Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference.
{
  "record": {
    "id": "ATTACK:enterprise:T1518.001",
    "title": "Security Software Discovery",
    "type": "Subtechnique",
    "source_url": "https://attack.mitre.org/techniques/T1518/001",
    "snapshot": "enterprise-attack-20.0.json",
    "status": "active",
    "rights": "Source metadata only; source notices retained; no operational prose or payloads",
    "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
    "stix_id": "attack-pattern--cba37adb-d6fb-4610-b069-dd04c0643384",
    "external_id": "T1518.001",
    "domain": "enterprise",
    "created": "2020-02-21T21:16:18.066Z",
    "modified": "2026-05-12T15:12:00.716Z",
    "version": "1.5",
    "aliases": [

    ],
    "tactics": [
      "discovery"
    ],
    "source_references": [

    ]
  },
  "assertions": [
    {
      "id": "enterprise:relationship--02052736-4888-47b0-9eb4-4031a4061998",
      "subject": "ATTACK:enterprise:G0012",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--02052736-4888-47b0-9eb4-4031a4061998",
      "modified": "2026-07-31T18:48:11.798Z",
      "references": [
        {
          "source_name": "Securelist Darkhotel Aug 2015",
          "url": "https://securelist.com/darkhotels-attacks-in-2015/71713/"
        },
        {
          "source_name": "Microsoft DUBNIUM June 2016",
          "url": "https://www.microsoft.com/security/blog/2016/06/09/reverse-engineering-dubnium-2/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--030506d0-28fa-4a37-8375-037f7887ccff",
      "subject": "ATTACK:enterprise:S1130",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--030506d0-28fa-4a37-8375-037f7887ccff",
      "modified": "2026-04-29T14:23:05.907Z",
      "references": [
        {
          "source_name": "TrendMicro RaspberryRobin 2022",
          "url": "https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"
        },
        {
          "source_name": "HP RaspberryRobin 2024",
          "url": "https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0481e814-434a-4736-80f3-f8bbcad3faf2",
      "subject": "ATTACK:enterprise:S0611",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0481e814-434a-4736-80f3-f8bbcad3faf2",
      "modified": "2026-04-29T14:23:05.909Z",
      "references": [
        {
          "source_name": "Mcafee Clop Aug 2019",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"
        },
        {
          "source_name": "Cybereason Clop Dec 2020",
          "url": "https://www.cybereason.com/blog/cybereason-vs.-clop-ransomware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--07173c7c-335d-488b-b3ff-2f94168500db",
      "subject": "ATTACK:enterprise:S0469",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--07173c7c-335d-488b-b3ff-2f94168500db",
      "modified": "2026-04-29T14:23:05.913Z",
      "references": [
        {
          "source_name": "Trend Micro Tick November 2019",
          "url": "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--07b15826-1fe3-42db-afdb-9f18e2c8ef2b",
      "subject": "ATTACK:enterprise:C0014",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--07b15826-1fe3-42db-afdb-9f18e2c8ef2b",
      "modified": "2026-07-31T18:47:31.344Z",
      "references": [
        {
          "source_name": "FoxIT Wocao December 2019",
          "url": "https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--085c21c0-4afb-4df2-bf86-803457be16fd",
      "subject": "ATTACK:enterprise:S1228",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--085c21c0-4afb-4df2-bf86-803457be16fd",
      "modified": "2026-04-29T14:23:05.915Z",
      "references": [
        {
          "source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0cf2ae01-9d19-46d7-949e-e6d7a5639a95",
      "subject": "ATTACK:enterprise:G0121",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0cf2ae01-9d19-46d7-949e-e6d7a5639a95",
      "modified": "2026-07-31T18:47:51.667Z",
      "references": [
        {
          "source_name": "Rewterz Sidewinder APT April 2020",
          "url": "https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0f5c39a8-edc1-4da2-941a-56e17b32abe4",
      "subject": "ATTACK:enterprise:S0455",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0f5c39a8-edc1-4da2-941a-56e17b32abe4",
      "modified": "2026-04-29T14:23:05.925Z",
      "references": [
        {
          "source_name": "Fortinet Metamorfo Feb 2020",
          "url": "https://www.fortinet.com/blog/threat-research/another-metamorfo-variant-targeting-customers-of-financial-institutions"
        },
        {
          "source_name": "ESET Casbaneiro Oct 2019",
          "url": "https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--11855647-767c-4f80-adb0-4ff81a392f67",
      "subject": "ATTACK:enterprise:S1234",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--11855647-767c-4f80-adb0-4ff81a392f67",
      "modified": "2026-04-29T14:23:05.928Z",
      "references": [
        {
          "source_name": "Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025",
          "url": "https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--12c5e6cf-be54-42cc-af42-5fa80ad87fb5",
      "subject": "ATTACK:enterprise:S1239",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--12c5e6cf-be54-42cc-af42-5fa80ad87fb5",
      "modified": "2026-04-29T14:23:05.930Z",
      "references": [
        {
          "source_name": "Trend Micro Mustang Panda Earth Preta Toneshell February 2025",
          "url": "https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1343df30-b011-42f7-b3a3-a5d1d2f0b9c6",
      "subject": "ATTACK:enterprise:S0650",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1343df30-b011-42f7-b3a3-a5d1d2f0b9c6",
      "modified": "2026-04-29T14:23:05.930Z",
      "references": [
        {
          "source_name": "Crowdstrike Qakbot October 2020",
          "url": "https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/"
        },
        {
          "source_name": "ATT QakBot April 2021",
          "url": "https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"
        },
        {
          "source_name": "ATT QakBot April 2021",
          "url": "https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"
        },
        {
          "source_name": "Kaspersky QakBot September 2021",
          "url": "https://securelist.com/qakbot-technical-analysis/103931/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--14a9f873-cb86-4238-b6c6-8b0836512fdc",
      "subject": "ATTACK:enterprise:S0339",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--14a9f873-cb86-4238-b6c6-8b0836512fdc",
      "modified": "2026-04-29T14:23:05.932Z",
      "references": [
        {
          "source_name": "Talos Micropsia June 2017",
          "url": "https://blog.talosintelligence.com/2017/06/palestine-delphi.html"
        },
        {
          "source_name": "Radware Micropsia July 2018",
          "url": "https://www.radware.com/blog/security/2018/07/micropsia-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--15c71de6-bc1d-451f-8c61-a982516bb18b",
      "subject": "ATTACK:enterprise:G1008",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--15c71de6-bc1d-451f-8c61-a982516bb18b",
      "modified": "2026-07-31T18:47:36.745Z",
      "references": [
        {
          "source_name": "MalwareBytes SideCopy Dec 2021",
          "url": "https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--198d7156-eff4-4a6e-8e59-ab8a656f77a8",
      "subject": "ATTACK:enterprise:S0115",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--198d7156-eff4-4a6e-8e59-ab8a656f77a8",
      "modified": "2026-04-29T14:23:05.939Z",
      "references": [
        {
          "source_name": "Proofpoint Operation Transparent Tribe March 2016",
          "url": "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"
        },
        {
          "source_name": "Kaspersky Transparent Tribe August 2020",
