{"record":{"id":"ATTACK:enterprise:T1190","title":"Exploit Public-Facing Application","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1190","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--3f886f2a-874f-4333-b794-aa6075009b1c","external_id":"T1190","domain":"enterprise","created":"2018-04-18T17:59:24.739Z","modified":"2026-05-12T15:12:00.628Z","version":"2.8","aliases":[],"tactics":["initial-access"],"source_references":[{"source_name":"CWE top 25","url":"https://cwe.mitre.org/top25/index.html"},{"source_name":"CIS Multiple SMB Vulnerabilities","url":"https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-windows-smb-server-could-allow-for-remote-code-execution/"},{"source_name":"Ars Technica VMWare Code Execution Vulnerability 2021","url":"https://arstechnica.com/information-technology/2021/02/armed-with-exploits-hackers-on-the-prowl-for-a-critical-vmware-vulnerability/"},{"source_name":"Recorded Future ESXiArgs Ransomware 2023","url":"https://www.recordedfuture.com/blog/esxiargs-ransomware-targets-vmware-esxi-openslp-servers"},{"source_name":"Wired Russia Cyberwar","url":"https://www.wired.com/story/russia-ukraine-cyberattacks-mandiant/"},{"source_name":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"},{"source_name":"NVD CVE-2016-6662","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6662"},{"source_name":"NVD CVE-2014-7169","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7169"},{"source_name":"Cisco Blog Legacy Device Attacks","url":"https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"},{"source_name":"OWASP Top 10","url":"https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project"},{"source_name":"US-CERT TA18-106A Network Infrastructure Devices 2018","url":"https://us-cert.cisa.gov/ncas/alerts/TA18-106A"}]},"assertions":[{"id":"enterprise:relationship--0365ae71-f035-48af-bed4-7609e7029804","subject":"ATTACK:enterprise:C0062","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0365ae71-f035-48af-bed4-7609e7029804","modified":"2026-07-31T18:47:24.160Z","references":[{"source_name":"Anthropic AI Orchestrated Campaign NOV 2025","url":"https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--04e866d0-5d9d-435d-b37c-311bb0bbdb1e","subject":"ATTACK:enterprise:C0027","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--04e866d0-5d9d-435d-b37c-311bb0bbdb1e","modified":"2026-07-31T18:47:33.289Z","references":[{"source_name":"Crowdstrike TELCO BPO Campaign December 2022","url":"https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--06508c23-746d-4894-b414-cff925692bd5","subject":"ATTACK:enterprise:G0106","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--06508c23-746d-4894-b414-cff925692bd5","modified":"2026-07-31T18:47:52.065Z","references":[{"source_name":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"},{"source_name":"Unit 42 Rocke January 2019","url":"https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--07dec22a-ac65-448c-a948-cefd8effa6f2","subject":"ATTACK:enterprise:C0039","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--07dec22a-ac65-448c-a948-cefd8effa6f2","modified":"2026-07-31T18:47:30.649Z","references":[{"source_name":"Lumen Versa 2024","url":"https://blog.lumen.com/taking-the-crossroads-the-versa-director-zero-day-exploitation/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0beabd79-c7a6-449b-806b-c50979cbc3d7","subject":"ATTACK:enterprise:C0045","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0beabd79-c7a6-449b-806b-c50979cbc3d7","modified":"2026-07-31T18:47:23.362Z","references":[{"source_name":"Oligo ShadowRay Campaign MAR 2024","url":"https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0c8fdb59-a28f-4f8f-a788-9e3e8928c6d5","subject":"ATTACK:enterprise:M1048","predicate":"mitigates","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0c8fdb59-a28f-4f8f-a788-9e3e8928c6d5","modified":"2026-04-29T14:23:05.920Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--11e07a59-502c-44e9-9a70-03eff1433c33","subject":"ATTACK:enterprise:G0027","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--11e07a59-502c-44e9-9a70-03eff1433c33","modified":"2026-07-31T18:48:28.378Z","references":[{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--198a9aa2-5d98-46c2-b43b-0191786049e7","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--198a9aa2-5d98-46c2-b43b-0191786049e7","modified":"2026-07-31T20:48:31.720Z","references":[{"source_name":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1c0c0c90-7974-48f4-9de0-15a8d9b00e0a","subject":"ATTACK:enterprise:M1037","predicate":"mitigates","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1c0c0c90-7974-48f4-9de0-15a8d9b00e0a","modified":"2026-04-29T14:23:05.943Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--237d7c2e-503a-420c-bf94-047f5c42a646","subject":"ATTACK:enterprise:C0018","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--237d7c2e-503a-420c-bf94-047f5c42a646","modified":"2026-07-31T18:47:22.903Z","references":[{"source_name":"Cisco Talos Avos Jun 2022","url":"https://blog.talosintelligence.com/avoslocker-new-arsenal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--269fbafb-f9ad-4782-b9e6-ccf44e3723f8","subject":"ATTACK:enterprise:G1056","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--269fbafb-f9ad-4782-b9e6-ccf44e3723f8","modified":"2026-09-02T17:31:48.823Z","references":[{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source_name":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"},{"source_name":"Wiz Mini Shai-Hulud MAY 2026","url":"https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"},{"source_name":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--26ecce49-13ab-43a9-a626-10dae30b6961","subject":"ATTACK:enterprise:S0623","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--26ecce49-13ab-43a9-a626-10dae30b6961","modified":"2026-04-29T14:23:05.958Z","references":[{"source_name":"Unit 42 Siloscape Jun 2021","url":"https://unit42.paloaltonetworks.com/siloscape/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--284eb222-c310-480c-aaaa-82c1d5c64e62","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--284eb222-c310-480c-aaaa-82c1d5c64e62","modified":"2026-07-31T18:47:39.903Z","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source_name":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f30a994-602d-48a0-bd19-bcd02e1cb322","subject":"ATTACK:enterprise:G1055","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f30a994-602d-48a0-bd19-bcd02e1cb322","modified":"2026-07-31T18:48:25.440Z","references":[{"source_name":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--31353596-4fa7-4a37-8bb9-bc0690742576","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--31353596-4fa7-4a37-8bb9-bc0690742576","modified":"2026-07-31T20:48:32.727Z","references":[{"source_name":"Leonard TAG 2023","url":"https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"},{"source_name":"NSA Sandworm 2020","url":"https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--329d115e-2a1d-443e-800c-d28f5f11d6b9","subject":"ATTACK:enterprise:G0007","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--329d115e-2a1d-443e-800c-d28f5f11d6b9","modified":"2026-07-31T20:48:44.576Z","references":[{"source_name":"US District Court Indictment GRU Oct 2018","url":"https://www.justice.gov/opa/page/file/1098481/download"},{"source_name":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--33eb4a61-d966-4193-a8e5-237eb5a5129a","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--33eb4a61-d966-4193-a8e5-237eb5a5129a","modified":"2026-07-31T20:48:24.712Z","references":[{"source_name":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--37306ec5-a50c-43a5-aa02-08b2179fb09d","subject":"ATTACK:enterprise:G1003","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--37306ec5-a50c-43a5-aa02-08b2179fb09d","modified":"2026-07-31T18:48:12.946Z","references":[{"source_name":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source_name":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3a41f311-3961-4446-ad71-2a6f4e3561ec","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3a41f311-3961-4446-ad71-2a6f4e3561ec","modified":"2026-07-31T18:47:31.501Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3b726298-74dc-4f8a-b58d-f623bc645124","subject":"ATTACK:enterprise:M1030","predicate":"mitigates","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3b726298-74dc-4f8a-b58d-f623bc645124","modified":"2026-04-29T14:23:06.003Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3c695c3d-7f8e-43dd-baad-b2afdfc86fc2","subject":"ATTACK:enterprise:C0002","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3c695c3d-7f8e-43dd-baad-b2afdfc86fc2","modified":"2026-07-31T18:47:30.779Z","references":[{"source_name":"McAfee Night Dragon","url":"https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f22638d-1003-44d6-a46e-eab83b966834","subject":"ATTACK:enterprise:C0017","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f22638d-1003-44d6-a46e-eab83b966834","modified":"2026-07-31T21:12:31.132Z","references":[{"source_name":"Mandiant APT41","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f4096d5-06d8-4a1e-bb31-0e2b37d5f622","subject":"ATTACK:enterprise:G0135","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f4096d5-06d8-4a1e-bb31-0e2b37d5f622","modified":"2026-07-31T18:48:11.184Z","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--42d0b653-1d08-4e7b-910f-753412fda316","subject":"ATTACK:enterprise:G0115","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--42d0b653-1d08-4e7b-910f-753412fda316","modified":"2026-07-31T20:48:46.009Z","references":[{"source_name":"Secureworks REvil September 2019","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--430c6ce1-4461-4c3a-b7e2-3617cc82483a","subject":"ATTACK:enterprise:G1057","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--430c6ce1-4461-4c3a-b7e2-3617cc82483a","modified":"2026-07-31T18:47:58.694Z","references":[{"source_name":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"},{"source_name":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4bbc5989-38f8-4057-a01b-2ff7812ef589","subject":"ATTACK:enterprise:C0064","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4bbc5989-38f8-4057-a01b-2ff7812ef589","modified":"2026-10-01T14:26:34.910Z","references":[{"source_name":"AI-Mexico-Govt-Breach","url":"https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4c308ec1-f0c6-4444-af7d-ff045204c326","subject":"ATTACK:enterprise:M1016","predicate":"mitigates","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4c308ec1-f0c6-4444-af7d-ff045204c326","modified":"2026-04-29T14:23:06.029Z","references":[{"source_name":"OWASP Top 10","url":"https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4d50a045-d85d-481f-ac7d-672065f1e348","subject":"ATTACK:enterprise:M1026","predicate":"mitigates","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4d50a045-d85d-481f-ac7d-672065f1e348","modified":"2026-04-29T14:23:06.030Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4f5f1da9-9396-4b66-a67b-c08470924882","subject":"ATTACK:enterprise:G1016","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4f5f1da9-9396-4b66-a67b-c08470924882","modified":"2026-07-31T18:48:30.869Z","references":[{"source_name":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source_name":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--51cc3f41-f5aa-4d04-95de-15d96e103bac","subject":"ATTACK:enterprise:G0098","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--51cc3f41-f5aa-4d04-95de-15d96e103bac","modified":"2026-07-31T18:48:01.641Z","references":[{"source_name":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--53a95297-1cce-401c-99a3-34079e878fac","subject":"ATTACK:enterprise:M1050","predicate":"mitigates","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--53a95297-1cce-401c-99a3-34079e878fac","modified":"2026-04-29T14:23:06.039Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--547b575e-bc3c-488a-ae38-8bf6387b33f5","subject":"ATTACK:enterprise:S0225","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--547b575e-bc3c-488a-ae38-8bf6387b33f5","modified":"2026-04-29T14:23:06.041Z","references":[{"source_name":"sqlmap Introduction","url":"http://sqlmap.org/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--54af36a6-0a08-4853-9002-a1ae51b22ca5","subject":"ATTACK:enterprise:G0059","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--54af36a6-0a08-4853-9002-a1ae51b22ca5","modified":"2026-07-31T18:48:28.403Z","references":[{"source_name":"Check Point APT35 CharmPower January 2022","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"},{"source_name":"Cybereason PowerLess February 2022","url":"https://www.cybereason.com/blog/research/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage"},{"source_name":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source_name":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source_name":"Microsoft Log4j Vulnerability Exploitation December 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/"},{"source_name":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--57b386c4-5322-4e5b-a8a9-37d68a75f4c0","subject":"ATTACK:enterprise:C0049","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--57b386c4-5322-4e5b-a8a9-37d68a75f4c0","modified":"2026-07-31T18:47:32.824Z","references":[{"source_name":"CISA Leviathan 2024","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5c1f3cc7-902d-4af1-9910-d149b76ae4a0","subject":"ATTACK:enterprise:C0038","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5c1f3cc7-902d-4af1-9910-d149b76ae4a0","modified":"2026-07-31T21:13:11.086Z","references":[{"source_name":"CISA Iran Albanian Attacks September 2022","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5debdfdd-fe10-4872-a8a2-63309c28d309","subject":"ATTACK:enterprise:C0048","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5debdfdd-fe10-4872-a8a2-63309c28d309","modified":"2026-07-31T18:47:20.874Z","references":[{"source_name":"Palo Alto MidnightEclipse APR 2024","url":"https://unit42.paloaltonetworks.com/cve-2024-3400/"},{"source_name":"Volexity UPSTYLE 2024","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--61ee8aa7-89fc-4414-97f3-95fa9f1f26ad","subject":"ATTACK:enterprise:S0516","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--61ee8aa7-89fc-4414-97f3-95fa9f1f26ad","modified":"2026-04-29T14:23:06.058Z","references":[{"source_name":"CISA SoreFang July 2016","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--62ab55a6-4341-41df-866d-5cc784770e6f","subject":"ATTACK:enterprise:G1051","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--62ab55a6-4341-41df-866d-5cc784770e6f","modified":"2026-07-31T18:48:10.486Z","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64711bac-8f6b-43f6-bcbc-1bdbf76dd47d","subject":"ATTACK:enterprise:C0055","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64711bac-8f6b-43f6-bcbc-1bdbf76dd47d","modified":"2026-07-31T18:47:34.037Z","references":[{"source_name":"Microsoft Storm-0940","url":"https://www.microsoft.com/en-us/security/blog/2024/10/31/chinese-threat-actor-storm-0940-uses-credentials-from-password-spray-attacks-from-a-covert-network/"},{"source_name":"TP-Link Quad 7 AUG 2025","url":"https://www.tp-link.com/us/support/faq/4365/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6496a79b-5946-4928-a92f-d8372e9c5de8","subject":"ATTACK:enterprise:G1041","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6496a79b-5946-4928-a92f-d8372e9c5de8","modified":"2026-07-31T18:47:57.626Z","references":[{"source_name":"Talos Sea Turtle 2019","url":"https://blog.talosintelligence.com/seaturtle/"},{"source_name":"PWC Sea Turtle 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--65971cda-62b8-4685-8070-3d61ded0850d","subject":"ATTACK:enterprise:G1053","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--65971cda-62b8-4685-8070-3d61ded0850d","modified":"2026-07-31T18:48:03.717Z","references":[{"source_name":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--66fe07f5-fe08-4ad1-98b6-cb300007fe42","subject":"ATTACK:enterprise:S0412","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--66fe07f5-fe08-4ad1-98b6-cb300007fe42","modified":"2026-04-29T14:23:06.065Z","references":[{"source_name":"Talos ZxShell Oct 2014","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6bbf2f6b-de27-435b-bf3e-bc991a25e561","subject":"ATTACK:enterprise:S1105","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6bbf2f6b-de27-435b-bf3e-bc991a25e561","modified":"2026-04-29T14:23:06.072Z","references":[{"source_name":"NCSC-NL COATHANGER Feb 2024","url":"https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6cfdc8e4-4970-428b-80c3-89ebb12328c4","subject":"ATTACK:enterprise:C0058","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6cfdc8e4-4970-428b-80c3-89ebb12328c4","modified":"2026-07-31T18:47:18.418Z","references":[{"source_name":"Trend Micro SharePoint Attacks JUL 2025","url":"https://www.trendmicro.com/en_us/research/25/g/cve-2025-53770-and-cve-2025-53771-sharepoint-attacks.html"},{"source_name":"ESET ToolShell JUL 2025","url":"https://www.welivesecurity.com/en/eset-research/toolshell-an-all-you-can-eat-buffet-for-threat-actors/"},{"source_name":"Eye Research ToolShell JUL 2025","url":"https://research.eye.security/sharepoint-under-siege/"},{"source_name":"SentinelOne ToolShell JUL 2025","url":"https://www.sentinelone.com/blog/sharepoint-toolshell-zero-day-exploited-in-the-wild-targets-enterprise-servers/"},{"source_name":"Microsoft SharePoint Exploit JUL 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603"},{"source_name":"Palo Alto SharePoint Vulnerabilities JUL 2025","url":"https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6d4f3696-caa9-4100-bef5-e42d0f18470e","subject":"ATTACK:enterprise:G0117","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6d4f3696-caa9-4100-bef5-e42d0f18470e","modified":"2026-07-31T18:48:17.275Z","references":[{"source_name":"ClearkSky Fox Kitten February 2020","url":"https://www.clearskysec.com/fox-kitten/"},{"source_name":"Dragos PARISITE ","url":"https://www.dragos.com/threat/parisite/"},{"source_name":"CrowdStrike PIONEER KITTEN August 2020","url":"https://www.crowdstrike.com/blog/who-is-pioneer-kitten/"},{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"},{"source_name":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7bf7f711-823d-41b8-8e88-801f7fa98591","subject":"ATTACK:enterprise:G1021","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7bf7f711-823d-41b8-8e88-801f7fa98591","modified":"2026-07-31T18:48:07.877Z","references":[{"source_name":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"},{"source_name":"SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022","url":"https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"},{"source_name":"Microsoft Log4j Vulnerability Exploitation December 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/"},{"source_name":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7cd37736-47d4-4d56-8398-bd4104f43cb9","subject":"ATTACK:enterprise:G1043","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7cd37736-47d4-4d56-8398-bd4104f43cb9","modified":"2026-07-31T18:47:36.174Z","references":[{"source_name":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"},{"source_name":"Symantec BlackByte 2022","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"},{"source_name":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e834bba-4d5d-47b6-b689-b905eba66c0d","subject":"ATTACK:enterprise:G0004","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e834bba-4d5d-47b6-b689-b905eba66c0d","modified":"2026-07-31T18:48:01.312Z","references":[{"source_name":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--81041da9-e3ff-4487-a54b-f02c0384c95c","subject":"ATTACK:enterprise:C0052","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--81041da9-e3ff-4487-a54b-f02c0384c95c","modified":"2026-07-31T18:47:26.730Z","references":[{"source_name":"NSA APT5 Citrix Threat Hunting December 2022","url":"https://media.defense.gov/2022/Dec/13/2003131586/-1/-1/0/CSA-APT5-CITRIXADC-V1.PDF"},{"source_name":"ORB Mandiant","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--836ba167-10bd-40ce-8578-bbac18d074ed","subject":"ATTACK:enterprise:G1058","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--836ba167-10bd-40ce-8578-bbac18d074ed","modified":"2026-09-22T18:50:55.262Z","references":[{"source_name":"BradyUnit42_TheGentlemen_July2026","url":"https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/"},{"source_name":"Intel471_TheGentlemen_Aug2026","url":"https://www.intel471.com/blog/threat-hunting-case-study-the-gentlemen"},{"source_name":"TrendAI_TheGentlemen_Sept2025","url":"https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware"},{"source_name":"SoučekESET_Gentlemen_Jun2026","url":"https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83ac4384-a6a8-42d1-9b1b-273902c57144","subject":"ATTACK:enterprise:C0012","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83ac4384-a6a8-42d1-9b1b-273902c57144","modified":"2026-07-31T18:47:28.417Z","references":[{"source_name":"Cybereason OperationCuckooBees May 2022","url":"https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83cd501e-c042-4d2d-bf76-f2d499971302","subject":"ATTACK:enterprise:G1030","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83cd501e-c042-4d2d-bf76-f2d499971302","modified":"2026-07-31T18:48:14.880Z","references":[{"source_name":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9171c149-2e87-4882-9e9d-8abce7533beb","subject":"ATTACK:enterprise:C0024","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9171c149-2e87-4882-9e9d-8abce7533beb","modified":"2026-07-31T18:47:26.957Z","references":[{"source_name":"Volexity SolarWinds","url":"https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/"},{"source_name":"Cybersecurity Advisory SVR TTP May 2021","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9558b7a7-f58b-4b6f-a1f5-8a7cdab03279","subject":"ATTACK:enterprise:C0061","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9558b7a7-f58b-4b6f-a1f5-8a7cdab03279","modified":"2026-07-31T18:47:24.669Z","references":[{"source_name":"sentinelone operationDigitalEye Dec 2024","url":"https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--96295901-89c2-4646-b18f-3d2eeec651ba","subject":"ATTACK:enterprise:S1242","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--96295901-89c2-4646-b18f-3d2eeec651ba","modified":"2026-04-29T14:23:06.130Z","references":[{"source_name":"SentinelOne Qilin NOV 2022","url":"https://www.sentinelone.com/anthology/agenda-qilin/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9cf09dbc-7668-4c1c-8e57-01f9c082c80d","subject":"ATTACK:enterprise:C0029","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9cf09dbc-7668-4c1c-8e57-01f9c082c80d","modified":"2026-07-31T18:47:23.253Z","references":[{"source_name":"Volexity Ivanti Global Exploitation January 2024","url":"https://www.volexity.com/blog/2024/01/15/ivanti-connect-secure-vpn-exploitation-goes-global/"},{"source_name":"Mandiant Cutting Edge Part 3 February 2024","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"},{"source_name":"Mandiant Cutting Edge Part 2 January 2024","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"},{"source_name":"Mandiant Cutting Edge January 2024","url":"https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"},{"source_name":"Volexity Ivanti Zero-Day Exploitation January 2024","url":"https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9e27b122-a10d-4f0a-8ca8-6040d8879586","subject":"ATTACK:enterprise:G0045","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9e27b122-a10d-4f0a-8ca8-6040d8879586","modified":"2026-07-31T18:47:44.233Z","references":[{"source_name":"Securelist APT10 March 2021","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a2a5e505-b957-430e-9bbd-75e6d9e34532","subject":"ATTACK:enterprise:G1022","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a2a5e505-b957-430e-9bbd-75e6d9e34532","modified":"2026-07-31T18:48:14.283Z","references":[{"source_name":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a4bb6f26-b659-4d1d-b0fc-f4f4efe32db6","subject":"ATTACK:enterprise:G0108","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a4bb6f26-b659-4d1d-b0fc-f4f4efe32db6","modified":"2026-07-31T18:48:02.886Z","references":[{"source_name":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a7fbea9e-99a2-4319-b159-f4cb18908c27","subject":"ATTACK:enterprise:S1184","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a7fbea9e-99a2-4319-b159-f4cb18908c27","modified":"2026-04-29T14:23:06.154Z","references":[{"source_name":"Google Cloud BOLDMOVE 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/chinese-actors-exploit-fortios-flaw/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ad60e0be-02a4-4f79-a81d-afdde78492be","subject":"ATTACK:enterprise:G0093","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ad60e0be-02a4-4f79-a81d-afdde78492be","modified":"2026-07-31T18:47:37.516Z","references":[{"source_name":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"},{"source_name":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b1eac432-b174-49c1-a8bf-93cedcc7d407","subject":"ATTACK:enterprise:C0053","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b1eac432-b174-49c1-a8bf-93cedcc7d407","modified":"2026-07-31T18:47:34.211Z","references":[{"source_name":"ORB Mandiant","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b20bd897-988b-422b-82d1-61e155d34115","subject":"ATTACK:enterprise:G1035","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b20bd897-988b-422b-82d1-61e155d34115","modified":"2026-07-31T18:48:03.194Z","references":[{"source_name":"ESET WinterVivern 2023","url":"https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/"},{"source_name":"Proofpoint WinterVivern 2023","url":"https://www.proofpoint.com/us/blog/threat-insight/exploitation-dish-best-served-cold-winter-vivern-uses-known-zimbra-vulnerability"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b7b6cc9f-50ac-4774-9dd4-3c14b408b99e","subject":"ATTACK:enterprise:M1035","predicate":"mitigates","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b7b6cc9f-50ac-4774-9dd4-3c14b408b99e","modified":"2026-04-29T14:23:06.176Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b8012238-cfd9-4c5b-8759-8d86f0d6f933","subject":"ATTACK:enterprise:G1006","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b8012238-cfd9-4c5b-8759-8d86f0d6f933","modified":"2026-07-31T20:48:48.354Z","references":[{"source_name":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b8a77549-8dbe-4089-97af-0875c90f874b","subject":"ATTACK:enterprise:C0046","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b8a77549-8dbe-4089-97af-0875c90f874b","modified":"2026-07-31T18:47:29.212Z","references":[{"source_name":"CCCS ArcaneDoor 2024","url":"https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bf0ff6f3-51a5-4718-af3f-8f75b1eb507c","subject":"ATTACK:enterprise:G0016","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bf0ff6f3-51a5-4718-af3f-8f75b1eb507c","modified":"2026-07-31T18:48:08.914Z","references":[{"source_name":"NCSC APT29 July 2020","url":"https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"},{"source_name":"Cybersecurity Advisory SVR TTP May 2021","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c010891f-9ddb-4943-a87a-e83c46075406","subject":"ATTACK:enterprise:G0065","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c010891f-9ddb-4943-a87a-e83c46075406","modified":"2026-07-31T20:48:38.398Z","references":[{"source_name":"CISA Leviathan 2024","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4bc8f71-e4f4-42b8-a39f-b4512987a423","subject":"ATTACK:enterprise:G0123","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4bc8f71-e4f4-42b8-a39f-b4512987a423","modified":"2026-07-31T18:48:13.492Z","references":[{"source_name":"CheckPoint Volatile Cedar March 2015","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"},{"source_name":"ClearSky Lebanese Cedar Jan 2021","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c962253b-d89e-4645-bdd4-5625df63abc1","subject":"ATTACK:enterprise:G1032","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c962253b-d89e-4645-bdd4-5625df63abc1","modified":"2026-07-31T20:48:47.774Z","references":[{"source_name":"SentinelOne INC Ransomware","url":"https://www.sentinelone.com/anthology/inc-ransom/"},{"source_name":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ca3b64e6-7422-48ce-b9c0-eff9d4ad2635","subject":"ATTACK:enterprise:G1048","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ca3b64e6-7422-48ce-b9c0-eff9d4ad2635","modified":"2026-07-31T18:47:54.186Z","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"},{"source_name":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cebc9afb-0f47-4fb5-b3f4-53aa59653a83","subject":"ATTACK:enterprise:G1054","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cebc9afb-0f47-4fb5-b3f4-53aa59653a83","modified":"2026-07-31T18:48:09.043Z","references":[{"source_name":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ced175fd-1f27-44cb-8d7f-44277b1754e4","subject":"ATTACK:enterprise:S0224","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ced175fd-1f27-44cb-8d7f-44277b1754e4","modified":"2026-04-29T14:23:06.208Z","references":[{"source_name":"Check Point Havij Analysis","url":"https://blog.checkpoint.com/2015/05/14/analysis-havij-sql-injection-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cf1d394d-a767-40a8-be7a-87c17531dfdb","subject":"ATTACK:enterprise:G1009","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cf1d394d-a767-40a8-be7a-87c17531dfdb","modified":"2026-07-31T18:47:55.719Z","references":[{"source_name":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d06cd799-f61b-460e-a287-e58e8ff39022","subject":"ATTACK:enterprise:G0035","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d06cd799-f61b-460e-a287-e58e8ff39022","modified":"2026-07-31T20:48:28.686Z","references":[{"source_name":"CISA AA20-296A Berserk Bear December 2020","url":"https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d373eebb-b578-4b59-9de1-2946bf837d96","subject":"ATTACK:enterprise:M1051","predicate":"mitigates","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d373eebb-b578-4b59-9de1-2946bf837d96","modified":"2026-04-29T14:23:06.214Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e11a3d87-d9cf-4dcf-b722-fef4b0a324b4","subject":"ATTACK:enterprise:G0001","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e11a3d87-d9cf-4dcf-b722-fef4b0a324b4","modified":"2026-07-31T18:48:12.492Z","references":[{"source_name":"Cisco Group 72","url":"http://blogs.cisco.com/security/talos/threat-spotlight-group-72"},{"source_name":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e7fc5a89-f5a7-432f-a885-6b9532153e7e","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e7fc5a89-f5a7-432f-a885-6b9532153e7e","modified":"2026-07-31T20:48:27.617Z","references":[{"source_name":"apt41_dcsocytec_dec2022","url":"https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"},{"source_name":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"},{"source_name":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e8148225-e246-45c4-b203-2958d0bb07da","subject":"ATTACK:enterprise:G1040","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e8148225-e246-45c4-b203-2958d0bb07da","modified":"2026-07-31T18:48:26.060Z","references":[{"source_name":"CISA Play Ransomware Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"},{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e869a152-1a24-4ae6-9060-2e6cd928589f","subject":"ATTACK:enterprise:C0041","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e869a152-1a24-4ae6-9060-2e6cd928589f","modified":"2026-07-31T20:48:13.577Z","references":[{"source_name":"Dragos FROSTYGOOP 2024","url":"https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e8e6f472-e048-401c-8a2e-5e2effc09040","subject":"ATTACK:enterprise:G0125","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e8e6f472-e048-401c-8a2e-5e2effc09040","modified":"2026-07-31T18:47:44.950Z","references":[{"source_name":"FireEye Exchange Zero Days March 2021","url":"https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html"},{"source_name":"Volexity Exchange Marauder March 2021","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"},{"source_name":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"},{"source_name":"Tarrask scheduled task","url":"https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/"},{"source_name":"Microsoft Log4j Vulnerability Exploitation December 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/"},{"source_name":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f147e87d-1ed7-4ab3-a414-0537a9bfb887","subject":"ATTACK:enterprise:G1023","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f147e87d-1ed7-4ab3-a414-0537a9bfb887","modified":"2026-07-31T18:48:17.668Z","references":[{"source_name":"Microsoft East Asia Threats September 2023","url":"https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RW1aFyW"},{"source_name":"NSA APT5 Citrix Threat Hunting December 2022","url":"https://media.defense.gov/2022/Dec/13/2003131586/-1/-1/0/CSA-APT5-CITRIXADC-V1.PDF"},{"source_name":"Mandiant Pulse Secure Zero-Day April 2021","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"},{"source_name":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f439858f-020c-4476-b032-42b3abdc0e19","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f439858f-020c-4476-b032-42b3abdc0e19","modified":"2026-07-31T20:48:30.293Z","references":[{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f63e09a1-6ed2-48b4-9ba2-69eec39091b4","subject":"ATTACK:enterprise:G1045","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f63e09a1-6ed2-48b4-9ba2-69eec39091b4","modified":"2026-09-28T13:59:55.533Z","references":[{"source_name":"CarySentinelLabs_CiscoSaltTyphoon_Dec2025","url":"https://www.sentinelone.com/labs/malicious-apprentice-how-two-hackers-went-from-cisco-academy-to-cisco-cves/"},{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"},{"source_name":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fab9f76e-570c-4235-8045-dec89714d435","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1190","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fab9f76e-570c-4235-8045-dec89714d435","modified":"2026-07-31T18:47:54.223Z","references":[{"source_name":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}