{"record":{"id":"ATTACK:enterprise:T1490","title":"Inhibit System Recovery","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1490","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a","external_id":"T1490","domain":"enterprise","created":"2019-04-02T13:54:43.136Z","modified":"2026-05-12T15:12:00.724Z","version":"1.6","aliases":[],"tactics":["impact"],"source_references":[{"source_name":"Dark Reading Code Spaces Cyber Attack","url":"https://www.darkreading.com/attacks-breaches/code-hosting-service-shuts-down-after-cyber-attack"},{"source_name":"FireEye WannaCry 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"},{"source_name":"Cybereason","url":"https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware"},{"source_name":"Talos Olympic Destroyer 2018","url":"https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"},{"source_name":"Diskshadow","url":"https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow"},{"source_name":"Crytox Ransomware","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware"},{"source_name":"Rhino Security Labs AWS S3 Ransomware","url":"https://rhinosecuritylabs.com/aws/s3-ransomware-part-2-prevention-and-defense/"},{"source_name":"ZDNet Ransomware Backups 2020","url":"https://www.zdnet.com/article/ransomware-victims-thought-their-backups-were-safe-they-were-wrong/"},{"source_name":"disable_notif_synology_ransom","url":"https://x.com/TheDFIRReport/status/1498657590259109894"}]},"assertions":[{"id":"enterprise:relationship--003071c1-a640-4f29-8405-a3998dfaf11f","subject":"ATTACK:enterprise:G1051","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--003071c1-a640-4f29-8405-a3998dfaf11f","modified":"2026-07-31T18:48:09.932Z","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0260e86a-488e-4307-a467-2ccabf430212","subject":"ATTACK:enterprise:S1070","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0260e86a-488e-4307-a467-2ccabf430212","modified":"2026-04-29T14:23:05.906Z","references":[{"source_name":"Avertium Black Basta June 2022","url":"https://www.avertium.com/resources/threat-reports/in-depth-look-at-black-basta-ransomware"},{"source_name":"Check Point Black Basta October 2022","url":"https://research.checkpoint.com/2022/black-basta-and-the-unnoticed-delivery/"},{"source_name":"Cyble Black Basta May 2022","url":"https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/"},{"source_name":"Palo Alto Networks Black Basta August 2022","url":"https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware"},{"source_name":"Trend Micro Black Basta May 2022","url":"https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html"},{"source_name":"NCC Group Black Basta June 2022","url":"https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/"},{"source_name":"Trend Micro Black Basta Spotlight September 2022","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbasta"},{"source_name":"Deep Instinct Black Basta August 2022","url":"https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence"},{"source_name":"Minerva Labs Black Basta May 2022","url":"https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--06dd311f-393f-4c24-beee-19d690ae4ba2","subject":"ATTACK:enterprise:S0481","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--06dd311f-393f-4c24-beee-19d690ae4ba2","modified":"2026-04-29T14:23:05.913Z","references":[{"source_name":"Sophos Ragnar May 2020","url":"https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0e9818a5-90ec-4b12-a6e2-20188d78a69f","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0e9818a5-90ec-4b12-a6e2-20188d78a69f","modified":"2026-04-29T14:23:05.923Z","references":[{"source_name":"ESET InvisiMole June 2018","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1a549ce9-124b-4a88-997f-c52b3a39a6bc","subject":"ATTACK:enterprise:G1053","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1a549ce9-124b-4a88-997f-c52b3a39a6bc","modified":"2026-07-31T18:48:03.543Z","references":[{"source_name":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--26fe80fc-b6ec-4ca0-8693-d61e63901af3","subject":"ATTACK:enterprise:S1162","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--26fe80fc-b6ec-4ca0-8693-d61e63901af3","modified":"2026-04-29T14:23:05.958Z","references":[{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2781807b-4dd7-4bd7-b453-bd258bc375ee","subject":"ATTACK:enterprise:S0612","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2781807b-4dd7-4bd7-b453-bd258bc375ee","modified":"2026-04-29T14:23:05.959Z","references":[{"source_name":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"},{"source_name":"NCC