          "url": "https://securelist.com/transparent-tribe-part-1/98127/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--19f93e6a-a481-4f72-856a-879742a654e4",
      "subject": "ATTACK:enterprise:S0330",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--19f93e6a-a481-4f72-856a-879742a654e4",
      "modified": "2026-04-29T14:23:05.940Z",
      "references": [
        {
          "source_name": "Talos Zeus Panda Nov 2017",
          "url": "https://blog.talosintelligence.com/2017/11/zeus-panda-campaign.html#More"
        },
        {
          "source_name": "GDATA Zeus Panda June 2017",
          "url": "https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1a2f3d08-8a75-4ad5-8aba-445d37ebbff8",
      "subject": "ATTACK:enterprise:G0112",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1a2f3d08-8a75-4ad5-8aba-445d37ebbff8",
      "modified": "2026-09-02T18:52:46.892Z",
      "references": [
        {
          "source_name": "BlackBerry Bahamut",
          "url": "https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1b19ae5d-f4c5-4962-a069-3d264ff1a80d",
      "subject": "ATTACK:enterprise:S9032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1b19ae5d-f4c5-4962-a069-3d264ff1a80d",
      "modified": "2026-04-29T14:23:05.941Z",
      "references": [
        {
          "source_name": "ESET_MuddyWater_Dec2025",
          "url": "https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1c327eb2-e0af-45c2-a9ea-784252ad34b0",
      "subject": "ATTACK:enterprise:G0082",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1c327eb2-e0af-45c2-a9ea-784252ad34b0",
      "modified": "2026-09-30T21:20:22.500Z",
      "references": [
        {
          "source_name": "CISA AA20-239A BeagleBoyz August 2020",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-239a"
        },
        {
          "source_name": "MIcrosoft Mastra npm Compromise JUN 2026",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"
        },
        {
          "source_name": "1 - appv",
          "url": "https://securelist.com/bluenoroff-methods-bypass-motw/108383/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1c792ece-e1d9-4819-9621-1b704a23839d",
      "subject": "ATTACK:enterprise:S1244",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1c792ece-e1d9-4819-9621-1b704a23839d",
      "modified": "2026-04-29T14:23:05.943Z",
      "references": [
        {
          "source_name": "Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024",
          "url": "https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1ce61b6a-b1fd-4e21-874a-774a1487fa12",
      "subject": "ATTACK:enterprise:G0061",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1ce61b6a-b1fd-4e21-874a-774a1487fa12",
      "modified": "2026-07-31T18:48:29.370Z",
      "references": [
        {
          "source_name": "FireEye Know Your Enemy FIN8 Aug 2016",
          "url": "https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2211993c-fe8d-4bd7-a312-44187566ae65",
      "subject": "ATTACK:enterprise:G1044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2211993c-fe8d-4bd7-a312-44187566ae65",
      "modified": "2026-07-31T18:48:15.987Z",
      "references": [
        {
          "source_name": "Mandiant APT42-untangling",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--240b044f-89b4-4009-bbf6-04b1f0bb6385",
      "subject": "ATTACK:enterprise:S1025",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--240b044f-89b4-4009-bbf6-04b1f0bb6385",
      "modified": "2026-04-29T14:23:05.955Z",
      "references": [
        {
          "source_name": "Korean FSI TA505 2020",
          "url": "https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="
        },
        {
          "source_name": "BlackBerry Amadey 2020",
          "url": "https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--25623cee-b8bc-4937-9a93-749549e69a83",
      "subject": "ATTACK:enterprise:G1018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--25623cee-b8bc-4937-9a93-749549e69a83",
      "modified": "2026-07-31T18:47:55.057Z",
      "references": [
        {
          "source_name": "Proofpoint TA2541 February 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--26289101-47e6-47a5-bc9f-19bf918721d6",
      "subject": "ATTACK:enterprise:S0244",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--26289101-47e6-47a5-bc9f-19bf918721d6",
      "modified": "2026-04-29T14:23:05.957Z",
      "references": [
        {
          "source_name": "Palo Alto Comnie",
          "url": "https://researchcenter.paloaltonetworks.com/2018/01/unit42-comnie-continues-target-organizations-east-asia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2a8c6029-7714-437a-87a2-bc91067575e6",
      "subject": "ATTACK:enterprise:G0089",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2a8c6029-7714-437a-87a2-bc91067575e6",
      "modified": "2026-07-31T18:47:59.838Z",
      "references": [
        {
          "source_name": "Cylance Shaheen Nov 2018",
          "url": "https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2e77d363-e38f-40ad-a6ef-9222dc12793d",
      "subject": "ATTACK:enterprise:G0019",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2e77d363-e38f-40ad-a6ef-9222dc12793d",
      "modified": "2026-07-31T18:47:46.076Z",
      "references": [
        {
          "source_name": "Baumgartner Naikon 2015",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2fdc9078-0737-4b2c-bb6c-f046b63c368b",
      "subject": "ATTACK:enterprise:S0534",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2fdc9078-0737-4b2c-bb6c-f046b63c368b",
      "modified": "2026-04-29T14:23:05.975Z",
      "references": [
        {
          "source_name": "Cybereason Bazar July 2020",
          "url": "https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--30b3b0e1-88a4-4126-8a2e-78ccaedbb36d",
      "subject": "ATTACK:enterprise:S1240",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--30b3b0e1-88a4-4126-8a2e-78ccaedbb36d",
      "modified": "2026-04-29T14:23:05.978Z",
      "references": [
        {
          "source_name": "Kroll RedLine Stealer August 2024",
          "url": "https://www.kroll.com/en/publications/cyber/redlinestealer-malware"
        },
        {
          "source_name": "Veriti RedLine Stealer MAAS April 2023",
          "url": "https://veriti.ai/blog/veriti-research/from-chatgpt-to-redline-stealer-the-dark-side-of-openai-and-google-bard/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--30ff291e-e546-4084-8b5b-22fd5a597449",
      "subject": "ATTACK:enterprise:G0080",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--30ff291e-e546-4084-8b5b-22fd5a597449",
      "modified": "2026-07-31T18:48:22.892Z",
      "references": [
        {
          "source_name": "Morphisec Cobalt Gang Oct 2018",
          "url": "https://blog.morphisec.com/cobalt-gang-2.0"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--330c8e43-575f-4c9a-b6c2-def7306841ad",
      "subject": "ATTACK:enterprise:S0046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--330c8e43-575f-4c9a-b6c2-def7306841ad",
      "modified": "2026-04-29T14:23:05.986Z",
      "references": [
        {
          "source_name": "F-Secure CozyDuke",
          "url": "https://www.f-secure.com/documents/996508/1030745/CozyDuke"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--35a86a34-1ea3-4f78-bd73-96b9975f9927",
      "subject": "ATTACK:enterprise:S1213",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--35a86a34-1ea3-4f78-bd73-96b9975f9927",
      "modified": "2026-04-29T14:23:05.992Z",
      "references": [
        {
          "source_name": "Qualys LummaStealer 2024",
          "url": "https://blog.qualys.com/vulnerabilities-threat-research/2024/10/20/unmasking-lumma-stealer-analyzing-deceptive-tactics-with-fake-captcha"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--37d43abb-78c6-45b7-927d-353f5f95c322",
      "subject": "ATTACK:enterprise:S9024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--37d43abb-78c6-45b7-927d-353f5f95c322",
      "modified": "2026-04-29T14:23:05.996Z",
