{"record":{"id":"ATTACK:enterprise:T1204.001","title":"Malicious Link","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1204/001","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--ef67e13e-5598-4adc-bdb2-998225874fa9","external_id":"T1204.001","domain":"enterprise","created":"2020-03-11T14:43:31.706Z","modified":"2026-09-11T19:19:57.658Z","version":"1.2","aliases":[],"tactics":["execution"],"source_references":[]},"assertions":[{"id":"enterprise:relationship--00561c3c-345e-4578-95c3-b7e0a95db7b1","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--00561c3c-345e-4578-95c3-b7e0a95db7b1","modified":"2026-07-31T20:48:31.662Z","references":[{"source_name":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--036d9e28-e7c4-4865-b964-2ea213274521","subject":"ATTACK:enterprise:G0098","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--036d9e28-e7c4-4865-b964-2ea213274521","modified":"2026-07-31T18:48:01.459Z","references":[{"source_name":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--039373a2-84b0-4780-b3ca-475ce5207a94","subject":"ATTACK:enterprise:C0060","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--039373a2-84b0-4780-b3ca-475ce5207a94","modified":"2026-07-31T18:47:26.723Z","references":[{"source_name":"ESET MirrorFace 2025","url":"https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/"},{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0be595fa-a284-4657-a1bd-9b22e56b6604","subject":"ATTACK:enterprise:S0531","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0be595fa-a284-4657-a1bd-9b22e56b6604","modified":"2026-04-29T14:23:05.919Z","references":[{"source_name":"IBM Grandoreiro April 2020","url":"https://securityintelligence.com/posts/grandoreiro-malware-now-targeting-banks-in-spain/"},{"source_name":"ESET Grandoreiro April 2020","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--17e7193e-6583-4bae-8a17-de75f006cd36","subject":"ATTACK:enterprise:S0534","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--17e7193e-6583-4bae-8a17-de75f006cd36","modified":"2026-04-29T14:23:05.937Z","references":[{"source_name":"Cybereason Bazar July 2020","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"},{"source_name":"Zscaler Bazar September 2020","url":"https://www.zscaler.com/blogs/research/spear-phishing-campaign-delivers-buer-and-bazar-malware"},{"source_name":"CrowdStrike Wizard Spider October 2020","url":"https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1fdcaa51-4445-43be-99eb-52787756fa1c","subject":"ATTACK:enterprise:C0002","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1fdcaa51-4445-43be-99eb-52787756fa1c","modified":"2026-07-31T18:47:30.561Z","references":[{"source_name":"McAfee Night Dragon","url":"https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--218a923b-2909-4186-8cf7-8fbfed6f2aaf","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--218a923b-2909-4186-8cf7-8fbfed6f2aaf","modified":"2026-07-31T18:47:51.766Z","references":[{"source_name":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"Crowdstrike MUSTANG PANDA June 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"McAfee Dianxun March 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--21ebcd72-cb89-4d26-82b7-4d17843034c5","subject":"ATTACK:enterprise:G0021","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--21ebcd72-cb89-4d26-82b7-4d17843034c5","modified":"2026-07-31T18:48:23.542Z","references":[{"source_name":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"},{"source_name":"Unit42 Molerat Mar 2020","url":"https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2332793b-afd0-407b-a1dc-97c5c7580bcb","subject":"ATTACK:enterprise:G0112","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2332793b-afd0-407b-a1dc-97c5c7580bcb","modified":"2026-09-02T18:52:46.913Z","references":[{"source_name":"SANS Windshift August 2018","url":"https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--24caab23-239c-4012-bb62-5b843f1ff767","subject":"ATTACK:enterprise:S1017","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--24caab23-239c-4012-bb62-5b843f1ff767","modified":"2026-04-29T14:23:05.955Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2ba344c1-aa24-4566-9df0-2556363fe8eb","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2ba344c1-aa24-4566-9df0-2556363fe8eb","modified":"2026-07-31T20:48:24.683Z","references":[{"source_name":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f146c3d-5dd4-42e2-a62b-04adcb36485c","subject":"ATTACK:enterprise:G0140","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f146c3d-5dd4-42e2-a62b-04adcb36485c","modified":"2026-07-31T18:48:13.224Z","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f14f601-d732-4770-ab76-a7c99627398e","subject":"ATTACK:enterprise:G0142","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f14f601-d732-4770-ab76-a7c99627398e","modified":"2026-07-31T20:48:37.532Z","references":[{"source_name":"TrendMicro