Group WastedLocker June 2020","url":"https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/"},{"source_name":"Sentinel Labs WastedLocker July 2020","url":"https://www.sentinelone.com/labs/wastedlocker-ransomware-abusing-ads-and-ntfs-file-attributes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2d090e9d-f9fb-4f73-99df-0e17a7489adb","subject":"ATTACK:enterprise:S0132","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2d090e9d-f9fb-4f73-99df-0e17a7489adb","modified":"2026-04-29T14:23:05.966Z","references":[{"source_name":"Cisco H1N1 Part 2","url":"https://web.archive.org/web/20231210122239/https://blogs.cisco.com/security/h1n1-technical-analysis-reveals-new-capabilities-part-2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f5583d9-e0bf-4d76-ad74-6d9bd3efa69c","subject":"ATTACK:enterprise:S0400","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f5583d9-e0bf-4d76-ad74-6d9bd3efa69c","modified":"2026-04-29T14:23:05.971Z","references":[{"source_name":"CarbonBlack RobbinHood May 2019","url":"https://www.carbonblack.com/2019/05/17/cb-tau-threat-intelligence-notification-robbinhood-ransomware-stops-181-windows-services-before-encryption/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3194fa27-46b8-4a05-8d3a-12d7bfe9ad15","subject":"ATTACK:enterprise:S0446","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3194fa27-46b8-4a05-8d3a-12d7bfe9ad15","modified":"2026-04-29T14:23:05.981Z","references":[{"source_name":"CrowdStrike Ryuk January 2019","url":"https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--331e8ea2-15c4-4cba-8a26-163b24d819b7","subject":"ATTACK:enterprise:S0673","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--331e8ea2-15c4-4cba-8a26-163b24d819b7","modified":"2026-04-29T14:23:05.986Z","references":[{"source_name":"Prevailion DarkWatchman 2021","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3924f0e4-f79b-4804-87d5-57df4ceddb95","subject":"ATTACK:enterprise:S1244","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3924f0e4-f79b-4804-87d5-57df4ceddb95","modified":"2026-04-29T14:23:05.998Z","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4238bdb9-71ad-413f-a2fa-4c090ed4c469","subject":"ATTACK:enterprise:S0605","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4238bdb9-71ad-413f-a2fa-4c090ed4c469","modified":"2026-04-29T14:23:06.015Z","references":[{"source_name":"Dragos EKANS","url":"https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"},{"source_name":"Palo Alto Unit 42 EKANS","url":"https://unit42.paloaltonetworks.com/threat-assessment-ekans-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--46a953d5-132d-4748-aa5d-7950103e684d","subject":"ATTACK:enterprise:S1139","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--46a953d5-132d-4748-aa5d-7950103e684d","modified":"2026-06-12T19:52:54.217Z","references":[{"source_name":"Cybereason INC Ransomware November 2023","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--48c9c2f3-9358-4342-88b7-57c8e5df893b","subject":"ATTACK:enterprise:S0576","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--48c9c2f3-9358-4342-88b7-57c8e5df893b","modified":"2026-04-29T14:23:06.024Z","references":[{"source_name":"IBM MegaCortex","url":"https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4e7966c2-7ac7-4959-8ee0-dfc6d812e000","subject":"ATTACK:enterprise:S0616","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4e7966c2-7ac7-4959-8ee0-dfc6d812e000","modified":"2026-04-29T14:23:06.032Z","references":[{"source_name":"FireEye FiveHands April 2021","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5364714b-0c15-4453-9b09-7fcca3d3db01","subject":"ATTACK:enterprise:S1073","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5364714b-0c15-4453-9b09-7fcca3d3db01","modified":"2026-04-29T14:23:06.039Z","references":[{"source_name":"CISA Royal AA23-061A March 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a"},{"source_name":"Cybereason Royal December 2022","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"},{"source_name":"Kroll Royal Deep Dive February 2023","url":"https://www.kroll.com/en/insights/publications/cyber/royal-ransomware-deep-dive"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--56aabb26-2bc3-428e-b8ea-ed69a2ea80e7","subject":"ATTACK:enterprise:S1181","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--56aabb26-2bc3-428e-b8ea-ed69a2ea80e7","modified":"2026-04-29T14:23:06.043Z","references":[{"source_name":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5b8d22c5-f191-4dc3-a4ee-04c7d8b799da","subject":"ATTACK:enterprise:S0640","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5b8d22c5-f191-4dc3-a4ee-04c7d8b799da","modified":"2026-04-29T14:23:06.050Z","references":[{"source_name":"Hornet Security Avaddon June 2020","url":"https://www.hornetsecurity.com/en/security-information/avaddon-from-seeking-affiliates-to-in-the-wild-in-2-days/"},{"source_name":"Arxiv Avaddon Feb 2021","url":"https://arxiv.org/pdf/2102.04796.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5f58daef-b978-4b88-957c-ef981ca26fca","subject":"ATTACK:enterprise:G1055","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5f58daef-b978-4b88-957c-ef981ca26fca","modified":"2026-07-31T18:48:25.587Z","references":[{"source_name":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--61b0b64f-da02-4f36-949e-016b83fa747f","subject":"ATTACK:enterprise:S1058","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--61b0b64f-da02-4f36-949e-016b83fa747f","modified":"2026-04-29T14:23:06.058Z","references":[{"source_name":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--650ae259-991e-4d54-a173-cc12e31ead50","subject":"ATTACK:enterprise:S1111","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--650ae259-991e-4d54-a173-cc12e31ead50","modified":"2026-04-29T14:23:06.062Z","references":[{"source_name":"Ensilo Darkgate 2018","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ac34520-de4a-4033-92a4-52d7463592b9","subject":"ATTACK:enterprise:S0697","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ac34520-de4a-4033-92a4-52d7463592b9","modified":"2026-04-29T14:23:06.070Z","references":[{"source_name":"Qualys Hermetic Wiper March 2022","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware"},{"source_name":"ESET Hermetic Wizard March 2022","url":"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"},{"source_name":"Crowdstrike DriveSlayer February 2022","url":"https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--76d0be57-e439-4640-b26d-db422353d9e5","subject":"ATTACK:enterprise:S0366","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--76d0be57-e439-4640-b26d-db422353d9e5","modified":"2026-04-29T14:23:06.088Z","references":[{"source_name":"FireEye WannaCry 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"},{"source_name":"SecureWorks WannaCry Analysis","url":"https://www.secureworks.com/research/wcry-ransomware-analysis"},{"source_name":"LogRhythm WannaCry","url":"https://web.archive.org/web/20230522041200/https://logrhythm.com/blog/a-technical-analysis-of-wannacry-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--76fbcff9-f756-47d7-8a86-8bb8dc748433","subject":"ATTACK:enterprise:S1247","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--76fbcff9-f756-47d7-8a86-8bb8dc748433","modified":"2026-04-29T14:23:06.088Z","references":[{"source_name":"Cyble Embargo Ransomware May 2024","url":"https://cyble.com/blog/the-rust-revolution-new-embargo-ransomware-steps-in/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--773fc200-e44d-4049-b972-043c1e3d9035","subject":"ATTACK:enterprise:G0102","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--773fc200-e44d-4049-b972-043c1e3d9035","modified":"2026-07-31T20:48:50.307Z","references":[{"source_name":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--813370e8-ec26-4533-b8e2-39474edb7006","subject":"ATTACK:enterprise:S0638","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--813370e8-ec26-4533-b8e2-39474edb7006","modified":"2026-04-29T14:23:06.102Z","references":[{"source_name":"Sogeti CERT ESEC Babuk March 2021","url":"https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf"},{"source_name":"McAfee Babuk February 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--833e14f8-0f37-488a-a67c-3ff2fe524ac3","subject":"ATTACK:enterprise:S0570","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--833e14f8-0f37-488a-a67c-3ff2fe524ac3","modified":"2026-04-29T14:23:06.105Z","references":[{"source_name":"Crowdstrike Indrik November 2018","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--84a5d9d6-1ec6-4064-be95-b69de01c578b","subject":"ATTACK:enterprise:S1180","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--84a5d9d6-1ec6-4064-be95-b69de01c578b","modified":"2026-04-29T14:23:06.106Z","references":[{"source_name":"Trustwave BlackByte 2021","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--84d34520-0386-4d41-96b6-3350d727150b","subject":"ATTACK:enterprise:S0617","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--84d34520-0386-4d41-96b6-3350d727150b","modified":"2026-04-29T14:23:06.107Z","references":[{"source_name":"FireEye FiveHands April 2021","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--87343ae5-53c9-426c-abab-602c8041dafe","subject":"ATTACK:enterprise:S0457","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--87343ae5-53c9-426c-abab-602c8041dafe","modified":"2026-04-29T14:23:06.110Z","references":[{"source_name":"TrendMicro Netwalker May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/"},{"source_name":"Sophos Netwalker May 2020","url":"https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8ab39b8c-44af-4ec5-ab8e-1a94142a2f7b","subject":"ATTACK:enterprise:G1043","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8ab39b8c-44af-4ec5-ab8e-1a94142a2f7b","modified":"2026-07-31T18:47:36.234Z","references":[{"source_name":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"Symantec BlackByte 2022","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9104be87-33ad-4a35-96db-3e2ed5c17f46","subject":"ATTACK:enterprise:M1038","predicate":"mitigates","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9104be87-33ad-4a35-96db-3e2ed5c17f46","modified":"2026-04-29T14:23:06.123Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--999097f3-7fe8-425f-a9cc-81ee310e05f1","subject":"ATTACK:enterprise:S1212","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--999097f3-7fe8-425f-a9cc-81ee310e05f1","modified":"2026-04-29T14:23:06.134Z","references":[{"source_name":"Group-IB RansomHub FEB 2025","url":"https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"},{"source_name":"CISA RansomHub AUG 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-242a-stopransomware-ransomhub-ransomware_1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9a91c3cf-b39d-470f-85fc-14bbebe39e98","subject":"ATTACK:enterprise:S0618","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9a91c3cf-b39d-470f-85fc-14bbebe39e98","modified":"2026-04-29T14:23:06.136Z","references":[{"source_name":"FireEye FiveHands April 2021","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"},{"source_name":"CISA AR21-126A FIVEHANDS May 2021","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9e22871c-2e16-4c81-903c-e081c140f7a2","subject":"ATTACK:enterprise:S0575","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9e22871c-2e16-4c81-903c-e081c140f7a2","modified":"2026-04-29T14:23:06.141Z","references":[{"source_name":"CarbonBlack Conti July 2020","url":"https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a831f997-d585-4e17-9342-7f9100edf6fb","subject":"ATTACK:enterprise:C0063","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a831f997-d585-4e17-9342-7f9100edf6fb","modified":"2026-07-31T20:48:19.884Z","references":[{"source_name":"CERT Polska","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aeb5cdda-6344-4048-9b41-a0e0e75ef099","subject":"ATTACK:enterprise:S1129","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aeb5cdda-6344-4048-9b41-a0e0e75ef099","modified":"2026-04-29T14:23:06.163Z","references":[{"source_name":"CISA Akira Ransomware APR 2024","url":"https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf"},{"source_name":"Kersten Akira 2023","url":"https://www.trellix.com/blogs/research/akira-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b2426c20-11cd-4211-a251-4c8e5980fe82","subject":"ATTACK:enterprise:S9051","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b2426c20-11cd-4211-a251-4c8e5980fe82","modified":"2026-09-30T20:24:27.300Z","references":[{"source_name":"BradyUnit42_TheGentlemen_July2026","url":"https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/"},{"source_name":"CheckPointResearch_TheGentlemen_April2026","url":"https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"},{"source_name":"MSTI_GentelmenRansomware_May2026","url":"https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"},{"source_name":"TrendAI_TheGentlemen_Sept2025","url":"https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bc733ee6-f441-42b1-a201-9ff84e0f522c","subject":"ATTACK:enterprise:S0611","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bc733ee6-f441-42b1-a201-9ff84e0f522c","modified":"2026-04-29T14:23:06.182Z","references":[{"source_name":"Mcafee Clop Aug 2019","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bf0a21c1-6549-4137-b05a-ae66b2764209","subject":"ATTACK:enterprise:S1135","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bf0a21c1-6549-4137-b05a-ae66b2764209","modified":"2026-04-29T14:23:06.186Z","references":[{"source_name":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4cd9acb-aaea-4b77-890e-f153a58623a4","subject":"ATTACK:enterprise:M1028","predicate":"mitigates","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4cd9acb-aaea-4b77-890e-f153a58623a4","modified":"2026-04-29T14:23:06.194Z","references":[{"source_name":"reagentc_cmd","url":"https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/reagentc-command-line-options?view=windows-11"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cbd8ee31-9b73-40b7-b054-3620a29b021f","subject":"ATTACK:enterprise:G1015","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cbd8ee31-9b73-40b7-b054-3620a29b021f","modified":"2026-07-31T20:48:34.454Z","references":[{"source_name":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cd38ce72-655d-40f5-afbc-5a9ad0624a6a","subject":"ATTACK:enterprise:S0688","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cd38ce72-655d-40f5-afbc-5a9ad0624a6a","modified":"2026-04-29T14:23:06.206Z","references":[{"source_name":"Check Point Meteor Aug 2021","url":"https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d62f97e9-2b94-44d9-88db-99f849a804ec","subject":"ATTACK:enterprise:M1018","predicate":"mitigates","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d62f97e9-2b94-44d9-88db-99f849a804ec","modified":"2026-04-29T14:23:06.218Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d6dcaa34-12d9-45f3-8f7b-397c2da0995a","subject":"ATTACK:enterprise:S0583","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d6dcaa34-12d9-45f3-8f7b-397c2da0995a","modified":"2026-04-29T14:23:06.219Z","references":[{"source_name":"CERT-FR PYSA April 2020","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2020-CTI-003.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d84bb8c3-7a8c-4dfb-bad4-a6d5b401b6a7","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d84bb8c3-7a8c-4dfb-bad4-a6d5b401b6a7","modified":"2026-07-31T20:48:33.300Z","references":[{"source_name":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e2b49348-8590-42a9-8b38-871c2eb3ada1","subject":"ATTACK:enterprise:S0608","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e2b49348-8590-42a9-8b38-871c2eb3ada1","modified":"2026-04-29T14:23:06.234Z","references":[{"source_name":"SANS Conficker","url":"https://web.archive.org/web/20200125132645/https://www.sans.org/security-resources/malwarefaq/conficker-worm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e4c2c54e-3980-45a4-92cb-c0d99bc0a428","subject":"ATTACK:enterprise:S0365","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e4c2c54e-3980-45a4-92cb-c0d99bc0a428","modified":"2026-04-29T14:23:06.237Z","references":[{"source_name":"Talos Olympic Destroyer 2018","url":"https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e8924eab-e270-43ed-8d7b-8e14cb739720","subject":"ATTACK:enterprise:S0496","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e8924eab-e270-43ed-8d7b-8e14cb739720","modified":"2026-04-29T14:23:06.242Z","references":[{"source_name":"Talos Sodinokibi April 2019","url":"https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html"},{"source_name":"Secureworks REvil September 2019","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"},{"source_name":"Cylance Sodinokibi July 2019","url":"https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"},{"source_name":"Intel 471 REvil March 2020","url":"https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"},{"source_name":"Kaspersky Sodin July 2019","url":"https://securelist.com/sodin-ransomware/91473/"},{"source_name":"McAfee Sodinokibi October 2019","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"},{"source_name":"Picus Sodinokibi January 2020","url":"https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware"},{"source_name":"Secureworks GandCrab and REvil September 2019","url":"https://www.secureworks.com/blog/revil-the-gandcrab-connection"},{"source_name":"Tetra Defense Sodinokibi March 2020","url":"https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea32ebd2-9827-43ec-a3d3-f0148fee8ed8","subject":"ATTACK:enterprise:S0449","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea32ebd2-9827-43ec-a3d3-f0148fee8ed8","modified":"2026-04-29T14:23:06.244Z","references":[{"source_name":"McAfee Maze March 2020","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/"},{"source_name":"Sophos Maze VM September 2020","url":"https://news.sophos.com/en-us/2020/09/17/maze-attackers-adopt-ragnar-locker-virtual-machine-technique/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ec0ea37c-cb59-4138-ac0a-ad401b37d5fe","subject":"ATTACK:enterprise:S0659","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ec0ea37c-cb59-4138-ac0a-ad401b37d5fe","modified":"2026-04-29T14:23:06.246Z","references":[{"source_name":"Fortinet Diavol July 2021","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eebb9c93-2d18-4b27-92aa-b7e597c27616","subject":"ATTACK:enterprise:S1242","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eebb9c93-2d18-4b27-92aa-b7e597c27616","modified":"2026-04-29T14:23:06.250Z","references":[{"source_name":"Sophos Qilin MSP APR 2025","url":"https://news.sophos.com/en-us/2025/04/01/sophos-mdr-tracks-ongoing-campaign-by-qilin-affiliates-targeting-screenconnect/"},{"source_name":"Halcyon Qilin.B OCT 2024","url":"https://www.halcyon.ai/blog/new-qilin-b-ransomware-variant-boasts-enhanced-encryption-and-defense-evasion"},{"source_name":"Trend Micro Agenda Ransomware AUG 2022","url":"https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"},{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f074afef-4b9a-474e-b5fd-21143a927d83","subject":"ATTACK:enterprise:S1202","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f074afef-4b9a-474e-b5fd-21143a927d83","modified":"2026-04-29T14:23:06.252Z","references":[{"source_name":"Joint Cybersecurity Advisory LockBit JUN 2023","url":"https://www.cisa.gov/sites/default/files/2023-06/aa23-165a_understanding_TA_LockBit_0.pdf"},{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"},{"source_name":"INCIBE-CERT LockBit MAR 2024","url":"https://www.incibe.es/en/incibe-cert/blog/lockbit-response-and-recovery-actions"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f0c94372-2818-46ff-899c-0c57fe0af46a","subject":"ATTACK:enterprise:S0389","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f0c94372-2818-46ff-899c-0c57fe0af46a","modified":"2026-04-29T14:23:06.252Z","references":[{"source_name":"Carbon Black JCry May 2019","url":"https://www.carbonblack.com/2019/05/14/cb-tau-threat-intelligence-notification-jcry-ransomware-pretends-to-be-adobe-flash-player-update-installer/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f2304e7f-50b3-41cc-81df-5c7baed21b89","subject":"ATTACK:enterprise:S1136","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f2304e7f-50b3-41cc-81df-5c7baed21b89","modified":"2026-04-29T14:23:06.254Z","references":[{"source_name":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f5d844e2-b442-4422-9880-e648ee387d67","subject":"ATTACK:enterprise:S1150","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f5d844e2-b442-4422-9880-e648ee387d67","modified":"2026-04-29T14:23:06.259Z","references":[{"source_name":"CISA Iran Albanian Attacks September 2022","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a"},{"source_name":"Mandiant ROADSWEEP August 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f86ad19e-67a2-453d-8af9-c73a130651a4","subject":"ATTACK:enterprise:S0654","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f86ad19e-67a2-453d-8af9-c73a130651a4","modified":"2026-04-29T14:23:06.262Z","references":[{"source_name":"Group IB Ransomware September 2020","url":"https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f9e62f6d-a091-44a9-91e6-3660b89ba2b9","subject":"ATTACK:enterprise:M1053","predicate":"mitigates","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f9e62f6d-a091-44a9-91e6-3660b89ba2b9","modified":"2026-04-29T14:23:06.264Z","references":[{"source_name":"Unit 42 Palo Alto Ransomware in Public Clouds 2022","url":"https://unit42.paloaltonetworks.com/ransomware-in-public-clouds/"},{"source_name":"Crowdstrike Hypervisor Jackpotting Pt 2 2021","url":"https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/"},{"source_name":"Ready.gov IT DRP","url":"https://www.ready.gov/business/implementation/IT"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fc3e0e8c-d6d3-4f2d-8374-86b7902079a9","subject":"ATTACK:enterprise:S1068","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fc3e0e8c-d6d3-4f2d-8374-86b7902079a9","modified":"2026-04-29T14:23:06.267Z","references":[{"source_name":"Microsoft BlackCat Jun 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fd1a359c-c834-4368-915c-bd278e179d5c","subject":"ATTACK:enterprise:S1199","predicate":"uses","object":"ATTACK:enterprise:T1490","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fd1a359c-c834-4368-915c-bd278e179d5c","modified":"2026-04-29T14:23:06.269Z","references":[{"source_name":"Cybereason Lockbit 2.0","url":"https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom"},{"source_name":"FBI Lockbit 2.0 FEB 2022","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}