      "references": [
        {
          "source_name": "Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--382d78e9-c653-4d0d-aab6-c154152f6f1c",
      "subject": "ATTACK:enterprise:S1013",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--382d78e9-c653-4d0d-aab6-c154152f6f1c",
      "modified": "2026-04-29T14:23:05.997Z",
      "references": [
        {
          "source_name": "Cisco Talos Bitter Bangladesh May 2022",
          "url": "https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3c0cb507-2bf0-46ab-b5c2-ba2865397722",
      "subject": "ATTACK:enterprise:S0196",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3c0cb507-2bf0-46ab-b5c2-ba2865397722",
      "modified": "2026-04-29T14:23:06.004Z",
      "references": [
        {
          "source_name": "Morphisec ShellTea June 2019",
          "url": "http://blog.morphisec.com/security-alert-fin8-is-back"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3c155a7b-d51d-4290-a663-3e5cf022d6e4",
      "subject": "ATTACK:enterprise:S1066",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3c155a7b-d51d-4290-a663-3e5cf022d6e4",
      "modified": "2026-04-29T14:23:06.004Z",
      "references": [
        {
          "source_name": "Secureworks DarkTortilla Aug 2022",
          "url": "https://www.secureworks.com/research/darktortilla-malware-analysis"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3caf848c-d95b-40ae-a288-2905319e4005",
      "subject": "ATTACK:enterprise:S0223",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3caf848c-d95b-40ae-a288-2905319e4005",
      "modified": "2026-04-29T14:23:06.007Z",
      "references": [
        {
          "source_name": "FireEye MuddyWater Mar 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3db3a6a7-5fa4-4a66-86b6-5df1732a8e96",
      "subject": "ATTACK:enterprise:G0047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3db3a6a7-5fa4-4a66-86b6-5df1732a8e96",
      "modified": "2026-07-31T18:47:47.557Z",
      "references": [
        {
          "source_name": "SymantecCarbonBlack_ShuckwormUSB_Apr2025",
          "url": "https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--433eeadb-2011-476e-833a-7541df07d432",
      "subject": "ATTACK:enterprise:S0267",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--433eeadb-2011-476e-833a-7541df07d432",
      "modified": "2026-04-29T14:23:06.017Z",
      "references": [
        {
          "source_name": "ESET GreyEnergy Oct 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--44aab0bc-80d5-4c6b-9acf-ceb9cc30f443",
      "subject": "ATTACK:enterprise:S0467",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--44aab0bc-80d5-4c6b-9acf-ceb9cc30f443",
      "modified": "2026-04-29T14:23:06.019Z",
      "references": [
        {
          "source_name": "Kaspersky TajMahal April 2019",
          "url": "https://securelist.com/project-tajmahal/90240/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--481c0cee-c977-430f-9f33-e5859b48be39",
      "subject": "ATTACK:enterprise:S0256",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--481c0cee-c977-430f-9f33-e5859b48be39",
      "modified": "2026-04-29T14:23:06.023Z",
      "references": [
        {
          "source_name": "ESET Turla Mosquito Jan 2018",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--49b63fca-e16a-446e-89fc-2b899f8420bf",
      "subject": "ATTACK:enterprise:S0257",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--49b63fca-e16a-446e-89fc-2b899f8420bf",
      "modified": "2026-04-29T14:23:06.026Z",
      "references": [
        {
          "source_name": "Unit 42 VERMIN Jan 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--49c5bbcf-7ac3-406f-8b58-2b4c00b2c41e",
      "subject": "ATTACK:enterprise:S0476",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--49c5bbcf-7ac3-406f-8b58-2b4c00b2c41e",
      "modified": "2026-04-29T14:23:06.026Z",
      "references": [
        {
          "source_name": "Cybereason Valak May 2020",
          "url": "https://www.cybereason.com/blog/valak-more-than-meets-the-eye"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--49f761f9-89d2-4e6f-a0c6-fc5e32cca471",
      "subject": "ATTACK:enterprise:S0468",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--49f761f9-89d2-4e6f-a0c6-fc5e32cca471",
      "modified": "2026-04-29T14:23:06.026Z",
      "references": [
        {
          "source_name": "Trend Micro Skidmap",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4a9f7553-b3ee-405b-9c81-f487b4bed868",
      "subject": "ATTACK:enterprise:S0143",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4a9f7553-b3ee-405b-9c81-f487b4bed868",
      "modified": "2026-04-29T14:23:06.027Z",
      "references": [
        {
          "source_name": "Kaspersky Flame",
          "url": "https://securelist.com/the-flame-questions-and-answers-51/34344/"
        },
        {
          "source_name": "Kaspersky Flame Functionality",
          "url": "https://securelist.com/flame-bunny-frog-munch-and-beetlejuice-2/32855/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4f90f58d-de6a-41b8-8ffd-1db5da42db34",
      "subject": "ATTACK:enterprise:S0373",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4f90f58d-de6a-41b8-8ffd-1db5da42db34",
      "modified": "2026-04-29T14:23:06.034Z",
      "references": [
        {
          "source_name": "Cofense Astaroth Sept 2018",
          "url": "https://web.archive.org/web/20200302071436/https://cofense.com/seeing-resurgence-demonic-astaroth-wmic-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--502d4200-719b-4b42-8221-0ecd0ed0d6e7",
      "subject": "ATTACK:enterprise:S1039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--502d4200-719b-4b42-8221-0ecd0ed0d6e7",
      "modified": "2026-04-29T14:23:06.035Z",
      "references": [
        {
          "source_name": "Symantec Bumblebee June 2022",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime"
        },
        {
          "source_name": "Proofpoint Bumblebee April 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"
        },
        {
          "source_name": "Medium Ali Salem Bumblebee April 2022",
          "url": "https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--50dbe887-4d91-42d3-8e1b-34000ad5a1e7",
      "subject": "ATTACK:enterprise:S0473",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--50dbe887-4d91-42d3-8e1b-34000ad5a1e7",
      "modified": "2026-04-29T14:23:06.036Z",
      "references": [
        {
          "source_name": "Trend Micro Tick November 2019",
          "url": "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--52781f1e-4b91-4ff2-8f48-89e15bc40d42",
      "subject": "ATTACK:enterprise:S0184",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--52781f1e-4b91-4ff2-8f48-89e15bc40d42",
      "modified": "2026-04-29T14:23:06.038Z",
      "references": [
        {
          "source_name": "FireEye APT34 Dec 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5449b7c0-73f8-474f-8444-0182112d7c57",
      "subject": "ATTACK:enterprise:C0001",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5449b7c0-73f8-474f-8444-0182112d7c57",
      "modified": "2026-07-31T18:47:19.042Z",
      "references": [
        {
          "source_name": "Talos Frankenstein June 2019",
          "url": "https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5adfebe4-4bfd-4848-9727-379d7284dcc8",
      "subject": "ATTACK:enterprise:S0657",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5adfebe4-4bfd-4848-9727-379d7284dcc8",
      "modified": "2026-04-29T14:23:06.049Z",
      "references": [
        {
          "source_name": "Volexity InkySquid BLUELIGHT August 2021",
          "url": "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5d2cc737-7cbc-476f-afbe-a8fafa7043fe",
      "subject": "ATTACK:enterprise:S1065",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5d2cc737-7cbc-476f-afbe-a8fafa7043fe",
      "modified": "2026-04-29T14:23:06.052Z",
      "references": [
        {
          "source_name": "MalwareBytes WoodyRAT Aug 2022",
          "url": "https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6157e239-92a8-427f-ba9b-2f06f5b03f12",
      "subject": "ATTACK:enterprise:S0368",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6157e239-92a8-427f-ba9b-2f06f5b03f12",
      "modified": "2026-04-29T14:23:06.057Z",
      "references": [
        {
          "source_name": "US District Court Indictment GRU Unit 74455 October 2020",
          "url": "https://www.justice.gov/opa/press-release/file/1328521/download"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--618d4835-6022-46df-bee1-38fcb97ffb91",
      "subject": "ATTACK:enterprise:S0388",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--618d4835-6022-46df-bee1-38fcb97ffb91",
      "modified": "2026-04-29T14:23:06.058Z",
      "references": [
        {
          "source_name": "TrendMicro TropicTrooper 2015",
          "url": "https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--61c802ec-b415-4161-bf15-3a8c5cc0a243",
      "subject": "ATTACK:enterprise:G0102",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--61c802ec-b415-4161-bf15-3a8c5cc0a243",
      "modified": "2026-07-31T20:48:50.252Z",
      "references": [
        {
          "source_name": "DFIR Ryuk's Return October 2020",
          "url": "https://thedfirreport.com/2020/10/08/ryuks-return/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6207afcd-8cc6-4bee-aa2c-2218e30679b1",
      "subject": "ATTACK:enterprise:S1159",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6207afcd-8cc6-4bee-aa2c-2218e30679b1",
      "modified": "2026-04-29T14:23:06.058Z",
      "references": [
        {
          "source_name": "Google Cloud APT41 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--67e2417b-793a-4082-94ca-445718e925b1",
      "subject": "ATTACK:enterprise:S0457",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--67e2417b-793a-4082-94ca-445718e925b1",
      "modified": "2026-04-29T14:23:06.066Z",
      "references": [
        {
          "source_name": "TrendMicro Netwalker May 2020",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6a5bc2dd-2132-4af0-9b12-0e781971d96c",
      "subject": "ATTACK:enterprise:G0040",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6a5bc2dd-2132-4af0-9b12-0e781971d96c",
      "modified": "2026-07-31T20:48:26.325Z",
      "references": [
        {
          "source_name": "Cymmetria Patchwork",
          "url": "https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6afb86e4-cb3b-40f5-ab03-10db5e0e9302",
      "subject": "ATTACK:enterprise:S0652",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6afb86e4-cb3b-40f5-ab03-10db5e0e9302",
      "modified": "2026-04-29T14:23:06.071Z",
      "references": [
        {
          "source_name": "Kaspersky Ferocious Kitten Jun 2021",
          "url": "https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6bed87bb-2cb9-48a8-a23d-31ed8285c61f",
      "subject": "ATTACK:enterprise:G0069",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6bed87bb-2cb9-48a8-a23d-31ed8285c61f",
      "modified": "2026-07-31T20:48:29.881Z",
      "references": [
        {
          "source_name": "Securelist MuddyWater Oct 2018",
          "url": "https://securelist.com/muddywater/88059/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6d651de6-29d6-4621-91af-a48593ab7c19",
      "subject": "ATTACK:enterprise:S9019",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6d651de6-29d6-4621-91af-a48593ab7c19",
      "modified": "2026-04-29T14:23:06.074Z",
      "references": [
        {
          "source_name": "Check Point Blind Eagle MAR 2025",
          "url": "https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--700e46f0-0c55-4b5b-8f12-d4ead13b03d3",
      "subject": "ATTACK:enterprise:S0679",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--700e46f0-0c55-4b5b-8f12-d4ead13b03d3",
      "modified": "2026-04-29T14:23:06.078Z",
      "references": [
        {
          "source_name": "Kaspersky WIRTE November 2021",
          "url": "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--71219800-4802-4029-bf24-fc09503ad05d",
      "subject": "ATTACK:enterprise:G1053",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--71219800-4802-4029-bf24-fc09503ad05d",
      "modified": "2026-07-31T18:48:03.745Z",
      "references": [
        {
          "source_name": "Microsoft Storm-0501 Embargo Ransomware August 2025",
          "url": "https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--716975f1-af44-4d45-af4e-29ad68ce3fb3",
      "subject": "ATTACK:enterprise:S0531",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--716975f1-af44-4d45-af4e-29ad68ce3fb3",
      "modified": "2026-04-29T14:23:06.080Z",
      "references": [
        {
          "source_name": "ESET Grandoreiro April 2020",
          "url": "https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"
        },
        {
          "source_name": "ESET Grandoreiro April 2020",
          "url": "https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--74e84133-f84a-469a-bfd7-1a514af2f15e",
      "subject": "ATTACK:enterprise:S0098",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--74e84133-f84a-469a-bfd7-1a514af2f15e",
      "modified": "2026-04-29T14:23:06.085Z",
      "references": [
        {
          "source_name": "Palo Alto T9000 Feb 2016",
          "url": "http://researchcenter.paloaltonetworks.com/2016/02/t9000-advanced-modular-backdoor-uses-complex-anti-analysis-techniques/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--765e3b13-60f4-4b34-b03f-0d8e738b0add",
      "subject": "ATTACK:enterprise:S0023",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--765e3b13-60f4-4b34-b03f-0d8e738b0add",
      "modified": "2026-04-29T14:23:06.087Z",
      "references": [
        {
          "source_name": "FireEye APT28",
          "url": "https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--77a6a1b4-9217-48fe-b1dd-f1f6506dd910",
      "subject": "ATTACK:enterprise:S9023",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--77a6a1b4-9217-48fe-b1dd-f1f6506dd910",
      "modified": "2026-04-29T14:23:06.089Z",
      "references": [
        {
          "source_name": "ESET HiddenFace 2024",
          "url": "https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf"
        },
        {
          "source_name": "Trend Micro Earth Kasha NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--785d0d93-1500-40b5-9f71-9d51aadef914",
      "subject": "ATTACK:enterprise:S0472",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--785d0d93-1500-40b5-9f71-9d51aadef914",
      "modified": "2026-04-29T14:23:06.089Z",
      "references": [
        {
          "source_name": "Trend Micro Tick November 2019",
          "url": "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--79c46f52-743a-4a17-bede-aa003c03f6b1",
      "subject": "ATTACK:enterprise:S0471",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--79c46f52-743a-4a17-bede-aa003c03f6b1",
      "modified": "2026-04-29T14:23:06.092Z",
      "references": [
        {
          "source_name": "Trend Micro Tick November 2019",
          "url": "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7da97f5c-fd61-4181-9775-47abbd5250c0",
      "subject": "ATTACK:enterprise:S0381",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7da97f5c-fd61-4181-9775-47abbd5250c0",
      "modified": "2026-04-29T14:23:06.097Z",
      "references": [
        {
          "source_name": "Proofpoint TA505 Mar 2018",
          "url": "https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7de5afb6-3dbf-4c9a-876f-1f7a4aa9d4e0",
      "subject": "ATTACK:enterprise:S0689",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7de5afb6-3dbf-4c9a-876f-1f7a4aa9d4e0",
      "modified": "2026-04-29T14:23:06.097Z",
      "references": [
        {
          "source_name": "Unit 42 WhisperGate January 2022",
          "url": "https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/#whispergate-malware-family"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7e32a557-f724-433f-84e0-756e14db7074",
      "subject": "ATTACK:enterprise:S0491",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7e32a557-f724-433f-84e0-756e14db7074",
      "modified": "2026-09-03T14:50:23.956Z",
      "references": [
        {
          "source_name": "Talos Promethium June 2020",
          "url": "https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7e90117e-0a1b-4320-9b37-54e070c3dc49",
      "subject": "ATTACK:enterprise:S0380",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7e90117e-0a1b-4320-9b37-54e070c3dc49",
      "modified": "2026-04-29T14:23:06.098Z",
      "references": [
        {
          "source_name": "Kaspersky StoneDrill 2017",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7f81539c-f287-4f8f-be26-11443d2e19d3",
      "subject": "ATTACK:enterprise:S0483",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7f81539c-f287-4f8f-be26-11443d2e19d3",
      "modified": "2026-04-29T14:23:06.100Z",
      "references": [
        {
          "source_name": "DFIR_Sodinokibi_Ransomware",
          "url": "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/"
        },
        {
          "source_name": "DFIR_Quantum_Ransomware",
          "url": "https://thedfirreport.com/2022/04/25/quantum-ransomware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--80ca0faf-6958-4158-a36d-b3e7936c5f5a",
      "subject": "ATTACK:enterprise:S0057",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--80ca0faf-6958-4158-a36d-b3e7936c5f5a",
      "modified": "2026-04-29T14:23:06.101Z",
      "references": [
        {
          "source_name": "Microsoft Tasklist",
          "url": "https://technet.microsoft.com/en-us/library/bb491010.aspx"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8121ed43-42eb-42ad-a86f-26fb53b71975",
      "subject": "ATTACK:enterprise:S0484",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8121ed43-42eb-42ad-a86f-26fb53b71975",
      "modified": "2026-04-29T14:23:06.102Z",
      "references": [
        {
          "source_name": "Prevx Carberp March 2011",
          "url": "https://web.archive.org/web/20231227000328/http://pxnow.prevx.com/content/blog/carberp-a_modular_information_stealing_trojan.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--81e6eb4d-4a94-4416-8a45-b54e9cafda9d",
      "subject": "ATTACK:enterprise:S1063",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--81e6eb4d-4a94-4416-8a45-b54e9cafda9d",
      "modified": "2026-04-29T14:23:06.103Z",
      "references": [
        {
          "source_name": "Palo Alto Brute Ratel July 2022",
          "url": "https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--83082ae7-c6bd-4595-8fe5-3016e8879119",
      "subject": "ATTACK:enterprise:S1179",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--83082ae7-c6bd-4595-8fe5-3016e8879119",
      "modified": "2026-04-29T14:23:06.104Z",
      "references": [
        {
          "source_name": "Symantec BlackByte 2022",
          "url": "https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--833c9993-3551-45af-9bbd-413de2d4dac3",
      "subject": "ATTACK:enterprise:G0143",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--833c9993-3551-45af-9bbd-413de2d4dac3",
      "modified": "2026-07-31T18:47:59.382Z",
      "references": [
        {
          "source_name": "CrowdStrike AQUATIC PANDA December 2021",
          "url": "https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8536d997-c81c-48c9-94e9-6ffea04e4a0f",
      "subject": "ATTACK:enterprise:S0653",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8536d997-c81c-48c9-94e9-6ffea04e4a0f",
      "modified": "2026-04-29T14:23:06.107Z",
      "references": [
        {
          "source_name": "Checkpoint IndigoZebra July 2021",
          "url": "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--863c1d57-db93-49a9-a953-eb7c2d6b2e5b",
      "subject": "ATTACK:enterprise:S0171",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--863c1d57-db93-49a9-a953-eb7c2d6b2e5b",
      "modified": "2026-04-29T14:23:06.108Z",
      "references": [
        {
          "source_name": "Forcepoint Felismus Mar 2017",
          "url": "https://blogs.forcepoint.com/security-labs/playing-cat-mouse-introducing-felismus-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8bfac9d6-8d6d-4a2f-9718-4015f231fdae",
      "subject": "ATTACK:enterprise:G0094",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8bfac9d6-8d6d-4a2f-9718-4015f231fdae",
      "modified": "2026-07-31T20:48:25.135Z",
      "references": [
        {
          "source_name": "Securonix Kimsuky February 2025",
          "url": "https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"
        },
        {
          "source_name": "KISA Operation Muzabi",
          "url": "https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"
        },
        {
          "source_name": "Aryaka Kimsuky July 2025",
          "url": "https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8e140ad6-3e95-41fb-893d-644316fdccbf",
      "subject": "ATTACK:enterprise:S0666",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8e140ad6-3e95-41fb-893d-644316fdccbf",
      "modified": "2026-04-29T14:23:06.119Z",
      "references": [
        {
          "source_name": "ESET Gelsemium June 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8e1a4560-f9da-4729-a364-dade6bb2cdc2",
      "subject": "ATTACK:enterprise:G0139",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8e1a4560-f9da-4729-a364-dade6bb2cdc2",
      "modified": "2026-07-31T18:47:49.687Z",
      "references": [
        {
          "source_name": "ATT TeamTNT Chimaera September 2020",
          "url": "https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"
        },
        {
          "source_name": "Cisco Talos Intelligence Group",
          "url": "https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8e685821-98a3-42a0-9c6a-334a8ff078d4",
      "subject": "ATTACK:enterprise:S0283",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8e685821-98a3-42a0-9c6a-334a8ff078d4",
      "modified": "2026-04-29T14:23:06.119Z",
      "references": [
        {
          "source_name": "jRAT Symantec Aug 2018",
          "url": "https://www.symantec.com/blogs/threat-intelligence/jrat-new-anti-parsing-techniques"
        },
        {
          "source_name": "Kaspersky Adwind Feb 2016",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8f18a511-65e3-4019-b617-ef0134597722",
      "subject": "ATTACK:enterprise:G1026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8f18a511-65e3-4019-b617-ef0134597722",
      "modified": "2026-07-31T18:48:16.090Z",
      "references": [
        {
          "source_name": "SCILabs Malteiro 2021",
          "url": "https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9395c820-d828-4dea-bcde-88c4baf06440",
      "subject": "ATTACK:enterprise:T1518.001",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1518",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9395c820-d828-4dea-bcde-88c4baf06440",
      "modified": "2026-04-29T14:23:06.126Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--95a1ac52-e022-4c81-96cc-b7b39ca776d3",
      "subject": "ATTACK:enterprise:S0088",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--95a1ac52-e022-4c81-96cc-b7b39ca776d3",
      "modified": "2026-04-29T14:23:06.129Z",
      "references": [
        {
          "source_name": "Zscaler Kasidet",
          "url": "http://research.zscaler.com/2016/01/malicious-office-files-dropping-kasidet.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--98b7d901-4ede-451f-bab8-3b2b37c56bfd",
      "subject": "ATTACK:enterprise:S0113",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--98b7d901-4ede-451f-bab8-3b2b37c56bfd",
      "modified": "2026-04-29T14:23:06.133Z",
      "references": [
        {
          "source_name": "ESET Operation Groundbait",
          "url": "http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--992ffd2b-bac7-418c-a401-b2be739818c9",
      "subject": "ATTACK:enterprise:S0270",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--992ffd2b-bac7-418c-a401-b2be739818c9",
      "modified": "2026-04-29T14:23:06.134Z",
      "references": [
        {
          "source_name": "Unit 42 DarkHydrus July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
        },
        {
          "source_name": "Unit42 DarkHydrus Jan 2019",
          "url": "https://unit42.paloaltonetworks.com/darkhydrus-delivers-new-trojan-that-can-use-google-drive-for-c2-communications/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9b8341df-94d6-4989-9662-9af1b2233036",
      "subject": "ATTACK:enterprise:S0579",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9b8341df-94d6-4989-9662-9af1b2233036",
      "modified": "2026-04-29T14:23:06.137Z",
      "references": [
        {
          "source_name": "Trend Micro Waterbear December 2019",
          "url": "https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9e0d38b0-f7c6-432e-8f7d-470e07a6d303",
      "subject": "ATTACK:enterprise:S0603",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9e0d38b0-f7c6-432e-8f7d-470e07a6d303",
      "modified": "2026-04-29T14:23:06.140Z",
      "references": [
        {
          "source_name": "Nicolas Falliere, Liam O Murchu, Eric Chien February 2011",
          "url": "https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a33a2769-246f-44f4-b40d-441aad3c8c3a",
      "subject": "ATTACK:enterprise:S1122",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a33a2769-246f-44f4-b40d-441aad3c8c3a",
      "modified": "2026-04-29T14:23:06.147Z",
      "references": [
        {
          "source_name": "ESET Security Mispadu Facebook Ads 2019",
          "url": "https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"
        },
        {
          "source_name": "Metabase Q Mispadu Trojan 2023",
          "url": "https://www.metabaseq.com/mispadu-banking-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a6e883cf-6276-47c1-a4a3-be2756d510a2",
      "subject": "ATTACK:enterprise:S0201",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a6e883cf-6276-47c1-a4a3-be2756d510a2",
      "modified": "2026-04-29T14:23:06.152Z",
      "references": [
        {
          "source_name": "Microsoft PLATINUM April 2016",
          "url": "https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a824dc85-8e56-4394-aa36-e466bbc2cf55",
      "subject": "ATTACK:enterprise:S9037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a824dc85-8e56-4394-aa36-e466bbc2cf55",
      "modified": "2026-04-29T14:23:06.154Z",
      "references": [
        {
          "source_name": "CloudSEK_RustyWater_Jan2026",
          "url": "https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ad50f322-18b6-43c7-bf6b-f77f4932fdad",
      "subject": "ATTACK:enterprise:S0062",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ad50f322-18b6-43c7-bf6b-f77f4932fdad",
      "modified": "2026-04-29T14:23:06.161Z",
      "references": [
        {
          "source_name": "DustySky",
          "url": "https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ad80dc80-0a57-4669-a8a1-d22bb63a4d40",
      "subject": "ATTACK:enterprise:S9026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ad80dc80-0a57-4669-a8a1-d22bb63a4d40",
      "modified": "2026-04-29T14:23:06.161Z",
      "references": [
        {
          "source_name": "Trend Micro Earth Kasha Updates APR 2025",
          "url": "https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ad8d3784-2eea-47b4-b13d-d16d0211acf3",
      "subject": "ATTACK:enterprise:G0010",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ad8d3784-2eea-47b4-b13d-d16d0211acf3",
      "modified": "2026-07-31T18:48:04.205Z",
      "references": [
        {
          "source_name": "ESET ComRAT May 2020",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ae8ac860-1dfc-41c3-81ab-08da9619c4a3",
      "subject": "ATTACK:enterprise:S1160",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ae8ac860-1dfc-41c3-81ab-08da9619c4a3",
      "modified": "2026-04-29T14:23:06.163Z",
      "references": [
        {
          "source_name": "Bitsight Latrodectus June 2024",
          "url": "https://www.bitsight.com/blog/latrodectus-are-you-coming-back"
        },
        {
          "source_name": "Elastic Latrodectus May 2024",
          "url": "https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b062c271-ce67-4134-bf86-033123d351ff",
      "subject": "ATTACK:enterprise:S1149",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b062c271-ce67-4134-bf86-033123d351ff",
      "modified": "2026-04-29T14:23:06.166Z",
      "references": [
        {
          "source_name": "Mandiant ROADSWEEP August 2022",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b1371fd9-1bfd-40b2-90a2-4876d89029bf",
      "subject": "ATTACK:enterprise:S0176",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b1371fd9-1bfd-40b2-90a2-4876d89029bf",
      "modified": "2026-04-29T14:23:06.167Z",
      "references": [
        {
          "source_name": "Microsoft SIR Vol 21",
          "url": "http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b2ff2217-ef23-4348-b8de-04e9aa195714",
      "subject": "ATTACK:enterprise:G1022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b2ff2217-ef23-4348-b8de-04e9aa195714",
      "modified": "2026-07-31T18:48:14.322Z",
      "references": [
        {
          "source_name": "Kaspersky ToddyCat Check Logs October 2023",
          "url": "https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b3dfdb85-2038-4be8-b5e9-bdbcb35f91c8",
      "subject": "ATTACK:enterprise:S1111",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b3dfdb85-2038-4be8-b5e9-bdbcb35f91c8",
      "modified": "2026-04-29T14:23:06.171Z",
      "references": [
        {
          "source_name": "Ensilo Darkgate 2018",
          "url": "https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"
        },
        {
          "source_name": "Rapid7 BlackBasta 2024",
          "url": "https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b5a6b7ee-7c1b-41c6-91d8-554ca468426e",
      "subject": "ATTACK:enterprise:S0681",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b5a6b7ee-7c1b-41c6-91d8-554ca468426e",
      "modified": "2026-04-29T14:23:06.173Z",
      "references": [
        {
          "source_name": "BiZone Lizar May 2021",
          "url": "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b655c9e9-a6c1-42e9-9df7-60ab64b7f65a",
      "subject": "ATTACK:enterprise:S0658",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b655c9e9-a6c1-42e9-9df7-60ab64b7f65a",
      "modified": "2026-04-29T14:23:06.174Z",
      "references": [
        {
          "source_name": "trendmicro xcsset xcode project 2020",
          "url": "https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b741ebf6-1436-4c44-94cd-d3c5b1155a35",
      "subject": "ATTACK:enterprise:S0284",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b741ebf6-1436-4c44-94cd-d3c5b1155a35",
      "modified": "2026-04-29T14:23:06.176Z",
      "references": [
        {
          "source_name": "Talos Cobalt Group July 2018",
          "url": "https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b9b28368-527c-4b13-9350-b2cda637e711",
      "subject": "ATTACK:enterprise:S0363",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b9b28368-527c-4b13-9350-b2cda637e711",
      "modified": "2026-04-29T14:23:06.178Z",
      "references": [
        {
          "source_name": "Github PowerShell Empire",
          "url": "https://github.com/PowerShellEmpire/Empire"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ba9f7e89-c677-4d86-a2e2-0de2a7f96013",
      "subject": "ATTACK:enterprise:S9060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ba9f7e89-c677-4d86-a2e2-0de2a7f96013",
      "modified": "2026-10-01T15:23:59.201Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549_Feb2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bd17ac4f-746a-4299-b9cc-ff587c57e4f2",
      "subject": "ATTACK:enterprise:S0492",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bd17ac4f-746a-4299-b9cc-ff587c57e4f2",
      "modified": "2026-04-29T14:23:06.184Z",
      "references": [
        {
          "source_name": "Unit42 CookieMiner Jan 2019",
          "url": "https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bedac37c-22e0-4220-8552-48da4aed5f44",
      "subject": "ATTACK:enterprise:S0513",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bedac37c-22e0-4220-8552-48da4aed5f44",
      "modified": "2026-04-29T14:23:06.186Z",
      "references": [
        {
          "source_name": "ESET Dukes October 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c443cc21-5f8f-4c12-8848-39c469a1c9b2",
      "subject": "ATTACK:enterprise:S0337",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c443cc21-5f8f-4c12-8848-39c469a1c9b2",
      "modified": "2026-04-29T14:23:06.193Z",
      "references": [
        {
          "source_name": "Unit 42 BadPatch Oct 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/10/unit42-badpatch/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ca2d1f51-cbd8-403b-a957-b142ba7895bf",
      "subject": "ATTACK:enterprise:G1040",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ca2d1f51-cbd8-403b-a957-b142ba7895bf",
      "modified": "2026-07-31T18:48:25.986Z",
      "references": [
        {
          "source_name": "CISA Play Ransomware Advisory December 2023",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cd7cda5b-ad63-433e-a47d-abbd6dca5f41",
      "subject": "ATTACK:enterprise:S1060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cd7cda5b-ad63-433e-a47d-abbd6dca5f41",
      "modified": "2026-04-29T14:23:06.206Z",
      "references": [
        {
          "source_name": "SentinelLabs Metador Sept 2022",
          "url": "https://assets.sentinelone.com/sentinellabs22/metador#page=1"
        },
        {
          "source_name": "SentinelLabs Metador Technical Appendix Sept 2022",
          "url": "https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cdefab78-5d90-4e89-8664-5bbd30ab1517",
      "subject": "ATTACK:enterprise:G0081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cdefab78-5d90-4e89-8664-5bbd30ab1517",
      "modified": "2026-07-31T18:47:57.616Z",
      "references": [
        {
          "source_name": "Unit 42 Tropic Trooper Nov 2016",
          "url": "https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ce853f8b-4aab-4404-a8d0-d9d024f1eda6",
      "subject": "ATTACK:enterprise:S0568",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ce853f8b-4aab-4404-a8d0-d9d024f1eda6",
      "modified": "2026-04-29T14:23:06.208Z",
      "references": [
        {
          "source_name": "Prevailion EvilNum May 2020",
          "url": "https://web.archive.org/web/20221209052853/https://www.prevailion.com/phantom-in-the-command-shell-2/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cf32330f-0d67-4e10-adae-2fe3157f6888",
      "subject": "ATTACK:enterprise:S0559",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cf32330f-0d67-4e10-adae-2fe3157f6888",
      "modified": "2026-04-29T14:23:06.209Z",
      "references": [
        {
          "source_name": "Microsoft Analyzing Solorigate Dec 2020",
          "url": "https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"
        },
        {
          "source_name": "FireEye SUNBURST Additional Details Dec 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/12/sunburst-additional-technical-details.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d051bbf1-be2f-45e6-adb2-5ae36ed4354f",
      "subject": "ATTACK:enterprise:S1193",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d051bbf1-be2f-45e6-adb2-5ae36ed4354f",
      "modified": "2026-04-29T14:23:06.211Z",
      "references": [
        {
          "source_name": "Mandiant APT42-untangling",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d236947c-849f-4f4f-9ee5-ab4b78d04ef6",
      "subject": "ATTACK:enterprise:S0595",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d236947c-849f-4f4f-9ee5-ab4b78d04ef6",
      "modified": "2026-04-29T14:23:06.213Z",
      "references": [
        {
          "source_name": "wardle evilquest parti",
          "url": "https://objective-see.com/blog/blog_0x59.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d2f6e1bf-49ae-48cb-a919-b556f8cd0553",
      "subject": "ATTACK:enterprise:S0091",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d2f6e1bf-49ae-48cb-a919-b556f8cd0553",
      "modified": "2026-04-29T14:23:06.214Z",
      "references": [
        {
          "source_name": "Kaspersky Turla",
          "url": "https://securelist.com/the-epic-turla-operation/65545/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d7903e1f-f31c-48bc-b7c3-3616cb1a792f",
      "subject": "ATTACK:enterprise:S0148",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d7903e1f-f31c-48bc-b7c3-3616cb1a792f",
      "modified": "2026-04-29T14:23:06.220Z",
      "references": [
        {
          "source_name": "ESET RTM Feb 2017",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d880473f-da6f-452b-8ea4-5723ab87226c",
      "subject": "ATTACK:enterprise:S0673",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d880473f-da6f-452b-8ea4-5723ab87226c",
      "modified": "2026-04-29T14:23:06.221Z",
      "references": [
        {
          "source_name": "Prevailion DarkWatchman 2021",
          "url": "https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d9b8e0cf-8906-45a4-8dd2-5ef9971e1a6d",
      "subject": "ATTACK:enterprise:S0182",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d9b8e0cf-8906-45a4-8dd2-5ef9971e1a6d",
      "modified": "2026-04-29T14:23:06.222Z",
      "references": [
        {
          "source_name": "FinFisher Citation",
          "url": "https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"
        },
        {
          "source_name": "Securelist BlackOasis Oct 2017",
          "url": "https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--da7dbcec-4714-4bca-8b90-d3a0a95576d9",
      "subject": "ATTACK:enterprise:S0260",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--da7dbcec-4714-4bca-8b90-d3a0a95576d9",
      "modified": "2026-04-29T14:23:06.223Z",
      "references": [
        {
          "source_name": "ESET InvisiMole June 2020",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--df4b0683-e6a7-4da4-9544-c6eded007412",
      "subject": "ATTACK:enterprise:S0249",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--df4b0683-e6a7-4da4-9544-c6eded007412",
      "modified": "2026-04-29T14:23:06.230Z",
      "references": [
        {
          "source_name": "McAfee Gold Dragon",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--df7fb8f2-e7a6-4342-8d67-09655ceefead",
      "subject": "ATTACK:enterprise:S0142",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--df7fb8f2-e7a6-4342-8d67-09655ceefead",
      "modified": "2026-04-29T14:23:06.230Z",
      "references": [
        {
          "source_name": "Cylance Shell Crew Feb 2017",
          "url": "https://www.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dfe9848e-3805-4f7f-bcaa-97de676d1823",
      "subject": "ATTACK:enterprise:G1051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dfe9848e-3805-4f7f-bcaa-97de676d1823",
      "modified": "2026-07-31T18:48:11.094Z",
      "references": [
        {
          "source_name": "Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024",
          "url": "https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e128b6ef-a7a5-4e36-a215-d5a07063c22b",
      "subject": "ATTACK:enterprise:S1029",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e128b6ef-a7a5-4e36-a215-d5a07063c22b",
      "modified": "2026-04-29T14:23:06.232Z",
      "references": [
        {
          "source_name": "MalwareBytes SideCopy Dec 2021",
          "url": "https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e23abec4-6a31-48c7-8857-e37951caebab",
      "subject": "ATTACK:enterprise:S0688",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e23abec4-6a31-48c7-8857-e37951caebab",
      "modified": "2026-04-29T14:23:06.233Z",
      "references": [
        {
          "source_name": "Check Point Meteor Aug 2021",
          "url": "https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e3e8e452-6e3f-4b2d-a9aa-00fc0573f804",
      "subject": "ATTACK:enterprise:G1043",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e3e8e452-6e3f-4b2d-a9aa-00fc0573f804",
      "modified": "2026-07-31T18:47:36.627Z",
      "references": [
        {
          "source_name": "Microsoft BlackByte 2023",
          "url": "https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e85d72e6-f217-4f8e-bdb9-5143a06e52a8",
      "subject": "ATTACK:enterprise:S1028",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e85d72e6-f217-4f8e-bdb9-5143a06e52a8",
      "modified": "2026-04-29T14:23:06.241Z",
      "references": [
        {
          "source_name": "MalwareBytes SideCopy Dec 2021",
          "url": "https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e900ada7-1b3a-442d-aa86-5cd16a3a2c00",
      "subject": "ATTACK:enterprise:S0396",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e900ada7-1b3a-442d-aa86-5cd16a3a2c00",
      "modified": "2026-04-29T14:23:06.242Z",
      "references": [
        {
          "source_name": "Cyphort EvilBunny Dec 2014",
          "url": "https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e9449844-2092-4f7d-9d8f-1ba50060e171",
      "subject": "ATTACK:enterprise:S0646",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e9449844-2092-4f7d-9d8f-1ba50060e171",
      "modified": "2026-04-29T14:23:06.243Z",
      "references": [
        {
          "source_name": "Secureworks GOLD KINGSWOOD September 2018",
          "url": "https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ea61c268-d0d1-4cbe-8b26-16f70f515a04",
      "subject": "ATTACK:enterprise:S0125",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ea61c268-d0d1-4cbe-8b26-16f70f515a04",
      "modified": "2026-04-29T14:23:06.244Z",
      "references": [
        {
          "source_name": "Kaspersky ProjectSauron Technical Analysis",
          "url": "https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--eb046f26-d7ab-41f0-bca2-80d76db13108",
      "subject": "ATTACK:enterprise:S1091",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--eb046f26-d7ab-41f0-bca2-80d76db13108",
      "modified": "2026-04-29T14:23:06.245Z",
      "references": [
        {
          "source_name": "GitHub Pacu",
          "url": "https://github.com/RhinoSecurityLabs/pacu"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--eb8508e4-6ebe-44bc-af58-b7b626bddeb8",
      "subject": "ATTACK:enterprise:S1044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--eb8508e4-6ebe-44bc-af58-b7b626bddeb8",
      "modified": "2026-04-29T14:23:06.246Z",
      "references": [
        {
          "source_name": "Bitdefender FunnyDream Campaign November 2020",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ed08418e-2143-4633-bfc9-cac436adde2b",
      "subject": "ATTACK:enterprise:S0553",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ed08418e-2143-4633-bfc9-cac436adde2b",
      "modified": "2026-04-29T14:23:06.247Z",
      "references": [
        {
          "source_name": "Cybereason Molerats Dec 2020",
          "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f0d218a3-9f7b-4f21-aa4a-34dc25f05b61",
      "subject": "ATTACK:enterprise:S0108",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f0d218a3-9f7b-4f21-aa4a-34dc25f05b61",
      "modified": "2026-04-29T14:23:06.252Z",
      "references": [
        {
          "source_name": "TechNet Netsh",
          "url": "https://technet.microsoft.com/library/bb490939.aspx"
        },
        {
          "source_name": "TechNet Netsh Firewall",
          "url": "https://technet.microsoft.com/en-us/library/cc771046(v=ws.10).aspx"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f1637c6e-7d39-4082-a05c-4742e7ef876e",
      "subject": "ATTACK:enterprise:S1180",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f1637c6e-7d39-4082-a05c-4742e7ef876e",
      "modified": "2026-04-29T14:23:06.253Z",
      "references": [
        {
          "source_name": "Trustwave BlackByte 2021",
          "url": "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f27f75b5-824d-43c9-a029-247d7d44ec8f",
      "subject": "ATTACK:enterprise:S0692",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f27f75b5-824d-43c9-a029-247d7d44ec8f",
      "modified": "2026-04-29T14:23:06.255Z",
      "references": [
        {
          "source_name": "Security Affairs SILENTTRINITY July 2019",
          "url": "https://securityaffairs.co/wordpress/88021/apt/croatia-government-silenttrinity-malware.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f3afa419-b741-4a1c-bb4d-569cde6ab558",
      "subject": "ATTACK:enterprise:S0501",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f3afa419-b741-4a1c-bb4d-569cde6ab558",
      "modified": "2026-04-29T14:23:06.256Z",
      "references": [
        {
          "source_name": "ESET PipeMon May 2020",
          "url": "https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f690a8fd-1a22-4f6d-bbd2-76cc344ecf5e",
      "subject": "ATTACK:enterprise:S0680",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f690a8fd-1a22-4f6d-bbd2-76cc344ecf5e",
      "modified": "2026-04-29T14:23:06.260Z",
      "references": [
        {
          "source_name": "Kaspersky WIRTE November 2021",
          "url": "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fb94932d-5286-42c4-817d-5d04f59763b2",
      "subject": "ATTACK:enterprise:C0035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fb94932d-5286-42c4-817d-5d04f59763b2",
      "modified": "2026-07-31T18:47:18.603Z",
      "references": [
        {
          "source_name": "Lumen KVBotnet 2023",
          "url": "https://blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ffb03265-d9d6-4dc7-ba8e-71498be4e131",
      "subject": "ATTACK:enterprise:G0106",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ffb03265-d9d6-4dc7-ba8e-71498be4e131",
      "modified": "2026-07-31T18:47:52.821Z",
      "references": [
        {
          "source_name": "Talos Rocke August 2018",
          "url": "https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"
        },
        {
          "source_name": "Unit 42 Rocke January 2019",
          "url": "https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ffd99d6b-3817-46a7-8bc0-2dd017b2d59a",
      "subject": "ATTACK:enterprise:S1141",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1518.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ffd99d6b-3817-46a7-8bc0-2dd017b2d59a",
      "modified": "2026-04-29T14:23:06.272Z",
      "references": [
        {
          "source_name": "ESET Turla Lunar toolset May 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    }
  ],
  "source_snapshot": {
    "file": "enterprise-attack-20.0.json",
    "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
    "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352",
    "bytes": 55271014,
    "checked_at": "2026-10-16T03:31:39Z"
  },
  "notices_url": "https://aol.pm/source-notices.txt",
  "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"
}

License
-------
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,
development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce
MITRE's copyright designation and this license in any such copy.

"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

Disclaimers
-----------
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part
of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover
full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or
variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE
ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,
AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE.