebb4f353b66",
      "modified": "2026-04-29T14:23:06.161Z",
      "references": [
        {
          "source_name": "Check Point Wirte NOV 2024",
          "url": "https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ad8fdfa4-5e0b-437d-9723-9bc5a272f465",
      "subject": "ATTACK:enterprise:S0126",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ad8fdfa4-5e0b-437d-9723-9bc5a272f465",
      "modified": "2026-04-29T14:23:06.161Z",
      "references": [
        {
          "source_name": "ESET ComRAT May 2020",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"
        },
        {
          "source_name": "CISA ComRAT Oct 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ade847d9-4ce6-4b63-accb-7070c926e5b5",
      "subject": "ATTACK:enterprise:S0531",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ade847d9-4ce6-4b63-accb-7070c926e5b5",
      "modified": "2026-04-29T14:23:06.162Z",
      "references": [
        {
          "source_name": "ESET Grandoreiro April 2020",
          "url": "https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ae788f2a-e2d8-4615-8714-f1263c987b23",
      "subject": "ATTACK:enterprise:S0660",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ae788f2a-e2d8-4615-8714-f1263c987b23",
      "modified": "2026-04-29T14:23:06.163Z",
      "references": [
        {
          "source_name": "Trend Micro DRBControl February 2020",
          "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
        },
        {
          "source_name": "Talent-Jump Clambling February 2020",
          "url": "https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--af7c56df-ced8-45b7-9aef-be1039e30cea",
      "subject": "ATTACK:enterprise:S0266",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--af7c56df-ced8-45b7-9aef-be1039e30cea",
      "modified": "2026-04-29T14:23:06.164Z",
      "references": [
        {
          "source_name": "Fidelis TrickBot Oct 2016",
          "url": "https://www.fidelissecurity.com/threatgeek/2016/10/trickbot-we-missed-you-dyre"
        },
        {
          "source_name": "Cyberreason Anchor December 2019",
          "url": "https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"
        },
        {
          "source_name": "Joe Sec Trickbot",
          "url": "https://www.joesecurity.org/blog/498839998833561473"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--afd2f545-557a-4113-bc0a-3191e71bcbea",
      "subject": "ATTACK:enterprise:S0618",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--afd2f545-557a-4113-bc0a-3191e71bcbea",
      "modified": "2026-04-29T14:23:06.165Z",
      "references": [
        {
          "source_name": "FireEye FiveHands April 2021",
          "url": "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
        },
        {
          "source_name": "CISA AR21-126A FIVEHANDS May 2021",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"
        },
        {
          "source_name": "NCC Group Fivehands June 2021",
          "url": "https://research.nccgroup.com/2021/06/15/handy-guide-to-a-new-fivehands-ransomware-variant/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--aff5ce36-4e3e-475e-b039-3424d5296521",
      "subject": "ATTACK:enterprise:S1190",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--aff5ce36-4e3e-475e-b039-3424d5296521",
      "modified": "2026-04-29T14:23:06.165Z",
      "references": [
        {
          "source_name": "WithSecure Kapeka 2024",
          "url": "https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Research-Kapeka.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b105573a-4d07-4253-8a5b-82f68357e098",
      "subject": "ATTACK:enterprise:S1018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b105573a-4d07-4253-8a5b-82f68357e098",
      "modified": "2026-04-29T14:23:06.167Z",
      "references": [
        {
          "source_name": "Malwarebytes Saint Bot April 2021",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b1065110-5387-4dee-b27e-f671d75f403f",
      "subject": "ATTACK:enterprise:S0154",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b1065110-5387-4dee-b27e-f671d75f403f",
      "modified": "2026-04-29T14:23:06.167Z",
      "references": [
        {
          "source_name": "Talos Cobalt Strike September 2020",
          "url": "https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"
        },
        {
          "source_name": "Cobalt Strike Manual 4.3 November 2020",
          "url": "https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"
        },
        {
          "source_name": "Cisco Talos Qilin Ransomware OCT 2025",
          "url": "https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b10f18a6-43a8-436f-8d9c-f180428f0a0d",
      "subject": "ATTACK:enterprise:S1019",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b10f18a6-43a8-436f-8d9c-f180428f0a0d",
      "modified": "2026-04-29T14:23:06.167Z",
      "references": [
        {
          "source_name": "ClearSky Siamesekitten August 2021",
          "url": "https://www.clearskysec.com/siamesekitten/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b16b1e0e-63b0-4c5b-8809-476d9645948c",
      "subject": "ATTACK:enterprise:S0581",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b16b1e0e-63b0-4c5b-8809-476d9645948c",
      "modified": "2026-04-29T14:23:06.167Z",
      "references": [
        {
          "source_name": "Unit 42 IronNetInjector February 2021 ",
          "url": "https://unit42.paloaltonetworks.com/ironnetinjector/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b1a30826-465a-4342-8ceb-e0bd4ef50063",
      "subject": "ATTACK:enterprise:S0543",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b1a30826-465a-4342-8ceb-e0bd4ef50063",
      "modified": "2026-04-29T14:23:06.168Z",
      "references": [
        {
          "source_name": "Unit42 Molerat Mar 2020",
          "url": "https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b2d68c37-be6c-49e4-917a-3a8e22a97e54",
      "subject": "ATTACK:enterprise:G1043",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b2d68c37-be6c-49e4-917a-3a8e22a97e54",
      "modified": "2026-07-31T18:47:36.414Z",
      "references": [
        {
          "source_name": "Picus BlackByte 2022",
          "url": "https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"
        },
        {
          "source_name": "FBI BlackByte 2022",
          "url": "https://www.ic3.gov/CSA/2022/220211.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b3f66735-fafe-49be-b55c-4d087d1351a7",
      "subject": "ATTACK:enterprise:S0439",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b3f66735-fafe-49be-b55c-4d087d1351a7",
      "modified": "2026-04-29T14:23:06.171Z",