Confucius APT Aug 2021","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--324a3d54-b9e5-4982-825d-87d281c07544","subject":"ATTACK:enterprise:G1031","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--324a3d54-b9e5-4982-825d-87d281c07544","modified":"2026-07-31T18:48:00.337Z","references":[{"source_name":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3445ad37-1738-45c3-aabd-dcc048d2ad2d","subject":"ATTACK:enterprise:C0005","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3445ad37-1738-45c3-aabd-dcc048d2ad2d","modified":"2026-07-31T18:47:22.442Z","references":[{"source_name":"ESET Operation Spalax Jan 2021","url":"https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--387640be-2b25-40c3-9048-f6cb86beab78","subject":"ATTACK:enterprise:C0016","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--387640be-2b25-40c3-9048-f6cb86beab78","modified":"2026-07-31T20:48:14.636Z","references":[{"source_name":"Cylance Dust Storm","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--393317c3-7dd7-487c-a2cb-81dfe4333ea3","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--393317c3-7dd7-487c-a2cb-81dfe4333ea3","modified":"2026-04-29T14:23:05.998Z","references":[{"source_name":"Unit 42 NETWIRE April 2020","url":"https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/"},{"source_name":"FireEye NETWIRE March 2019","url":"https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3c2b63fe-e891-4ac5-a0aa-d02536699614","subject":"ATTACK:enterprise:C0022","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3c2b63fe-e891-4ac5-a0aa-d02536699614","modified":"2026-07-31T21:14:22.532Z","references":[{"source_name":"ESET Lazarus Jun 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf"},{"source_name":"ClearSky Lazarus Aug 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3ce7d771-a246-4b79-839e-2e5670103bbe","subject":"ATTACK:enterprise:G0090","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3ce7d771-a246-4b79-839e-2e5670103bbe","modified":"2026-07-31T20:48:52.420Z","references":[{"source_name":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3de1cc89-ee9a-4476-9d93-a034da6a90bf","subject":"ATTACK:enterprise:S1030","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3de1cc89-ee9a-4476-9d93-a034da6a90bf","modified":"2026-04-29T14:23:06.009Z","references":[{"source_name":"ZScaler Squirrelwaffle Sep 2021","url":"https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f8ae509-18e1-4189-9aa4-2ae649e56a88","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f8ae509-18e1-4189-9aa4-2ae649e56a88","modified":"2026-04-29T14:23:06.011Z","references":[{"source_name":"Group IB Ransomware September 2020","url":"https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"},{"source_name":"Trend Micro Black Basta October 2022","url":"https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"},{"source_name":"Kaspersky QakBot September 2021","url":"https://securelist.com/qakbot-technical-analysis/103931/"},{"source_name":"Trend Micro Qakbot May 2020","url":"https://www.trendmicro.com/vinfo/ph/security/news/cybercrime-and-digital-threats/qakbot-resurges-spreads-through-vbs-files"},{"source_name":"ATT QakBot April 2021","url":"https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"},{"source_name":"Kroll Qakbot June 2020","url":"https://www.kroll.com/en/insights/publications/cyber/qakbot-malware-exfiltrating-emails-thread-hijacking-attacks"},{"source_name":"Trend Micro Qakbot December 2020","url":"https://success.trendmicro.com/en-US/solution/KA-0011282"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3ff580a6-1323-4587-8f64-137e02f148e6","subject":"ATTACK:enterprise:S1160","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3ff580a6-1323-4587-8f64-137e02f148e6","modified":"2026-04-29T14:23:06.012Z","references":[{"source_name":"Bleeping Computer Latrodectus April 2024","url":"https://www.bleepingcomputer.com/news/security/new-latrodectus-malware-attacks-use-microsoft-cloudflare-themes/"},{"source_name":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--471304cd-f98a-49f7-a33e-2d69ab6c8a47","subject":"ATTACK:enterprise:S0499","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--471304cd-f98a-49f7-a33e-2d69ab6c8a47","modified":"2026-04-29T14:23:06.022Z","references":[{"source_name":"Threatpost Hancitor","url":"https://threatpost.com/spammers-revive-hancitor-downloader-campaigns/123011/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4aaa3063-d1b0-4c13-aa6d-829000f05aec","subject":"ATTACK:enterprise:S0528","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4aaa3063-d1b0-4c13-aa6d-829000f05aec","modified":"2026-04-29T14:23:06.027Z","references":[{"source_name":"Securelist Brazilian Banking Malware July 2020","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5458626f-976e-4007-bb93-43a8a69b0ec1","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5458626f-976e-4007-bb93-43a8a69b0ec1","modified":"2026-09-30T20:00:40.391Z","references":[{"source_name":"Microsoft CYBERWARCON NOV 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/11/22/microsoft-shares-latest-intelligence-on-north-korean-and-chinese-threat-actors-at-cyberwarcon/"},{"source_name":"Microsoft Axios Compromise APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"},{"source_name":"MIcrosoft Mastra npm Compromise JUN 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"},{"source_name":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5610e19c-de2e-4b9d-9e10-776e94528b0d","subject":"ATTACK:enterprise:C0021","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5610e19c-de2e-4b9d-9e10-776e94528b0d","modified":"2026-07-31T18:47:24.365Z","references":[{"source_name":"FireEye APT29 Nov 2018","url":"https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5685e636-7ee7-47d2-a179-edcaa9d26938","subject":"ATTACK:enterprise:C0037","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5685e636-7ee7-47d2-a179-edcaa9d26938","modified":"2026-07-31T18:47:23.382Z","references":[{"source_name":"TrendMicro Pikabot 2024","url":"https://www.trendmicro.com/en_us/research/24/a/a-look-into-pikabot-spam-wave-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5969ffbe-edd3-4bb3-aee4-4e73ac9c6a7f","subject":"ATTACK:enterprise:S0649","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5969ffbe-edd3-4bb3-aee4-4e73ac9c6a7f","modified":"2026-04-29T14:23:06.047Z","references":[{"source_name":"FireEye Shining A Light on DARKSIDE May 2021","url":"https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5a374aec-ae82-4c99-bbc2-34c4050a9932","subject":"ATTACK:enterprise:G0061","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5a374aec-ae82-4c99-bbc2-34c4050a9932","modified":"2026-07-31T18:48:29.637Z","references":[{"source_name":"FireEye Obfuscation June 2017","url":"https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"},{"source_name":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source_name":"FireEye Fin8 May 2016","url":"https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6035f6c6-8e6c-4ac6-9467-722502e90799","subject":"ATTACK:enterprise:G1018","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6035f6c6-8e6c-4ac6-9467-722502e90799","modified":"2026-07-31T18:47:55.293Z","references":[{"source_name":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"},{"source_name":"FireEye NETWIRE March 2019","url":"https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--616bf309-ed87-4573-8640-416e6f05285d","subject":"ATTACK:enterprise:G0016","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--616bf309-ed87-4573-8640-416e6f05285d","modified":"2026-07-31T18:48:08.084Z","references":[{"source_name":"MSTIC NOBELIUM May 2021","url":"https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"},{"source_name":"Secureworks IRON RITUAL USAID Phish May 2021","url":"https://www.secureworks.com/blog/usaid-themed-phishing-campaign-leverages-us-elections-lure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--670c1635-4831-491a-be9a-f2a70b5d545c","subject":"ATTACK:enterprise:S9044","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--670c1635-4831-491a-be9a-f2a70b5d545c","modified":"2026-07-31T03:30:04.116Z","references":[{"source_name":"Artic Wolf Labs Kali365 Device Code April 2026","url":"https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/"},{"source_name":"Huntress Kali365 Device Code June 2026","url":"https://www.huntress.com/blog/kali365-device-code-phishing-kit"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--67154159-cd44-4d9c-ae84-c82a8cd5ee58","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--67154159-cd44-4d9c-ae84-c82a8cd5ee58","modified":"2026-07-31T20:48:26.317Z","references":[{"source_name":"Symantec Patchwork","url":"http://www.symantec.com/connect/blogs/patchwork-cyberespionage-group-expands-targets-governments-wide-range-industries"},{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"},{"source_name":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"},{"source_name":"Unit 42 BackConfig May 2020","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--67e3c192-f0f3-4b8d-9fd7-b4200acebd85","subject":"ATTACK:enterprise:G0022","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--67e3c192-f0f3-4b8d-9fd7-b4200acebd85","modified":"2026-07-31T18:47:37.921Z","references":[{"source_name":"FireEye Clandestine Wolf","url":"https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6c0ae1dc-2429-42fd-899e-8aafb9adc50c","subject":"ATTACK:enterprise:G0120","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6c0ae1dc-2429-42fd-899e-8aafb9adc50c","modified":"2026-07-31T18:47:42.479Z","references":[{"source_name":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ebe95eb-909e-460e-b2ff-db0838e2f1e8","subject":"ATTACK:enterprise:S1086","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ebe95eb-909e-460e-b2ff-db0838e2f1e8","modified":"2026-04-29T14:23:06.076Z","references":[{"source_name":"Telefonica Snip3 December 2021","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7194f06c-abd5-4ff8-ad95-2449adaa4c13","subject":"ATTACK:enterprise:M1031","predicate":"mitigates","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7194f06c-abd5-4ff8-ad95-2449adaa4c13","modified":"2026-04-29T14:23:06.080Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--71ee0311-3fdc-4baf-8c3e-2143416b742c","subject":"ATTACK:enterprise:G0092","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--71ee0311-3fdc-4baf-8c3e-2143416b742c","modified":"2026-07-31T18:48:05.571Z","references":[{"source_name":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"},{"source_name":"Proofpoint TA505 June 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times"},{"source_name":"Proofpoint TA505 Jan 2019","url":"https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"},{"source_name":"Cybereason TA505 April 2019","url":"https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware"},{"source_name":"ProofPoint SettingContent-ms July 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-abusing-settingcontent-ms-within-pdf-files-distribute-flawedammyy-rat"},{"source_name":"Proofpoint TA505 Mar 2018","url":"https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware"},{"source_name":"Trend Micro TA505 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"},{"source_name":"Proofpoint TA505 October 2019","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--74244c73-6561-4dcd-b96a-e365c7e21b09","subject":"ATTACK:enterprise:S9026","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--74244c73-6561-4dcd-b96a-e365c7e21b09","modified":"2026-04-29T14:23:06.084Z","references":[{"source_name":"Trend Micro Earth Kasha Updates APR 2025","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--74480cd6-1f2e-4c2d-a1ad-82cc50d63d14","subject":"ATTACK:enterprise:G1014","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--74480cd6-1f2e-4c2d-a1ad-82cc50d63d14","modified":"2026-07-31T18:48:14.849Z","references":[{"source_name":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--754a5c00-45bb-4279-bdd2-ec11d54f2926","subject":"ATTACK:enterprise:S0644","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--754a5c00-45bb-4279-bdd2-ec11d54f2926","modified":"2026-04-29T14:23:06.086Z","references":[{"source_name":"Talos Oblique RAT March 2021","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"},{"source_name":"Talos Transparent Tribe May 2021","url":"https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--77a98e76-5a38-40a8-af9a-180c31bf7563","subject":"ATTACK:enterprise:G0059","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--77a98e76-5a38-40a8-af9a-180c31bf7563","modified":"2026-07-31T18:48:28.664Z","references":[{"source_name":"Certfa Charming Kitten January 2021","url":"https://blog.certfa.com/posts/charming-kitten-christmas-gift/"},{"source_name":"ClearSky Kittens Back 3 August 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--77e0980c-de43-48a8-8df3-b924f8d91b51","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--77e0980c-de43-48a8-8df3-b924f8d91b51","modified":"2026-07-31T18:47:53.756Z","references":[{"source_name":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source_name":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--788a6ca2-60ac-4f36-b708-c3a57f087b2b","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--788a6ca2-60ac-4f36-b708-c3a57f087b2b","modified":"2026-07-31T18:47:44.895Z","references":[{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"},{"source_name":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"},{"source_name":"Amnesty Intl. Ocean Lotus February 2021","url":"https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--78a49769-fec0-4961-a25d-fc5eab623e93","subject":"ATTACK:enterprise:G0103","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--78a49769-fec0-4961-a25d-fc5eab623e93","modified":"2026-07-31T18:48:06.593Z","references":[{"source_name":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7a75776c-22e1-4227-9c7a-8531f9ce6c5e","subject":"ATTACK:enterprise:S1138","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7a75776c-22e1-4227-9c7a-8531f9ce6c5e","modified":"2026-04-29T14:23:06.093Z","references":[{"source_name":"SentinelOne Gootloader June 2021","url":"https://www.sentinelone.com/labs/gootloader-initial-access-as-a-service-platform-expands-its-search-for-high-value-targets/"},{"source_name":"Sophos Gootloader","url":"https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7bda4cc5-09d8-4e0e-87af-f33cdb7a63d1","subject":"ATTACK:enterprise:C0011","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7bda4cc5-09d8-4e0e-87af-f33cdb7a63d1","modified":"2026-07-31T18:47:31.410Z","references":[{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--822c5044-906d-4c4f-b350-49471beb03a8","subject":"ATTACK:enterprise:G0085","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--822c5044-906d-4c4f-b350-49471beb03a8","modified":"2026-07-31T20:48:48.764Z","references":[{"source_name":"FireEye Hacking FIN4 Video Dec 2014","url":"https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"},{"source_name":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86a6b769-470e-4aa4-a285-2559af72a21b","subject":"ATTACK:enterprise:G1039","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86a6b769-470e-4aa4-a285-2559af72a21b","modified":"2026-07-31T18:48:06.298Z","references":[{"source_name":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8769bb08-b5e3-4264-95ac-6164bdbd54f3","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8769bb08-b5e3-4264-95ac-6164bdbd54f3","modified":"2026-07-31T20:48:33.050Z","references":[{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--89672463-a201-43c7-a24a-1e6d7a1a188a","subject":"ATTACK:enterprise:G0066","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--89672463-a201-43c7-a24a-1e6d7a1a188a","modified":"2026-07-31T18:47:36.004Z","references":[{"source_name":"CSM Elderwood Sept 2012","url":"https://www.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-two-huge-cyber-gangs-in-China"},{"source_name":"Symantec Elderwood Sept 2012","url":"https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8be8b96b-b69c-497a-8b38-308b8bd291ff","subject":"ATTACK:enterprise:G0010","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8be8b96b-b69c-497a-8b38-308b8bd291ff","modified":"2026-07-31T18:48:04.118Z","references":[{"source_name":"ESET Turla Mosquito Jan 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8e575d01-2a20-4718-b95c-f9af3a200da0","subject":"ATTACK:enterprise:G1038","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8e575d01-2a20-4718-b95c-f9af3a200da0","modified":"2026-07-31T18:48:12.315Z","references":[{"source_name":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8f8d7305-96e8-46c9-8fb9-1a1b85c8fbe5","subject":"ATTACK:enterprise:S1242","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8f8d7305-96e8-46c9-8fb9-1a1b85c8fbe5","modified":"2026-04-29T14:23:06.121Z","references":[{"source_name":"Sophos Qilin MSP APR 2025","url":"https://news.sophos.com/en-us/2025/04/01/sophos-mdr-tracks-ongoing-campaign-by-qilin-affiliates-targeting-screenconnect/"},{"source_name":"SentinelOne Qilin NOV 2022","url":"https://www.sentinelone.com/anthology/agenda-qilin/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8fd50d9a-0d3e-4433-a2b9-b9e0ae3621f7","subject":"ATTACK:enterprise:G1034","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8fd50d9a-0d3e-4433-a2b9-b9e0ae3621f7","modified":"2026-07-31T18:48:27.081Z","references":[{"source_name":"ESET EvasivePanda 2024","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--90b7c9e6-53db-4656-a5ee-f8056a8d6ef7","subject":"ATTACK:enterprise:S0367","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--90b7c9e6-53db-4656-a5ee-f8056a8d6ef7","modified":"2026-04-29T14:23:06.122Z","references":[{"source_name":"Trend Micro Banking Malware Jan 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-banking-malware-uses-network-sniffing-for-data-theft/"},{"source_name":"Carbon Black Emotet Apr 2019","url":"https://www.carbonblack.com/2019/04/24/cb-tau-threat-intelligence-notification-emotet-utilizing-wmi-to-launch-powershell-encoded-code/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--952edf61-e906-4ab5-989f-1d6a5dd95dce","subject":"ATTACK:enterprise:G0049","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--952edf61-e906-4ab5-989f-1d6a5dd95dce","modified":"2026-07-31T20:48:35.676Z","references":[{"source_name":"ClearSky OilRig Jan 2017","url":"http://www.clearskysec.com/oilrig/"},{"source_name":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"},{"source_name":"Unit 42 QUADAGENT July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"},{"source_name":"Crowdstrike Helix Kitten Nov 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9730ebe6-78b7-4dbf-93f4-add720033985","subject":"ATTACK:enterprise:G0047","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9730ebe6-78b7-4dbf-93f4-add720033985","modified":"2026-07-31T18:47:47.822Z","references":[{"source_name":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source_name":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--988fda8d-8374-4ff7-b70c-f2a654442808","subject":"ATTACK:enterprise:G1011","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--988fda8d-8374-4ff7-b70c-f2a654442808","modified":"2026-07-31T18:47:38.845Z","references":[{"source_name":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9c7833f5-6e00-4118-9f9d-c7f23e1c8857","subject":"ATTACK:enterprise:G0099","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9c7833f5-6e00-4118-9f9d-c7f23e1c8857","modified":"2026-07-31T18:48:18.610Z","references":[{"source_name":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9c8cf20d-b834-4460-a8a8-13d96c19d2ea","subject":"ATTACK:enterprise:G0080","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9c8cf20d-b834-4460-a8a8-13d96c19d2ea","modified":"2026-07-31T18:48:23.218Z","references":[{"source_name":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source_name":"Unit 42 Cobalt Gang Oct 2018","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"},{"source_name":"Secureworks GOLD KINGSWOOD September 2018","url":"https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a0b2b4b4-c522-4428-a70b-ad1002417a28","subject":"ATTACK:enterprise:S0453","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a0b2b4b4-c522-4428-a70b-ad1002417a28","modified":"2026-04-29T14:23:06.144Z","references":[{"source_name":"Malwarebytes Pony April 2016","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a5a1488d-2028-4132-9aef-2e6da56ffca0","subject":"ATTACK:enterprise:G1059","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a5a1488d-2028-4132-9aef-2e6da56ffca0","modified":"2026-10-01T21:10:26.590Z","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"},{"source_name":"CheckPoint_NimbusManticore_May2026","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"},{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"},{"source_name":"Mandiant_UNC1549_Feb2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a63bc24e-2b10-46bc-a9a5-992701755923","subject":"ATTACK:enterprise:S1124","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a63bc24e-2b10-46bc-a9a5-992701755923","modified":"2026-04-29T14:23:06.151Z","references":[{"source_name":"SocGholish-update","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a77818b1-bbe8-477f-a8b1-1704e525d5a9","subject":"ATTACK:enterprise:S0435","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a77818b1-bbe8-477f-a8b1-1704e525d5a9","modified":"2026-04-29T14:23:06.153Z","references":[{"source_name":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ad8fcad2-fe74-4795-b369-eb669c75b9b5","subject":"ATTACK:enterprise:S0669","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ad8fcad2-fe74-4795-b369-eb669c75b9b5","modified":"2026-04-29T14:23:06.161Z","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aeffbd1d-a962-492a-a6bf-670b70f01abb","subject":"ATTACK:enterprise:G0128","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aeffbd1d-a962-492a-a6bf-670b70f01abb","modified":"2026-07-31T18:47:52.458Z","references":[{"source_name":"Google Election Threats October 2020","url":"https://blog.google/threat-analysis-group/how-were-tackling-evolving-online-threats/"},{"source_name":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b4824825-f732-44d9-a088-3ce222c0f751","subject":"ATTACK:enterprise:G0134","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b4824825-f732-44d9-a088-3ce222c0f751","modified":"2026-07-31T18:48:24.306Z","references":[{"source_name":"Talos Oblique RAT March 2021","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"},{"source_name":"Talos Transparent Tribe May 2021","url":"https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b5372961-d931-497e-8043-1bfa446f65d6","subject":"ATTACK:enterprise:S0646","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b5372961-d931-497e-8043-1bfa446f65d6","modified":"2026-04-29T14:23:06.173Z","references":[{"source_name":"Secureworks GOLD KINGSWOOD September 2018","url":"https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b6fa5f7f-1055-4a9a-8372-d281fd6ca4af","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b6fa5f7f-1055-4a9a-8372-d281fd6ca4af","modified":"2026-07-31T20:48:30.130Z","references":[{"source_name":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"},{"source_name":"Proofpoint TA450 Phishing March 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign"},{"source_name":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b9711cc5-0d30-403c-8ff7-92e2a21e1905","subject":"ATTACK:enterprise:G1052","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b9711cc5-0d30-403c-8ff7-92e2a21e1905","modified":"2026-07-31T18:47:54.801Z","references":[{"source_name":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b9dcab92-6b0d-43c7-a122-90eccb016b9d","subject":"ATTACK:enterprise:G0102","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b9dcab92-6b0d-43c7-a122-90eccb016b9d","modified":"2026-07-31T20:48:50.466Z","references":[{"source_name":"DHS/CISA Ransomware Targeting Healthcare October 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ba79589f-f4e2-497b-b25b-a6a0abf3eedd","subject":"ATTACK:enterprise:S0561","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ba79589f-f4e2-497b-b25b-a6a0abf3eedd","modified":"2026-04-29T14:23:06.179Z","references":[{"source_name":"Unit 42 NETWIRE April 2020","url":"https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ba84c2c2-e5bf-432e-9827-6d622490ba2d","subject":"ATTACK:enterprise:G0095","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ba84c2c2-e5bf-432e-9827-6d622490ba2d","modified":"2026-07-31T18:47:49.964Z","references":[{"source_name":"Cylance Machete Mar 2017","url":"https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"},{"source_name":"Securelist Machete Aug 2014","url":"https://securelist.com/el-machete/66108/"},{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bbeb5b3a-3533-4252-9c81-3cc027ba8b20","subject":"ATTACK:enterprise:S9050","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bbeb5b3a-3533-4252-9c81-3cc027ba8b20","modified":"2026-09-28T17:54:51.991Z","references":[{"source_name":"Intrinsec_Vidar_April2026","url":"https://www.intrinsec.com/wp-content/uploads/2026/04/TLP_CLEAR-20260424-New_Vidar.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4600507-03d9-471f-a175-d5fd3953c0c6","subject":"ATTACK:enterprise:S1039","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4600507-03d9-471f-a175-d5fd3953c0c6","modified":"2026-04-29T14:23:06.193Z","references":[{"source_name":"Cybereason Bumblebee August 2022","url":"https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control"},{"source_name":"Proofpoint Bumblebee April 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c809e1ba-e97b-41bf-a704-26fe09b6235c","subject":"ATTACK:enterprise:G1020","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c809e1ba-e97b-41bf-a704-26fe09b6235c","modified":"2026-07-31T18:47:37.903Z","references":[{"source_name":"SocGholish-update","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"},{"source_name":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ce39dc03-c3aa-4c6b-9edb-c05c3b934cbd","subject":"ATTACK:enterprise:T1204.001","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1204","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ce39dc03-c3aa-4c6b-9edb-c05c3b934cbd","modified":"2026-04-29T14:23:06.207Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d15c7116-2d00-48cd-9003-1ab6fc4a0076","subject":"ATTACK:enterprise:S0436","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d15c7116-2d00-48cd-9003-1ab6fc4a0076","modified":"2026-04-29T14:23:06.212Z","references":[{"source_name":"JPCert TSCookie March 2018","url":"https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d2ea2645-1940-4776-a874-09309f75636a","subject":"ATTACK:enterprise:G0121","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d2ea2645-1940-4776-a874-09309f75636a","modified":"2026-07-31T18:47:52.134Z","references":[{"source_name":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source_name":"Rewterz Sidewinder APT April 2020","url":"https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis"},{"source_name":"Rewterz Sidewinder COVID-19 June 2020","url":"https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19"},{"source_name":"Cyble Sidewinder September 2020","url":"https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d38b5509-0587-4128-b18c-123fade07f3a","subject":"ATTACK:enterprise:S0530","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d38b5509-0587-4128-b18c-123fade07f3a","modified":"2026-04-29T14:23:06.214Z","references":[{"source_name":"Securelist Brazilian Banking Malware July 2020","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d7af8f20-9581-4b41-a591-118842f8ba6e","subject":"ATTACK:enterprise:G0007","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d7af8f20-9581-4b41-a591-118842f8ba6e","modified":"2026-07-31T20:48:45.183Z","references":[{"source_name":"US District Court Indictment GRU Oct 2018","url":"https://www.justice.gov/opa/page/file/1098481/download"},{"source_name":"Secureworks IRON TWILIGHT Active Measures March 2017","url":"https://www.secureworks.com/research/iron-twilight-supports-active-measures"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dc7ab03a-ba08-4a79-9b5d-c0c38aa14577","subject":"ATTACK:enterprise:G1037","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dc7ab03a-ba08-4a79-9b5d-c0c38aa14577","modified":"2026-07-31T18:47:38.790Z","references":[{"source_name":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--de9a5ad0-b680-493d-9aeb-95070d003033","subject":"ATTACK:enterprise:G1035","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--de9a5ad0-b680-493d-9aeb-95070d003033","modified":"2026-07-31T18:48:03.325Z","references":[{"source_name":"CERT-UA WinterVivern 2023","url":"https://cert.gov.ua/article/3761104"},{"source_name":"SentinelOne WinterVivern 2023","url":"https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df82dc71-a168-4af3-9526-8449400777dc","subject":"ATTACK:enterprise:M1017","predicate":"mitigates","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df82dc71-a168-4af3-9526-8449400777dc","modified":"2026-04-29T14:23:06.230Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e37c2e11-8b96-4a9a-bc94-2995f54135dd","subject":"ATTACK:enterprise:M1021","predicate":"mitigates","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e37c2e11-8b96-4a9a-bc94-2995f54135dd","modified":"2026-04-29T14:23:06.235Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e733d4b5-0881-4de8-9461-58ca239b7c82","subject":"ATTACK:enterprise:S0585","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e733d4b5-0881-4de8-9461-58ca239b7c82","modified":"2026-04-29T14:23:06.240Z","references":[{"source_name":"Amnesty Intl. Ocean Lotus February 2021","url":"https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e877f75e-4b57-4328-a17c-a7c46929ae84","subject":"ATTACK:enterprise:S1018","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e877f75e-4b57-4328-a17c-a7c46929ae84","modified":"2026-04-29T14:23:06.241Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--efcd3e1b-d17b-4c7f-97fd-b438ebef6760","subject":"ATTACK:enterprise:S0475","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--efcd3e1b-d17b-4c7f-97fd-b438ebef6760","modified":"2026-04-29T14:23:06.251Z","references":[{"source_name":"Unit 42 BackConfig May 2020","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f6cd8be3-3145-4088-ae9d-d006be865c01","subject":"ATTACK:enterprise:G0064","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f6cd8be3-3145-4088-ae9d-d006be865c01","modified":"2026-07-31T20:48:53.337Z","references":[{"source_name":"FireEye APT33 Sept 2017","url":"https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"},{"source_name":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f81ae9dc-3299-480f-817c-a5b65cfc38d7","subject":"ATTACK:enterprise:G0065","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f81ae9dc-3299-480f-817c-a5b65cfc38d7","modified":"2026-07-31T20:48:38.508Z","references":[{"source_name":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"},{"source_name":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f9a79b10-7ed6-40be-be49-693c530717b0","subject":"ATTACK:enterprise:C0047","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f9a79b10-7ed6-40be-be49-693c530717b0","modified":"2026-07-31T18:47:19.896Z","references":[{"source_name":"Recorded Future RedDelta 2025","url":"https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fbe555c3-5c7b-44e7-a48f-293bdae9de0c","subject":"ATTACK:enterprise:S0584","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fbe555c3-5c7b-44e7-a48f-293bdae9de0c","modified":"2026-04-29T14:23:06.267Z","references":[{"source_name":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fff3195c-ef40-4e11-b0f3-f1a849b2b316","subject":"ATTACK:enterprise:G1006","predicate":"uses","object":"ATTACK:enterprise:T1204.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fff3195c-ef40-4e11-b0f3-f1a849b2b316","modified":"2026-07-31T20:48:48.471Z","references":[{"source_name":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}