      "references": [
        {
          "source_name": "ESET Okrum July 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b4016d43-d8c4-4ca2-b119-0681ebe8aaff",
      "subject": "ATTACK:enterprise:S0466",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b4016d43-d8c4-4ca2-b119-0681ebe8aaff",
      "modified": "2026-04-29T14:23:06.171Z",
      "references": [
        {
          "source_name": "objective-see windtail1 dec 2018",
          "url": "https://objective-see.com/blog/blog_0x3B.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b4f15c4f-eedd-4045-bdec-57393716fa50",
      "subject": "ATTACK:enterprise:S1207",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b4f15c4f-eedd-4045-bdec-57393716fa50",
      "modified": "2026-04-29T14:23:06.172Z",
      "references": [
        {
          "source_name": "Google XLoader 2017",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/formbook-malware-distribution-campaigns/"
        },
        {
          "source_name": "Zscaler XLoader 2025",
          "url": "https://www.zscaler.com/blogs/security-research/technical-analysis-xloader-versions-6-and-7-part-1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b6a89ded-fa53-42b9-8f40-03c845123ac0",
      "subject": "ATTACK:enterprise:S0260",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b6a89ded-fa53-42b9-8f40-03c845123ac0",
      "modified": "2026-04-29T14:23:06.174Z",
      "references": [
        {
          "source_name": "ESET InvisiMole June 2018",
          "url": "https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"
        },
        {
          "source_name": "ESET InvisiMole June 2020",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b6df63b7-34af-4918-8d1d-cf3dad0287f8",
      "subject": "ATTACK:enterprise:S0394",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b6df63b7-34af-4918-8d1d-cf3dad0287f8",
      "modified": "2026-04-29T14:23:06.175Z",
      "references": [
        {
          "source_name": "Intezer HiddenWasp Map 2019",
          "url": "https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b71e10b8-e566-470b-8a5c-b634ddfd3965",
      "subject": "ATTACK:enterprise:S0665",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b71e10b8-e566-470b-8a5c-b634ddfd3965",
      "modified": "2026-04-29T14:23:06.175Z",
      "references": [
        {
          "source_name": "Kaspersky ThreatNeedle Feb 2021",
          "url": "https://securelist.com/lazarus-threatneedle/100803/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b7f13afc-0e1c-4142-b05c-def10c17a8d6",
      "subject": "ATTACK:enterprise:S0390",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b7f13afc-0e1c-4142-b05c-def10c17a8d6",
      "modified": "2026-04-29T14:23:06.176Z",
      "references": [
        {
          "source_name": "Flashpoint FIN 7 March 2019",
          "url": "https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b8333924-1556-4c3f-b60f-105984e1f715",
      "subject": "ATTACK:enterprise:S0562",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b8333924-1556-4c3f-b60f-105984e1f715",
      "modified": "2026-04-29T14:23:06.177Z",
      "references": [
        {
          "source_name": "CrowdStrike SUNSPOT Implant January 2021",
          "url": "https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b99e218f-942b-4643-b4de-35649d2a4cbd",
      "subject": "ATTACK:enterprise:S0476",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b99e218f-942b-4643-b4de-35649d2a4cbd",
      "modified": "2026-04-29T14:23:06.178Z",
      "references": [
        {
          "source_name": "Cybereason Valak May 2020",
          "url": "https://www.cybereason.com/blog/valak-more-than-meets-the-eye"
        },
        {
          "source_name": "Unit 42 Valak July 2020",
          "url": "https://unit42.paloaltonetworks.com/valak-evolution/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bb870870-2dfb-4ff3-9e17-6a75476d9be4",
      "subject": "ATTACK:enterprise:G0065",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bb870870-2dfb-4ff3-9e17-6a75476d9be4",
      "modified": "2026-07-31T20:48:38.368Z",
      "references": [
        {
          "source_name": "Proofpoint Leviathan Oct 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bccf4511-1e01-42ed-ab75-65d558e3fa3f",
      "subject": "ATTACK:enterprise:S0560",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bccf4511-1e01-42ed-ab75-65d558e3fa3f",
      "modified": "2026-04-29T14:23:06.183Z",
      "references": [
        {
          "source_name": "FireEye SUNBURST Backdoor December 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
        },
        {
          "source_name": "Check Point Sunburst Teardrop December 2020",
          "url": "https://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal/"
        },
        {
          "source_name": "Microsoft Deep Dive Solorigate January 2021",
          "url": "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bd33f6b4-ff04-49d9-81ea-275a86222a97",
      "subject": "ATTACK:enterprise:C0056",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bd33f6b4-ff04-49d9-81ea-275a86222a97",
      "modified": "2026-07-31T18:47:20.263Z",
      "references": [
        {
          "source_name": "Juniper RedPenguin MAR 2025",
          "url": "https://supportportal.juniper.net/sfc/servlet.shepherd/document/download/069Dp00000FzdmIIAR?operationContext=S1"
        },
        {
          "source_name": "Mandiant UNC3886 Juniper Routers MAR 2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bdd9a384-2d57-4238-bddd-5500e667d620",
      "subject": "ATTACK:enterprise:S0196",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bdd9a384-2d57-4238-bddd-5500e667d620",
      "modified": "2026-04-29T14:23:06.185Z",
      "references": [
        {
          "source_name": "Morphisec ShellTea June 2019",
          "url": "http://blog.morphisec.com/security-alert-fin8-is-back"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--be07fb4e-06db-4bb0-a1e0-23f34b24a97f",
      "subject": "ATTACK:enterprise:S0353",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--be07fb4e-06db-4bb0-a1e0-23f34b24a97f",
      "modified": "2026-04-29T14:23:06.185Z",
      "references": [
        {
          "source_name": "Unit 42 NOKKI Sept 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--beee667c-c63d-48c9-86c1-54a50081199d",
      "subject": "ATTACK:enterprise:G1021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--beee667c-c63d-48c9-86c1-54a50081199d",
      "modified": "2026-07-31T18:48:07.937Z",
      "references": [
        {
          "source_name": "Sygnia Emperor Dragonfly October 2022",
          "url": "https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bf46855b-a15e-4789-a8e6-d5ad3261ded3",
      "subject": "ATTACK:enterprise:S1145",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bf46855b-a15e-4789-a8e6-d5ad3261ded3",
      "modified": "2026-04-29T14:23:06.187Z",
      "references": [
        {
          "source_name": "Zscaler Pikabot 2023",
          "url": "https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot"
        },
        {
          "source_name": "Elastic Pikabot 2024",
          "url": "https://www.elastic.co/security-labs/pikabot-i-choose-you"
        },
        {
          "source_name": "Logpoint Pikabot 2024",
          "url": "https://www.logpoint.com/wp-content/uploads/2024/02/logpoint-etpr-pikabot.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bf984c42-b059-4e2e-af65-d316569bd426",
      "subject": "ATTACK:enterprise:S1182",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bf984c42-b059-4e2e-af65-d316569bd426",
      "modified": "2026-04-29T14:23:06.187Z",
      "references": [
        {
          "source_name": "Cisco MagicRAT 2022",
          "url": "https://blog.talosintelligence.com/lazarus-magicrat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bf9adcbf-3d35-4d70-b681-e7180f3c08da",
      "subject": "ATTACK:enterprise:S0613",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bf9adcbf-3d35-4d70-b681-e7180f3c08da",
      "modified": "2026-04-29T14:23:06.187Z",
      "references": [
        {
          "source_name": "BlackBerry CostaRicto November 2020",
          "url": "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bfe474ce-d88f-4372-9918-a04470ba080e",
      "subject": "ATTACK:enterprise:S0348",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bfe474ce-d88f-4372-9918-a04470ba080e",
      "modified": "2026-04-29T14:23:06.188Z",
      "references": [
        {
          "source_name": "PaloAlto CardinalRat Apr 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c0b37fb2-6a19-40cf-bb18-a7289e235398",
      "subject": "ATTACK:enterprise:S1249",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c0b37fb2-6a19-40cf-bb18-a7289e235398",
      "modified": "2026-04-29T14:23:06.189Z",
      "references": [
        {
          "source_name": "Socket Contagious Interview NPM April 2025",
          "url": "https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"
        },
        {
          "source_name": "Socket BeaverTail XORIndex HexEval Contagious Interview July 2025",
          "url": "https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"
        },
        {
          "source_name": "Socket HexEval BeaverTail Contagious Interview June 2025",
          "url": "https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c2e3c3ad-669a-4c20-8fd8-04626433a03c",
      "subject": "ATTACK:enterprise:S9037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c2e3c3ad-669a-4c20-8fd8-04626433a03c",
      "modified": "2026-04-29T14:23:06.192Z",
      "references": [
        {
          "source_name": "CloudSEK_RustyWater_Jan2026",
          "url": "https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c66a8b99-9928-4b4c-83e8-e416de4d07b3",
      "subject": "ATTACK:enterprise:S1173",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c66a8b99-9928-4b4c-83e8-e416de4d07b3",
      "modified": "2026-04-29T14:23:06.197Z",
      "references": [
        {
          "source_name": "Symantec Crambus OCT 2023",
          "url": "https://www.security.com/threat-intelligence/crambus-middle-east-government"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c89f4447-e8dc-4b6f-aa52-fade3ced3268",
      "subject": "ATTACK:enterprise:S0689",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c89f4447-e8dc-4b6f-aa52-fade3ced3268",
      "modified": "2026-04-29T14:23:06.199Z",
      "references": [
        {
          "source_name": "Cisco Ukraine Wipers January 2022",
          "url": "https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html"
        },
        {
          "source_name": "Medium S2W WhisperGate January 2022",
          "url": "https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c8fdab57-1e10-4f66-a1de-59a876c99ab1",
      "subject": "ATTACK:enterprise:G0106",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c8fdab57-1e10-4f66-a1de-59a876c99ab1",
      "modified": "2026-07-31T18:47:52.626Z",
      "references": [
        {
          "source_name": "Talos Rocke August 2018",
          "url": "https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c9256d21-a464-477a-8756-96eae300b0e4",
      "subject": "ATTACK:enterprise:S0632",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c9256d21-a464-477a-8756-96eae300b0e4",
      "modified": "2026-04-29T14:23:06.200Z",
      "references": [
        {
          "source_name": "Group IB GrimAgent July 2021",
          "url": "https://www.group-ib.com/blog/grimagent/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c9261a0d-98f4-4781-8e57-d21d393a01b8",
      "subject": "ATTACK:enterprise:C0037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c9261a0d-98f4-4781-8e57-d21d393a01b8",
      "modified": "2026-07-31T18:47:23.510Z",
      "references": [
        {
          "source_name": "TrendMicro Pikabot 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/a/a-look-into-pikabot-spam-wave-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c935af5a-b6e3-41b8-afa8-f9d7ad593201",
      "subject": "ATTACK:enterprise:S1046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c935af5a-b6e3-41b8-afa8-f9d7ad593201",
      "modified": "2026-04-29T14:23:06.200Z",
      "references": [
        {
          "source_name": "CYBERCOM Iranian Intel Cyber January 2022",
          "url": "https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/"
        },
        {
          "source_name": "DHS CISA AA22-055A MuddyWater February 2022",
          "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c948844f-25f3-4fbd-b949-f6c61a459aeb",
      "subject": "ATTACK:enterprise:S1183",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c948844f-25f3-4fbd-b949-f6c61a459aeb",
      "modified": "2026-04-29T14:23:06.200Z",
      "references": [
        {
          "source_name": "PaloAlto StrelaStealer 2024",
          "url": "https://unit42.paloaltonetworks.com/strelastealer-campaign/"
        },
        {
          "source_name": "DCSO StrelaStealer 2022",
          "url": "https://medium.com/@DCSO_CyTec/shortandmalicious-strelastealer-aims-for-mail-credentials-a4c3e78c8abc"
        },
        {
          "source_name": "Fortgale StrelaStealer 2023",
          "url": "https://fortgale.com/blog/malware-analysis/strelastealer-malware-analysis-2/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c958d98c-d3d9-40cf-9702-5d9cb2cdf719",
      "subject": "ATTACK:enterprise:S0514",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c958d98c-d3d9-40cf-9702-5d9cb2cdf719",
      "modified": "2026-04-29T14:23:06.201Z",
      "references": [
        {
          "source_name": "PWC WellMess July 2020",
          "url": "https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"
        },
        {
          "source_name": "PWC WellMess C2 August 2020",
          "url": "https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmess-analysis-command-control.html"
        },
        {
          "source_name": "CISA WellMess July 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c9759e33-1cdd-472a-b3fc-f3263f218fdb",
      "subject": "ATTACK:enterprise:S0628",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c9759e33-1cdd-472a-b3fc-f3263f218fdb",
      "modified": "2026-04-29T14:23:06.201Z",
      "references": [
        {
          "source_name": "Securelist APT10 March 2021",
          "url": "https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c9a2ee9a-4787-47c0-9cdc-f52735f066ad",
      "subject": "ATTACK:enterprise:S1130",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c9a2ee9a-4787-47c0-9cdc-f52735f066ad",
      "modified": "2026-04-29T14:23:06.201Z",
      "references": [
        {
          "source_name": "TrendMicro RaspberryRobin 2022",
          "url": "https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c9aa1bb6-874a-4de6-84c8-e1e9d1d112d0",
      "subject": "ATTACK:enterprise:S0477",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c9aa1bb6-874a-4de6-84c8-e1e9d1d112d0",
      "modified": "2026-04-29T14:23:06.201Z",
      "references": [
        {
          "source_name": "Cybereason Cobalt Kitty 2017",
          "url": "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c9ebddf7-337f-4002-84fd-84a7744b78e1",
      "subject": "ATTACK:enterprise:S0612",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c9ebddf7-337f-4002-84fd-84a7744b78e1",
      "modified": "2026-04-29T14:23:06.201Z",
      "references": [
        {
          "source_name": "NCC Group WastedLocker June 2020",
          "url": "https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cb67b57d-2ab3-4971-9b8d-83768df36df0",
      "subject": "ATTACK:enterprise:S0013",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cb67b57d-2ab3-4971-9b8d-83768df36df0",
      "modified": "2026-04-29T14:23:06.203Z",
      "references": [
        {
          "source_name": "Eset PlugX Korplug Mustang Panda March 2022",
          "url": "https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"
        },
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "CIRCL PlugX March 2013",
          "url": "http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"
        },
        {
          "source_name": "EclecticIQ Mustang Panda PlugX",
          "url": "https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"
        },
        {
          "source_name": "Trend Micro DRBControl February 2020",
          "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
        },
        {
          "source_name": "Proofpoint TA416 Europe March 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"
        },
        {
          "source_name": "Sophos Mustang Panda PLUGX",
          "url": "https://www.secureworks.com/blog/bronze-president-targets-government-officials"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ccb19fb9-7c27-4941-b383-62386a4a6429",
      "subject": "ATTACK:enterprise:S1105",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ccb19fb9-7c27-4941-b383-62386a4a6429",
      "modified": "2026-04-29T14:23:06.205Z",
      "references": [
        {
          "source_name": "NCSC-NL COATHANGER Feb 2024",
          "url": "https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cd82d148-f6b1-4247-8ccf-49fadbe7f245",
      "subject": "ATTACK:enterprise:S0585",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cd82d148-f6b1-4247-8ccf-49fadbe7f245",
      "modified": "2026-04-29T14:23:06.206Z",
      "references": [
        {
          "source_name": "Unit 42 KerrDown February 2019",
          "url": "https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d0146a8e-8658-40c4-8232-bec51e1ab9a2",
      "subject": "ATTACK:enterprise:S1014",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d0146a8e-8658-40c4-8232-bec51e1ab9a2",
      "modified": "2026-04-29T14:23:06.210Z",
      "references": [
        {
          "source_name": "SecureWorks August 2019",
          "url": "https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d0a02e9b-9247-4bce-9070-649d7c908640",
      "subject": "ATTACK:enterprise:S1031",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d0a02e9b-9247-4bce-9070-649d7c908640",
      "modified": "2026-04-29T14:23:06.211Z",
      "references": [
        {
          "source_name": "Unit 42 PingPull Jun 2022",
          "url": "https://unit42.paloaltonetworks.com/pingpull-gallium/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d1a489c9-f937-4cc8-85d0-b4ce6b961a62",
      "subject": "ATTACK:enterprise:S0642",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d1a489c9-f937-4cc8-85d0-b4ce6b961a62",
      "modified": "2026-06-13T12:04:40.998Z",
      "references": [
        {
          "source_name": "Accenture MUDCARP March 2019",
          "url": "https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d1b6a397-4f29-4274-8394-1d5ca4fe9fc7",
      "subject": "ATTACK:enterprise:S0022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d1b6a397-4f29-4274-8394-1d5ca4fe9fc7",
      "modified": "2026-04-29T14:23:06.212Z",
      "references": [
        {
          "source_name": "Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023",
          "url": "https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d2bc4516-c074-4d44-9931-07ab518de60a",
      "subject": "ATTACK:enterprise:S0501",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d2bc4516-c074-4d44-9931-07ab518de60a",
      "modified": "2026-04-29T14:23:06.214Z",
      "references": [
        {
          "source_name": "ESET PipeMon May 2020",
          "url": "https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d3937396-a1e5-46c7-87a8-f9653895714f",
      "subject": "ATTACK:enterprise:S1180",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d3937396-a1e5-46c7-87a8-f9653895714f",
      "modified": "2026-04-29T14:23:06.214Z",
      "references": [
        {
          "source_name": "Trustwave BlackByte 2021",
          "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d4240d9a-1499-4863-a654-a52a1dbf48b4",
      "subject": "ATTACK:enterprise:S0258",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d4240d9a-1499-4863-a654-a52a1dbf48b4",
      "modified": "2026-04-29T14:23:06.215Z",
      "references": [
        {
          "source_name": "Unit 42 RGDoor Jan 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d4bffc31-3d7a-4f05-a85d-fdaaaa70853d",
      "subject": "ATTACK:enterprise:S0182",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d4bffc31-3d7a-4f05-a85d-fdaaaa70853d",
      "modified": "2026-04-29T14:23:06.216Z",
      "references": [
        {
          "source_name": "Microsoft FinFisher March 2018",
          "url": "https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"
        },
        {
          "source_name": "FinFisher Citation",
          "url": "https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d68120b8-9ef8-4a40-ae4c-d2b597336140",
      "subject": "ATTACK:enterprise:G0081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d68120b8-9ef8-4a40-ae4c-d2b597336140",
      "modified": "2026-07-31T18:47:57.634Z",
      "references": [
        {
          "source_name": "Unit 42 Tropic Trooper Nov 2016",
          "url": "https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"
        },
        {
          "source_name": "TrendMicro Tropic Trooper May 2020",
          "url": "https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d7702458-8b9d-49e8-a494-b5d87681f2c5",
      "subject": "ATTACK:enterprise:G1016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d7702458-8b9d-49e8-a494-b5d87681f2c5",
      "modified": "2026-07-31T18:48:31.508Z",
      "references": [
        {
          "source_name": "Mandiant FIN13 Aug 2022",
          "url": "https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d850589b-a36f-446e-9864-ae4d4a62b724",
      "subject": "ATTACK:enterprise:S1025",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d850589b-a36f-446e-9864-ae4d4a62b724",
      "modified": "2026-04-29T14:23:06.221Z",
      "references": [
        {
          "source_name": "Korean FSI TA505 2020",
          "url": "https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d86a36a9-fce9-4147-b375-292d6b617769",
      "subject": "ATTACK:enterprise:S1112",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d86a36a9-fce9-4147-b375-292d6b617769",
      "modified": "2026-04-29T14:23:06.221Z",
      "references": [
        {
          "source_name": "Mandiant Pulse Secure Zero-Day April 2021",
          "url": "https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d87615c7-501a-4b78-87fb-ba2c1a2faffb",
      "subject": "ATTACK:enterprise:C0001",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d87615c7-501a-4b78-87fb-ba2c1a2faffb",
      "modified": "2026-07-31T18:47:19.501Z",
      "references": [
        {
          "source_name": "Talos Frankenstein June 2019",
          "url": "https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d98b5525-3cc5-4058-baf5-d614b91eb814",
      "subject": "ATTACK:enterprise:S0347",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d98b5525-3cc5-4058-baf5-d614b91eb814",
      "modified": "2026-04-29T14:23:06.222Z",
      "references": [
        {
          "source_name": "TrendMicro Lazarus Nov 2018",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-continues-heists-mounts-attacks-on-financial-organizations-in-latin-america/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d99ad754-c9fa-4244-b4fa-69a0b2191e24",
      "subject": "ATTACK:enterprise:S0141",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d99ad754-c9fa-4244-b4fa-69a0b2191e24",
      "modified": "2026-04-29T14:23:06.222Z",
      "references": [
        {
          "source_name": "Novetta Winnti April 2015",
          "url": "https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d9e7b8b3-6275-4c26-b9d2-4adfa1143c1b",
      "subject": "ATTACK:enterprise:S0534",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d9e7b8b3-6275-4c26-b9d2-4adfa1143c1b",
      "modified": "2026-04-29T14:23:06.223Z",
      "references": [
        {
          "source_name": "Cybereason Bazar July 2020",
          "url": "https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"
        },
        {
          "source_name": "NCC Group Team9 June 2020",
          "url": "https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--da225cfe-1959-4faa-afef-b5c7a6555bba",
      "subject": "ATTACK:enterprise:S9034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--da225cfe-1959-4faa-afef-b5c7a6555bba",
      "modified": "2026-04-29T14:23:06.223Z",
      "references": [
        {
          "source_name": "CAL_MuddyWater_Mar2026",
          "url": "https://ctrlaltintel.com/research/MuddyWater/"
        },
        {
          "source_name": "SecureListUbiedo_Tsundere_Nov2025",
          "url": "https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--de6e7fde-7407-4caf-acd0-cfa3aa458d04",
      "subject": "ATTACK:enterprise:S1148",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--de6e7fde-7407-4caf-acd0-cfa3aa458d04",
      "modified": "2026-04-29T14:23:06.229Z",
      "references": [
        {
          "source_name": "Sekoia Raccoon1 2022",
          "url": "https://blog.sekoia.io/raccoon-stealer-v2-part-1-the-return-of-the-dead/"
        },
        {
          "source_name": "S2W Racoon 2022",
          "url": "https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--df0ee75f-5e10-40d7-a0ac-e6c281e0d4b9",
      "subject": "ATTACK:enterprise:S0428",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--df0ee75f-5e10-40d7-a0ac-e6c281e0d4b9",
      "modified": "2026-04-29T14:23:06.229Z",
      "references": [
        {
          "source_name": "Talos PoetRAT October 2020",
          "url": "https://blog.talosintelligence.com/2020/10/poetrat-update.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--df98db39-fdfd-463c-96b3-e9a8b049f316",
      "subject": "ATTACK:enterprise:G0034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--df98db39-fdfd-463c-96b3-e9a8b049f316",
      "modified": "2026-07-31T20:48:33.337Z",
      "references": [
        {
          "source_name": "ESET Telebots Dec 2016",
          "url": "https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"
        },
        {
          "source_name": "ESET Telebots July 2017",
          "url": "https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dfcd4d41-11f4-4891-9e49-7a725ab18d1d",
      "subject": "ATTACK:enterprise:S1012",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dfcd4d41-11f4-4891-9e49-7a725ab18d1d",
      "modified": "2026-04-29T14:23:06.230Z",
      "references": [
        {
          "source_name": "Cybereason PowerLess February 2022",
          "url": "https://www.cybereason.com/blog/research/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e1fba82d-1cd2-4906-92db-ba3aafad72ca",
      "subject": "ATTACK:enterprise:S0052",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e1fba82d-1cd2-4906-92db-ba3aafad72ca",
      "modified": "2026-04-29T14:23:06.233Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e359da34-bc39-4e72-9db1-49aa5da6c8b4",
      "subject": "ATTACK:enterprise:C0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e359da34-bc39-4e72-9db1-49aa5da6c8b4",
      "modified": "2026-07-31T20:48:14.878Z",
      "references": [
        {
          "source_name": "Cylance Dust Storm",
          "url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e3be5269-92fd-488e-be35-ddc91030f7c3",
      "subject": "ATTACK:enterprise:S0251",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e3be5269-92fd-488e-be35-ddc91030f7c3",
      "modified": "2026-04-29T14:23:06.235Z",
      "references": [
        {
          "source_name": "Unit42 Cannon Nov 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"
        },
        {
          "source_name": "ESET Zebrocy Nov 2018",
          "url": "https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e3d05599-2a5f-4357-b452-49309690eab1",
      "subject": "ATTACK:enterprise:G1026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e3d05599-2a5f-4357-b452-49309690eab1",
      "modified": "2026-07-31T18:48:16.172Z",
      "references": [
        {
          "source_name": "SCILabs Malteiro 2021",
          "url": "https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e6aed3c5-9f4a-4178-b03b-5805b2f61c81",
      "subject": "ATTACK:enterprise:S0330",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e6aed3c5-9f4a-4178-b03b-5805b2f61c81",
      "modified": "2026-04-29T14:23:06.239Z",
      "references": [
        {
          "source_name": "Talos Zeus Panda Nov 2017",
          "url": "https://blog.talosintelligence.com/2017/11/zeus-panda-campaign.html#More"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e74df3d8-4609-4f07-bdb0-b0531b79038c",
      "subject": "ATTACK:enterprise:S9023",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e74df3d8-4609-4f07-bdb0-b0531b79038c",
      "modified": "2026-04-29T14:23:06.240Z",
      "references": [
        {
          "source_name": "ESET HiddenFace 2024",
          "url": "https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf"
        },
        {
          "source_name": "JPCERT MirrorFace JUL 2024",
          "url": "https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e7c81430-1c3a-4ee8-9f10-4a3fcad2da54",
      "subject": "ATTACK:enterprise:S1140",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e7c81430-1c3a-4ee8-9f10-4a3fcad2da54",
      "modified": "2026-04-29T14:23:06.240Z",
      "references": [
        {
          "source_name": "Google TAG COLDRIVER January 2024",
          "url": "https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e7c9e0f2-d1be-440b-9b6b-7273661d8dac",
      "subject": "ATTACK:enterprise:S9033",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e7c9e0f2-d1be-440b-9b6b-7273661d8dac",
      "modified": "2026-04-29T14:23:06.240Z",
      "references": [
        {
          "source_name": "ESET_MuddyWater_Dec2025",
          "url": "https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e7caa3b3-78d3-4840-bee3-70d7637f5508",
      "subject": "ATTACK:enterprise:S1123",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e7caa3b3-78d3-4840-bee3-70d7637f5508",
      "modified": "2026-04-29T14:23:06.240Z",
      "references": [
        {
          "source_name": "Mandiant Cutting Edge Part 3 February 2024",
          "url": "https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e823be4b-50b9-4430-9010-e960b46bdfcc",
      "subject": "ATTACK:enterprise:S0475",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e823be4b-50b9-4430-9010-e960b46bdfcc",
      "modified": "2026-04-29T14:23:06.241Z",
      "references": [
        {
          "source_name": "Unit 42 BackConfig May 2020",
          "url": "https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e98ae201-7492-4aef-9b17-6499956bbe2b",
      "subject": "ATTACK:enterprise:S0687",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e98ae201-7492-4aef-9b17-6499956bbe2b",
      "modified": "2026-04-29T14:23:06.243Z",
      "references": [
        {
          "source_name": "NCSC Cyclops Blink February 2022",
          "url": "https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e9a7ebd2-e8ec-4047-84d2-831018de10ab",
      "subject": "ATTACK:enterprise:S1236",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e9a7ebd2-e8ec-4047-84d2-831018de10ab",
      "modified": "2026-04-29T14:23:06.243Z",
      "references": [
        {
          "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
          "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ea027248-40a2-403b-a0e9-748bdc8c5667",
      "subject": "ATTACK:enterprise:S0520",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ea027248-40a2-403b-a0e9-748bdc8c5667",
      "modified": "2026-04-29T14:23:06.244Z",
      "references": [
        {
          "source_name": "US-CERT BLINDINGCAN Aug 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--eacb139c-69ea-44a5-b299-6a2db03e4079",
      "subject": "ATTACK:enterprise:S1120",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--eacb139c-69ea-44a5-b299-6a2db03e4079",
      "modified": "2026-04-29T14:23:06.245Z",
      "references": [
        {
          "source_name": "Mandiant Cutting Edge Part 2 January 2024",
          "url": "https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ebbb5d6e-9949-436b-85c5-5cd90a681042",
      "subject": "ATTACK:enterprise:S0631",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ebbb5d6e-9949-436b-85c5-5cd90a681042",
      "modified": "2026-04-29T14:23:06.246Z",
      "references": [
        {
          "source_name": "Cybereason Chaes Nov 2020",
          "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ebd78850-caf0-4e14-8338-0f7347063afc",
      "subject": "ATTACK:enterprise:S0234",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ebd78850-caf0-4e14-8338-0f7347063afc",
      "modified": "2026-04-29T14:23:06.246Z",
      "references": [
        {
          "source_name": "CheckPoint Bandook Nov 2020",
          "url": "https://research.checkpoint.com/2020/bandook-signed-delivered/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ec218695-e481-4895-97a2-5383949cb04d",
      "subject": "ATTACK:enterprise:S0516",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ec218695-e481-4895-97a2-5383949cb04d",
      "modified": "2026-04-29T14:23:06.246Z",
      "references": [
        {
          "source_name": "CISA SoreFang July 2016",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ed6d663f-510b-4702-9c2a-ef40cc4d88c7",
      "subject": "ATTACK:enterprise:S0458",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ed6d663f-510b-4702-9c2a-ef40cc4d88c7",
      "modified": "2026-04-29T14:23:06.248Z",
      "references": [
        {
          "source_name": "Eset Ramsay May 2020",
          "url": "https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f16f0b46-3363-48bd-9a13-c8751fdedf1c",
      "subject": "ATTACK:enterprise:S0280",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f16f0b46-3363-48bd-9a13-c8751fdedf1c",
      "modified": "2026-04-29T14:23:06.253Z",
      "references": [
        {
          "source_name": "APT15 Intezer June 2018",
          "url": "https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f2034fc3-e721-42ce-be50-d58668c5da4b",
      "subject": "ATTACK:enterprise:S0653",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f2034fc3-e721-42ce-be50-d58668c5da4b",
      "modified": "2026-04-29T14:23:06.254Z",
      "references": [
        {
          "source_name": "Checkpoint IndigoZebra July 2021",
          "url": "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f264330f-3c9f-4a2a-a6f6-904a9139bbf5",
      "subject": "ATTACK:enterprise:S0455",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f264330f-3c9f-4a2a-a6f6-904a9139bbf5",
      "modified": "2026-04-29T14:23:06.254Z",
      "references": [
        {
          "source_name": "Medium Metamorfo Apr 2020",
          "url": "https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"
        },
        {
          "source_name": "FireEye Metamorfo Apr 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"
        },
        {
          "source_name": "ESET Casbaneiro Oct 2019",
          "url": "https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f2938ba0-1768-48a8-a36d-9d1578c6f5b1",
      "subject": "ATTACK:enterprise:S1118",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f2938ba0-1768-48a8-a36d-9d1578c6f5b1",
      "modified": "2026-04-29T14:23:06.255Z",
      "references": [
        {
          "source_name": "Mandiant Cutting Edge Part 3 February 2024",
          "url": "https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"
        },
        {
          "source_name": "Mandiant Cutting Edge Part 2 January 2024",
          "url": "https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f2cb5393-d33f-4ee3-a2c0-197c1e032ea5",
      "subject": "ATTACK:enterprise:S0526",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f2cb5393-d33f-4ee3-a2c0-197c1e032ea5",
      "modified": "2026-04-29T14:23:06.255Z",
      "references": [
        {
          "source_name": "Cybereason Kimsuky November 2020",
          "url": "https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f2d433c3-d134-4985-8dc1-b35d407b330a",
      "subject": "ATTACK:enterprise:S0614",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f2d433c3-d134-4985-8dc1-b35d407b330a",
      "modified": "2026-04-29T14:23:06.255Z",
      "references": [
        {
          "source_name": "BlackBerry CostaRicto November 2020",
          "url": "https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f304b74c-85c7-4bd6-85bc-bec918a4fb7e",
      "subject": "ATTACK:enterprise:S0270",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f304b74c-85c7-4bd6-85bc-bec918a4fb7e",
      "modified": "2026-04-29T14:23:06.255Z",
      "references": [
        {
          "source_name": "Unit42 DarkHydrus Jan 2019",
          "url": "https://unit42.paloaltonetworks.com/darkhydrus-delivers-new-trojan-that-can-use-google-drive-for-c2-communications/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f3d0ffd9-5bda-46fd-ba44-ef1b1def9506",
      "subject": "ATTACK:enterprise:S0604",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f3d0ffd9-5bda-46fd-ba44-ef1b1def9506",
      "modified": "2026-04-29T14:23:06.256Z",
      "references": [
        {
          "source_name": "ESET Industroyer",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f3dcd0dd-8657-47b4-b523-38e68bc0ee0f",
      "subject": "ATTACK:enterprise:S1200",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f3dcd0dd-8657-47b4-b523-38e68bc0ee0f",
      "modified": "2026-04-29T14:23:06.256Z",
      "references": [
        {
          "source_name": "Cybereason StealBit Exfiltration Tool",
          "url": "https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"
        },
        {
          "source_name": "FBI Lockbit 2.0 FEB 2022",
          "url": "https://www.ic3.gov/CSA/2022/220204.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f5435422-0bf4-4ca2-af11-12fe12d13f8e",
      "subject": "ATTACK:enterprise:S1170",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f5435422-0bf4-4ca2-af11-12fe12d13f8e",
      "modified": "2026-04-29T14:23:06.258Z",
      "references": [
        {
          "source_name": "ESET OilRig Downloaders DEC 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f59927fc-7a14-44bf-9164-47ac08cf86a4",
      "subject": "ATTACK:enterprise:S1172",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f59927fc-7a14-44bf-9164-47ac08cf86a4",
      "modified": "2026-04-29T14:23:06.259Z",
      "references": [
        {
          "source_name": "ESET OilRig Downloaders DEC 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f649505a-555f-4939-980e-916a511c3134",
      "subject": "ATTACK:enterprise:S1013",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f649505a-555f-4939-980e-916a511c3134",
      "modified": "2026-04-29T14:23:06.260Z",
      "references": [
        {
          "source_name": "Cisco Talos Bitter Bangladesh May 2022",
          "url": "https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f7a7e19a-7d6b-43ca-91a4-4aab1dbfeecc",
      "subject": "ATTACK:enterprise:S1133",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f7a7e19a-7d6b-43ca-91a4-4aab1dbfeecc",
      "modified": "2026-04-29T14:23:06.262Z",
      "references": [
        {
          "source_name": "SentinelOne Agrius 2021",
          "url": "https://assets.sentinelone.com/sentinellabs/evol-agrius"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f813e8ab-96d7-4880-a3c2-50e164d4bd66",
      "subject": "ATTACK:enterprise:C0006",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f813e8ab-96d7-4880-a3c2-50e164d4bd66",
      "modified": "2026-07-31T18:47:21.229Z",
      "references": [
        {
          "source_name": "McAfee Honeybee",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f84b2658-a891-45a8-93ff-14dc0a86df10",
      "subject": "ATTACK:enterprise:G0073",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f84b2658-a891-45a8-93ff-14dc0a86df10",
      "modified": "2026-07-31T18:48:31.260Z",
      "references": [
        {
          "source_name": "Unit 42 C0d0so0 Jan 2016",
          "url": "https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f8e31b9d-941d-4f58-ae3a-3bdbf4b2a923",
      "subject": "ATTACK:enterprise:S0624",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f8e31b9d-941d-4f58-ae3a-3bdbf4b2a923",
      "modified": "2026-04-29T14:23:06.263Z",
      "references": [
        {
          "source_name": "Securelist APT10 March 2021",
          "url": "https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fa22812f-01a4-420a-be11-7cb5822026e5",
      "subject": "ATTACK:enterprise:G0126",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fa22812f-01a4-420a-be11-7cb5822026e5",
      "modified": "2026-07-31T18:47:56.936Z",
      "references": [
        {
          "source_name": "Malwarebytes Higaisa 2020",
          "url": "https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"
        },
        {
          "source_name": "Zscaler Higaisa 2020",
          "url": "https://www.zscaler.com/blogs/security-research/return-higaisa-apt"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fbe5352c-7c4f-437c-a439-d212ba6d439b",
      "subject": "ATTACK:enterprise:S0512",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fbe5352c-7c4f-437c-a439-d212ba6d439b",
      "modified": "2026-04-29T14:23:06.267Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fbf9654c-45f2-41bc-83ec-3dfdfa6d5115",
      "subject": "ATTACK:enterprise:S1147",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fbf9654c-45f2-41bc-83ec-3dfdfa6d5115",
      "modified": "2026-04-29T14:23:06.267Z",
      "references": [
        {
          "source_name": "Symantec Daggerfly 2024",
          "url": "https://symantec-enterprise-blogs.security.com/threat-intelligence/daggerfly-espionage-updated-toolset"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fc61d659-2c80-4148-92ff-b689093a49b2",
      "subject": "ATTACK:enterprise:S1227",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fc61d659-2c80-4148-92ff-b689093a49b2",
      "modified": "2026-04-29T14:23:06.267Z",
      "references": [
        {
          "source_name": "Zscaler",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fd14f3b8-b18a-4b35-822e-cfd8cd103728",
      "subject": "ATTACK:enterprise:C0046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fd14f3b8-b18a-4b35-822e-cfd8cd103728",
      "modified": "2026-07-31T18:47:29.321Z",
      "references": [
        {
          "source_name": "Cisco ArcaneDoor 2024",
          "url": "https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fd2f1a44-2ae7-4df0-b53c-42bc96af2da1",
      "subject": "ATTACK:enterprise:S0180",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fd2f1a44-2ae7-4df0-b53c-42bc96af2da1",
      "modified": "2026-04-29T14:23:06.269Z",
      "references": [
        {
          "source_name": "US-CERT Volgmer 2 Nov 2017",
          "url": "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-D_WHITE_S508C.PDF"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fdb22ee1-d90b-496b-a7f7-baf155a1930c",
      "subject": "ATTACK:enterprise:S0582",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fdb22ee1-d90b-496b-a7f7-baf155a1930c",
      "modified": "2026-04-29T14:23:06.270Z",
      "references": [
        {
          "source_name": "Proofpoint LookBack Malware Aug 2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fe2eb5b7-7ae1-4df1-a49e-ad13f50510e8",
      "subject": "ATTACK:enterprise:S0518",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fe2eb5b7-7ae1-4df1-a49e-ad13f50510e8",
      "modified": "2026-04-29T14:23:06.270Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ff10b414-cc17-4335-9030-1262e5401b39",
      "subject": "ATTACK:enterprise:S0565",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ff10b414-cc17-4335-9030-1262e5401b39",
      "modified": "2026-04-29T14:23:06.271Z",
      "references": [
        {
          "source_name": "Symantec RAINDROP January 2021",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"
        },
        {
          "source_name": "Microsoft Deep Dive Solorigate January 2021",
          "url": "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ff66d5ca-9ce1-49bb-871a-8e5579c5bc3e",
      "subject": "ATTACK:enterprise:S9058",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ff66d5ca-9ce1-49bb-871a-8e5579c5bc3e",
      "modified": "2026-09-28T16:48:44.116Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549_Nov2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ff8241d6-2a4c-41ea-b86d-43082ca0fb48",
      "subject": "ATTACK:enterprise:S0567",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ff8241d6-2a4c-41ea-b86d-43082ca0fb48",
      "modified": "2026-04-29T14:23:06.272Z",
      "references": [
        {
          "source_name": "Securelist Dtrack",
          "url": "https://securelist.com/my-name-is-dtrack/93338/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ffecf9e6-6966-4535-934f-4fd4696875b0",
      "subject": "ATTACK:enterprise:S0499",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1140",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ffecf9e6-6966-4535-934f-4fd4696875b0",
      "modified": "2026-04-29T14:23:06.272Z",
      "references": [
        {
          "source_name": "Threatpost Hancitor",
          "url": "https://threatpost.com/spammers-revive-hancitor-downloader-campaigns/123011/"
        },
        {
          "source_name": "FireEye Hancitor",
          "url": "https://www.fireeye.com/blog/threat-research/2016/09/hancitor_aka_chanit.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    }
  ],
  "source_snapshot": {
    "file": "enterprise-attack-20.0.json",
    "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
    "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352",
    "bytes": 55271014,
    "checked_at": "2026-10-16T03:31:39Z"
  },
  "notices_url": "https://aol.pm/source-notices.txt",
  "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"
}

License
-------
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,
development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce
MITRE's copyright designation and this license in any such copy.

"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

Disclaimers
-----------
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part
of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover
full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or
variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE
ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,
AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE.