{"record":{"id":"ATTACK:enterprise:T1555.003","title":"Credentials from Web Browsers","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1555/003","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--58a3e6aa-4453-4cc8-a51f-4befe80b31a8","external_id":"T1555.003","domain":"enterprise","created":"2020-02-12T18:57:36.041Z","modified":"2026-09-11T19:22:47.433Z","version":"1.2","aliases":[],"tactics":["credential-access"],"source_references":[{"source_name":"GitHub Mimikittenz July 2016","url":"https://github.com/putterpanda/mimikittenz"},{"source_name":"Talos Olympic Destroyer 2018","url":"https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"},{"source_name":"Microsoft CryptUnprotectData April 2018","url":"https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/nf-dpapi-cryptunprotectdata"},{"source_name":"Proofpoint Vega Credential Stealer May 2018","url":"https://www.proofpoint.com/us/threat-insight/post/new-vega-stealer-shines-brightly-targeted-campaign"},{"source_name":"FireEye HawkEye Malware July 2017","url":"https://www.fireeye.com/blog/threat-research/2017/07/hawkeye-malware-distributed-in-phishing-campaign.html"}]},"assertions":[{"id":"enterprise:relationship--07773227-54d9-4476-877a-739c490b7b65","subject":"ATTACK:enterprise:S0385","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--07773227-54d9-4476-877a-739c490b7b65","modified":"2026-04-29T14:23:05.913Z","references":[{"source_name":"Fidelis njRAT June 2013","url":"https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"},{"source_name":"Trend Micro njRAT 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"},{"source_name":"Citizen Lab Group5","url":"https://citizenlab.ca/2016/08/group5-syria/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0cba3f24-f1b0-4184-afd4-f7bd3d34c49b","subject":"ATTACK:enterprise:S1246","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0cba3f24-f1b0-4184-afd4-f7bd3d34c49b","modified":"2026-04-29T14:23:05.920Z","references":[{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d4d7376-5bda-44bc-b90d-0a065bb99433","subject":"ATTACK:enterprise:S0089","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d4d7376-5bda-44bc-b90d-0a065bb99433","modified":"2026-04-29T14:23:05.921Z","references":[{"source_name":"F-Secure BlackEnergy 2014","url":"https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"},{"source_name":"Securelist BlackEnergy Nov 2014","url":"https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d4e8cb8-c265-449a-b010-f4614135572f","subject":"ATTACK:enterprise:S0132","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d4e8cb8-c265-449a-b010-f4614135572f","modified":"2026-04-29T14:23:05.921Z","references":[{"source_name":"Cisco H1N1 Part 2","url":"https://web.archive.org/web/20231210122239/https://blogs.cisco.com/security/h1n1-technical-analysis-reveals-new-capabilities-part-2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--10432a2f-2a96-46ad-b9c1-c35f405c09db","subject":"ATTACK:enterprise:S1122","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--10432a2f-2a96-46ad-b9c1-c35f405c09db","modified":"2026-04-29T14:23:05.926Z","references":[{"source_name":"ESET Security Mispadu Facebook Ads 2019","url":"https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"},{"source_name":"Metabase Q Mispadu Trojan 2023","url":"https://www.metabaseq.com/mispadu-banking-trojan/"},{"source_name":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--14307b7b-0837-4c15-a959-0c8d24e05b6b","subject":"ATTACK:enterprise:S0434","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--14307b7b-0837-4c15-a959-0c8d24e05b6b","modified":"2026-04-29T14:23:05.931Z","references":[{"source_name":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--151d1f28-13c0-4186-a636-f3131b6a6869","subject":"ATTACK:enterprise:S9062","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--151d1f28-13c0-4186-a636-f3131b6a6869","modified":"2026-10-01T13:05:51.037Z","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--17d2730a-c2b7-4d58-b22f-921600daccfb","subject":"ATTACK:enterprise:S0365","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--17d2730a-c2b7-4d58-b22f-921600daccfb","modified":"2026-04-29T14:23:05.937Z","references":[{"source_name":"Talos Olympic Destroyer 2018","url":"https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1910d7f9-b71c-4a85-80ad-74b6722aa208","subject":"ATTACK:enterprise:S0528","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1910d7f9-b71c-4a85-80ad-74b6722aa208","modified":"2026-04-29T14:23:05.938Z","references":[{"source_name":"Securelist Brazilian Banking Malware July 2020","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--19bfa4e1-509b-417a-9bcc-b739f7d798a7","subject":"ATTACK:enterprise:S0492","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--19bfa4e1-509b-417a-9bcc-b739f7d798a7","modified":"2026-04-29T14:23:05.940Z","references":[{"source_name":"Unit42 CookieMiner Jan 2019","url":"https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1df7df54-c4c1-49f0-a0c3-11102db44f2c","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1df7df54-c4c1-49f0-a0c3-11102db44f2c","modified":"2026-07-31T20:48:26.201Z","references":[{"source_name":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1f552cc5-66fe-44a6-8881-8e127fc5c0f0","subject":"ATTACK:enterprise:S1042","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1f552cc5-66fe-44a6-8881-8e127fc5c0f0","modified":"2026-04-29T14:23:05.947Z","references":[{"source_name":"Mandiant UNC3890 Aug 2022","url":"https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--21f211bb-733d-4fed-b8c5-e008811097db","subject":"ATTACK:enterprise:S1213","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--21f211bb-733d-4fed-b8c5-e008811097db","modified":"2026-04-29T14:23:05.951Z","references":[{"source_name":"TrendMicro LummaStealer 2025","url":"https://www.trendmicro.com/en_us/research/25/a/lumma-stealers-github-based-delivery-via-mdr.html"},{"source_name":"Fortinet LummaStealer 2024","url":"https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube"},{"source_name":"Cybereason LumaStealer Undated","url":"https://www.cybereason.com/blog/threat-analysis-rise-of-lummastealer"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--23b9cf45-fbd6-49b9-892d-6f3b1de18f9f","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--23b9cf45-fbd6-49b9-892d-6f3b1de18f9f","modified":"2026-07-31T20:48:26.864Z","references":[{"source_name":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--25a92f58-75d6-46a5-8e82-7f576f9659a5","subject":"ATTACK:enterprise:S0670","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--25a92f58-75d6-46a5-8e82-7f576f9659a5","modified":"2026-04-29T14:23:05.956Z","references":[{"source_name":"Check Point Warzone Feb 2020","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"},{"source_name":"Uptycs Warzone UAC Bypass November 2020","url":"https://www.uptycs.com/blog/warzone-rat-comes-with-uac-bypass-technique"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--28093010-d22d-43d7-9570-79e442336eae","subject":"ATTACK:enterprise:S1201","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--28093010-d22d-43d7-9570-79e442336eae","modified":"2026-04-29T14:23:05.959Z","references":[{"source_name":"Zscaler Kimsuky TRANSLATEXT","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--28757531-79b3-4c51-8e6c-b9b317a06abd","subject":"ATTACK:enterprise:G0128","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--28757531-79b3-4c51-8e6c-b9b317a06abd","modified":"2026-07-31T18:47:52.151Z","references":[{"source_name":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--29403801-cdba-4de9-9b9c-c1295b9eccf6","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--29403801-cdba-4de9-9b9c-c1295b9eccf6","modified":"2026-04-29T14:23:05.961Z","references":[{"source_name":"Talos Konni May 2017","url":"https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2bc01152-d964-4d53-86bd-a35e56200379","subject":"ATTACK:enterprise:G1026","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2bc01152-d964-4d53-86bd-a35e56200379","modified":"2026-07-31T18:48:15.912Z","references":[{"source_name":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2cac54a6-fe28-45b2-b4f7-53a23f8a5f54","subject":"ATTACK:enterprise:C0024","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2cac54a6-fe28-45b2-b4f7-53a23f8a5f54","modified":"2026-07-31T18:47:26.442Z","references":[{"source_name":"CrowdStrike StellarParticle January 2022","url":"https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--352953e9-c1ca-4d25-84b6-eb05a012b2e9","subject":"ATTACK:enterprise:S0240","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--352953e9-c1ca-4d25-84b6-eb05a012b2e9","modified":"2026-04-29T14:23:05.990Z","references":[{"source_name":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--360f1c0d-c6ec-4d49-92a0-e8ce63559960","subject":"ATTACK:enterprise:S0262","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--360f1c0d-c6ec-4d49-92a0-e8ce63559960","modified":"2026-04-29T14:23:05.993Z","references":[{"source_name":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source_name":"GitHub QuasarRAT","url":"https://github.com/quasar/QuasarRAT"},{"source_name":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3911c758-2c61-4615-88a1-4b9f21c99a9c","subject":"ATTACK:enterprise:G0022","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3911c758-2c61-4615-88a1-4b9f21c99a9c","modified":"2026-07-31T18:47:37.743Z","references":[{"source_name":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3b806ebb-0c5d-4ba8-adf8-b215a59f81b0","subject":"ATTACK:enterprise:S0349","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3b806ebb-0c5d-4ba8-adf8-b215a59f81b0","modified":"2026-04-29T14:23:06.003Z","references":[{"source_name":"GitHub LaZagne Dec 2018","url":"https://github.com/AlessandroZ/LaZagne"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3baf9dda-1286-4a3b-874b-7a04f0172aae","subject":"ATTACK:enterprise:G0064","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3baf9dda-1286-4a3b-874b-7a04f0172aae","modified":"2026-07-31T20:48:53.051Z","references":[{"source_name":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"},{"source_name":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4086a9d6-5574-48fb-be8d-e8406145e740","subject":"ATTACK:enterprise:S0153","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4086a9d6-5574-48fb-be8d-e8406145e740","modified":"2026-04-29T14:23:06.013Z","references":[{"source_name":"Accenture Hogfish April 2018","url":"http://web.archive.org/web/20220810112638/https:/www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--410e0c58-d96c-40ae-bf00-2d4b414daf50","subject":"ATTACK:enterprise:G0038","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--410e0c58-d96c-40ae-bf00-2d4b414daf50","modified":"2026-07-31T18:48:07.196Z","references":[{"source_name":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--416dfc14-ae33-49f7-8084-d35dee036dc1","subject":"ATTACK:enterprise:S1146","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--416dfc14-ae33-49f7-8084-d35dee036dc1","modified":"2026-04-29T14:23:06.014Z","references":[{"source_name":"ESET EvasivePanda 2023","url":"https://www.welivesecurity.com/2023/04/26/evasive-panda-apt-group-malware-updates-popular-chinese-software/"},{"source_name":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--426c8308-0856-4dad-85e6-87df276cfa69","subject":"ATTACK:enterprise:S0436","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--426c8308-0856-4dad-85e6-87df276cfa69","modified":"2026-04-29T14:23:06.016Z","references":[{"source_name":"JPCert TSCookie March 2018","url":"https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--44aeb943-8861-4018-a93b-beeb393bfa8f","subject":"ATTACK:enterprise:S0226","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--44aeb943-8861-4018-a93b-beeb393bfa8f","modified":"2026-04-29T14:23:06.019Z","references":[{"source_name":"Talos Smoke Loader July 2018","url":"https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html#more"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--47173be4-dc15-49c6-9e81-cba36c6e6c68","subject":"ATTACK:enterprise:S0331","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--47173be4-dc15-49c6-9e81-cba36c6e6c68","modified":"2026-04-29T14:23:06.022Z","references":[{"source_name":"Bitdefender Agent Tesla April 2020","url":"https://labs.bitdefender.com/2020/04/oil-gas-spearphishing-campaigns-drop-agent-tesla-spyware-in-advance-of-historic-opec-deal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4889f7a3-2c36-423a-b48d-c5405e07442f","subject":"ATTACK:enterprise:S0192","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4889f7a3-2c36-423a-b48d-c5405e07442f","modified":"2026-04-29T14:23:06.024Z","references":[{"source_name":"GitHub Pupy","url":"https://github.com/n1nj4sec/pupy"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--48a5f18e-d744-4600-8489-18533cadb0c0","subject":"ATTACK:enterprise:S0409","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--48a5f18e-d744-4600-8489-18533cadb0c0","modified":"2026-04-29T14:23:06.024Z","references":[{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4e16de60-84f8-47c8-a069-a7af5178b13d","subject":"ATTACK:enterprise:S9010","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4e16de60-84f8-47c8-a069-a7af5178b13d","modified":"2026-04-29T14:23:06.031Z","references":[{"source_name":"Koi Glassworm New Tricks December 2025","url":"https://www.koi.ai/blog/glassworm-goes-mac-fresh-infrastructure-new-tricks"},{"source_name":"Socket GlassWorm January 2026","url":"https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4ffe77f2-8b05-40ff-b572-f7c0b9040571","subject":"ATTACK:enterprise:S0344","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4ffe77f2-8b05-40ff-b572-f7c0b9040571","modified":"2026-04-29T14:23:06.034Z","references":[{"source_name":"Unit42 Azorult Nov 2018","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5033a0a2-ef95-4ec6-b5ac-d7cfbd7be9f0","subject":"ATTACK:enterprise:S0113","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5033a0a2-ef95-4ec6-b5ac-d7cfbd7be9f0","modified":"2026-04-29T14:23:06.035Z","references":[{"source_name":"ESET Operation Groundbait","url":"http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--519b3d7a-2de3-470b-a1cd-f40d0c351ea3","subject":"ATTACK:enterprise:S0094","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--519b3d7a-2de3-470b-a1cd-f40d0c351ea3","modified":"2026-04-29T14:23:06.037Z","references":[{"source_name":"Secureworks Karagany July 2019","url":"https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--56213677-9ebd-475c-b7a1-be35665dd4e6","subject":"ATTACK:enterprise:S1156","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--56213677-9ebd-475c-b7a1-be35665dd4e6","modified":"2026-04-29T14:23:06.043Z","references":[{"source_name":"Talos Manjusaka 2022","url":"https://blog.talosintelligence.com/manjusaka-offensive-framework/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--59e682dd-3a1f-48ab-8e1f-3fb967676931","subject":"ATTACK:enterprise:S0526","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--59e682dd-3a1f-48ab-8e1f-3fb967676931","modified":"2026-04-29T14:23:06.048Z","references":[{"source_name":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5d3f58bf-2192-46f9-bba3-27e917b75df6","subject":"ATTACK:enterprise:G0077","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5d3f58bf-2192-46f9-bba3-27e917b75df6","modified":"2026-07-31T18:47:49.095Z","references":[{"source_name":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5e596415-354e-4ccc-bc9d-3deb3fe5de1e","subject":"ATTACK:enterprise:G0067","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5e596415-354e-4ccc-bc9d-3deb3fe5de1e","modified":"2026-07-31T18:47:55.335Z","references":[{"source_name":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--62943e4f-a181-4eb2-84a4-27ed3e7308af","subject":"ATTACK:enterprise:S0050","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--62943e4f-a181-4eb2-84a4-27ed3e7308af","modified":"2026-04-29T14:23:06.059Z","references":[{"source_name":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6930c084-c02c-4278-8343-6a47fed4fdc0","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6930c084-c02c-4278-8343-6a47fed4fdc0","modified":"2026-07-31T20:48:32.990Z","references":[{"source_name":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--695c2f41-140a-48f9-9e14-0cd58d7712d1","subject":"ATTACK:enterprise:S0138","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--695c2f41-140a-48f9-9e14-0cd58d7712d1","modified":"2026-04-29T14:23:06.068Z","references":[{"source_name":"FireEye APT28","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--70166ae9-63ec-4d74-be69-ec42a39c239c","subject":"ATTACK:enterprise:S0629","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--70166ae9-63ec-4d74-be69-ec42a39c239c","modified":"2026-04-29T14:23:06.078Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7804d727-91bc-41bd-9b05-686d550e9e04","subject":"ATTACK:enterprise:S0002","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7804d727-91bc-41bd-9b05-686d550e9e04","modified":"2026-04-29T14:23:06.089Z","references":[{"source_name":"Deply Mimikatz","url":"https://github.com/gentilkiwi/mimikatz"},{"source_name":"GitHub Mimikatz lsadump Module","url":"https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump"},{"source_name":"Directory Services Internals DPAPI Backup Keys Oct 2015","url":"https://www.dsinternals.com/en/retrieving-dpapi-backup-keys-from-active-directory/"},{"source_name":"NCSC Joint Report Public Tools","url":"https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7ac04e64-a09e-4a66-b6ce-047030400045","subject":"ATTACK:enterprise:S0367","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7ac04e64-a09e-4a66-b6ce-047030400045","modified":"2026-04-29T14:23:06.093Z","references":[{"source_name":"Trend Micro Emotet Jan 2019","url":"https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf"},{"source_name":"IBM IcedID November 2017","url":"https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8117e136-627c-41bf-94ae-c99ff300c5a1","subject":"ATTACK:enterprise:S1245","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8117e136-627c-41bf-94ae-c99ff300c5a1","modified":"2026-04-29T14:23:06.102Z","references":[{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--81abc87e-ce9f-4b03-af21-b1f35d0b64ec","subject":"ATTACK:enterprise:S1148","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--81abc87e-ce9f-4b03-af21-b1f35d0b64ec","modified":"2026-04-29T14:23:06.103Z","references":[{"source_name":"Sekoia Raccoon2 2022","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--885cab64-2589-4917-95ab-4ae5a2b75cd3","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--885cab64-2589-4917-95ab-4ae5a2b75cd3","modified":"2026-07-31T20:48:29.967Z","references":[{"source_name":"Symantec MuddyWater Dec 2018","url":"https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"},{"source_name":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--890f944f-190d-456d-b194-f5ecb17a0868","subject":"ATTACK:enterprise:S0283","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--890f944f-190d-456d-b194-f5ecb17a0868","modified":"2026-04-29T14:23:06.112Z","references":[{"source_name":"Kaspersky Adwind Feb 2016","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8e2cd29d-5d72-450d-8697-d7121e1b2e8d","subject":"ATTACK:enterprise:S0692","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8e2cd29d-5d72-450d-8697-d7121e1b2e8d","modified":"2026-04-29T14:23:06.119Z","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8f58a6f1-f95b-4f38-8347-995880aa6029","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8f58a6f1-f95b-4f38-8347-995880aa6029","modified":"2026-04-29T14:23:06.120Z","references":[{"source_name":"Red Canary NETWIRE January 2020","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"},{"source_name":"FireEye NETWIRE March 2019","url":"https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"},{"source_name":"Proofpoint NETWIRE December 2020","url":"https://www.proofpoint.com/us/blog/threat-insight/geofenced-netwire-campaigns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--91a7667b-592f-45c1-a069-986380d29e71","subject":"ATTACK:enterprise:S0530","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--91a7667b-592f-45c1-a069-986380d29e71","modified":"2026-04-29T14:23:06.124Z","references":[{"source_name":"Securelist Brazilian Banking Malware July 2020","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--945108e9-bf13-48ed-bdf5-a7888d0f9fba","subject":"ATTACK:enterprise:S1207","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--945108e9-bf13-48ed-bdf5-a7888d0f9fba","modified":"2026-04-29T14:23:06.127Z","references":[{"source_name":"Netskope XLoader 2022","url":"https://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails"},{"source_name":"Google XLoader 2017","url":"https://cloud.google.com/blog/topics/threat-intelligence/formbook-malware-distribution-campaigns/"},{"source_name":"Zscaler XLoader 2025","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-xloader-versions-6-and-7-part-1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--956078f0-e1b1-4be7-9bf3-f03630ec3f1b","subject":"ATTACK:enterprise:G1004","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--956078f0-e1b1-4be7-9bf3-f03630ec3f1b","modified":"2026-07-31T20:48:49.429Z","references":[{"source_name":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--965ea950-3680-4317-8f73-996157632a0e","subject":"ATTACK:enterprise:S0657","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--965ea950-3680-4317-8f73-996157632a0e","modified":"2026-04-29T14:23:06.130Z","references":[{"source_name":"Volexity InkySquid BLUELIGHT August 2021","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--976118d5-b033-4dfc-b4be-b8190f2cf641","subject":"ATTACK:enterprise:S9022","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--976118d5-b033-4dfc-b4be-b8190f2cf641","modified":"2026-04-29T14:23:06.131Z","references":[{"source_name":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9bc7f2ff-7ba1-42f4-9e96-2112e99ab12a","subject":"ATTACK:enterprise:S0144","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9bc7f2ff-7ba1-42f4-9e96-2112e99ab12a","modified":"2026-04-29T14:23:06.137Z","references":[{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9ca71386-44e2-41e5-aecf-796de464855d","subject":"ATTACK:enterprise:S0279","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9ca71386-44e2-41e5-aecf-796de464855d","modified":"2026-04-29T14:23:06.138Z","references":[{"source_name":"objsee mac malware 2017","url":"https://objective-see.com/blog/blog_0x25.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9d588be8-f13d-458d-9480-f39ef82197d6","subject":"ATTACK:enterprise:G1001","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9d588be8-f13d-458d-9480-f39ef82197d6","modified":"2026-07-31T20:48:51.830Z","references":[{"source_name":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9e27c930-eba5-467f-90e5-4ec5b4219735","subject":"ATTACK:enterprise:G0092","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9e27c930-eba5-467f-90e5-4ec5b4219735","modified":"2026-07-31T18:48:05.692Z","references":[{"source_name":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a06bd922-b887-4134-81cb-1e4180cf5a5a","subject":"ATTACK:enterprise:G0021","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a06bd922-b887-4134-81cb-1e4180cf5a5a","modified":"2026-07-31T18:48:23.779Z","references":[{"source_name":"DustySky","url":"https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a0704053-1dec-4f7d-bcb2-ff2372640b02","subject":"ATTACK:enterprise:S1240","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a0704053-1dec-4f7d-bcb2-ff2372640b02","modified":"2026-04-29T14:23:06.144Z","references":[{"source_name":"ESET RedLine Stealer November 2024","url":"https://www.welivesecurity.com/en/eset-research/life-crooked-redline-analyzing-infamous-infostealers-backend/"},{"source_name":"Kroll RedLine Stealer August 2024","url":"https://www.kroll.com/en/publications/cyber/redlinestealer-malware"},{"source_name":"Proofpoint RedLine Stealer March 2020","url":"https://www.proofpoint.com/us/blog/threat-insight/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign"},{"source_name":"Splunk RedLine Stealer June 2023","url":"https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a2ff468d-e5a3-4dea-a9b4-ca3583d7a72c","subject":"ATTACK:enterprise:M1051","predicate":"mitigates","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a2ff468d-e5a3-4dea-a9b4-ca3583d7a72c","modified":"2026-04-29T14:23:06.147Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a3d4b793-b11a-4d6d-9a72-8c592a1eb834","subject":"ATTACK:enterprise:M1018","predicate":"mitigates","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a3d4b793-b11a-4d6d-9a72-8c592a1eb834","modified":"2026-04-29T14:23:06.148Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a454aae7-c327-4df5-af79-1191f8128f4e","subject":"ATTACK:enterprise:M1017","predicate":"mitigates","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a454aae7-c327-4df5-af79-1191f8128f4e","modified":"2026-04-29T14:23:06.148Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a76e4748-2cef-4ee6-96a3-53ee227f0333","subject":"ATTACK:enterprise:S0130","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a76e4748-2cef-4ee6-96a3-53ee227f0333","modified":"2026-04-29T14:23:06.153Z","references":[{"source_name":"Forcepoint Monsoon","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ac196369-5b5b-4e71-805a-3f64f150b1e2","subject":"ATTACK:enterprise:G0130","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ac196369-5b5b-4e71-805a-3f64f150b1e2","modified":"2026-07-31T18:48:28.092Z","references":[{"source_name":"Check Point Rocket Kitten","url":"https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ad3298b6-8cb5-4c4e-b2be-e058273c15be","subject":"ATTACK:enterprise:G0100","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ad3298b6-8cb5-4c4e-b2be-e058273c15be","modified":"2026-07-31T18:48:25.264Z","references":[{"source_name":"Symantec Inception Framework March 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--adf7a6a5-91b0-4c37-9fa5-0bfbb382a838","subject":"ATTACK:enterprise:S0093","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--adf7a6a5-91b0-4c37-9fa5-0bfbb382a838","modified":"2026-04-29T14:23:06.162Z","references":[{"source_name":"Symantec Dragonfly","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b2ab1f44-2c92-4c1e-ba9e-c61737a59323","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b2ab1f44-2c92-4c1e-ba9e-c61737a59323","modified":"2026-09-30T20:39:41.368Z","references":[{"source_name":"Microsoft Sapphire Sleet APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"},{"source_name":"MIcrosoft Mastra npm Compromise JUN 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b620d7cd-34ef-402c-b8c2-e36c27162c63","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b620d7cd-34ef-402c-b8c2-e36c27162c63","modified":"2026-07-31T18:47:41.031Z","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b6d8f711-8b5f-4b5e-82c4-abf144223c55","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b6d8f711-8b5f-4b5e-82c4-abf144223c55","modified":"2026-07-31T20:48:25.357Z","references":[{"source_name":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"Netscout Stolen Pencil Dec 2018","url":"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"},{"source_name":"Zdnet Kimsuky Dec 2018","url":"https://www.zdnet.com/article/cyber-espionage-group-uses-chrome-extension-to-infect-victims/"},{"source_name":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b97afcfc-489a-4d59-89b3-1533eae926e0","subject":"ATTACK:enterprise:S0363","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b97afcfc-489a-4d59-89b3-1533eae926e0","modified":"2026-04-29T14:23:06.178Z","references":[{"source_name":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b9e2fac9-fc1a-4e13-ac68-1a5796b04d72","subject":"ATTACK:enterprise:S0161","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b9e2fac9-fc1a-4e13-ac68-1a5796b04d72","modified":"2026-04-29T14:23:06.179Z","references":[{"source_name":"XAgentOSX 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ba93bce7-7214-45e9-9deb-4fefb5038aab","subject":"ATTACK:enterprise:S0681","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ba93bce7-7214-45e9-9deb-4fefb5038aab","modified":"2026-04-29T14:23:06.179Z","references":[{"source_name":"BiZone Lizar May 2021","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--be16ecaf-46a6-4602-8d7e-0273c9983520","subject":"ATTACK:enterprise:S9050","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--be16ecaf-46a6-4602-8d7e-0273c9983520","modified":"2026-09-11T19:22:47.182Z","references":[{"source_name":"Cyfirma_Vidar_June2024","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"},{"source_name":"Intrinsec_Vidar_April2026","url":"https://www.intrinsec.com/wp-content/uploads/2026/04/TLP_CLEAR-20260424-New_Vidar.pdf"},{"source_name":"LevelBlue_Vidar_May2026","url":"https://www.levelblue.com/blogs/spiderlabs-blog/unmasking-a-multi-stage-loader-autoit-abuse-leading-to-vidar-stealer-command-and-control-communication"},{"source_name":"Unit42_Vidar_July2026","url":"https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/"},{"source_name":"QuorumCyber_Vidar_March2023","url":"https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c375648a-e0ce-49f1-8428-d498444e0e64","subject":"ATTACK:enterprise:M1021","predicate":"mitigates","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c375648a-e0ce-49f1-8428-d498444e0e64","modified":"2026-04-29T14:23:06.192Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d2bb226a-810d-47ea-be8d-397b9dd94031","subject":"ATTACK:enterprise:M1027","predicate":"mitigates","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d2bb226a-810d-47ea-be8d-397b9dd94031","modified":"2026-04-29T14:23:06.214Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d5943cbb-6a13-41ff-9aaf-4213b46b83cd","subject":"ATTACK:enterprise:S0048","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d5943cbb-6a13-41ff-9aaf-4213b46b83cd","modified":"2026-04-29T14:23:06.217Z","references":[{"source_name":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dafc7834-fbb5-426c-adce-957742078002","subject":"ATTACK:enterprise:G0049","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dafc7834-fbb5-426c-adce-957742078002","modified":"2026-07-31T20:48:35.908Z","references":[{"source_name":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source_name":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source_name":"FireEye APT35 2018","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"},{"source_name":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dcb0f1a0-18e5-47e0-ab2a-324aca7f89ba","subject":"ATTACK:enterprise:G1039","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dcb0f1a0-18e5-47e0-ab2a-324aca7f89ba","modified":"2026-07-31T18:48:06.486Z","references":[{"source_name":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e49cb6bd-78c8-4826-a292-a7c5d3096d2b","subject":"ATTACK:enterprise:S0387","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e49cb6bd-78c8-4826-a292-a7c5d3096d2b","modified":"2026-04-29T14:23:06.236Z","references":[{"source_name":"Rapid7 KeyBoy Jun 2013","url":"https://blog.rapid7.com/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e92c4fd7-eb92-4255-80c3-abaa9262845f","subject":"ATTACK:enterprise:T1555.003","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1555","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e92c4fd7-eb92-4255-80c3-abaa9262845f","modified":"2026-04-29T14:23:06.242Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eadd5ace-0afb-4812-8834-e0dd56b9b129","subject":"ATTACK:enterprise:S0531","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eadd5ace-0afb-4812-8834-e0dd56b9b129","modified":"2026-04-29T14:23:06.245Z","references":[{"source_name":"IBM Grandoreiro April 2020","url":"https://securityintelligence.com/posts/grandoreiro-malware-now-targeting-banks-in-spain/"},{"source_name":"ESET Grandoreiro April 2020","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eaf2533c-e25e-4d4c-a7e5-62342a874bb1","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eaf2533c-e25e-4d4c-a7e5-62342a874bb1","modified":"2026-04-29T14:23:06.245Z","references":[{"source_name":"Kaspersky QakBot September 2021","url":"https://securelist.com/qakbot-technical-analysis/103931/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ed74954d-4717-4d63-9836-4cbd66c37345","subject":"ATTACK:enterprise:S0115","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ed74954d-4717-4d63-9836-4cbd66c37345","modified":"2026-04-29T14:23:06.248Z","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Kaspersky Transparent Tribe August 2020","url":"https://securelist.com/transparent-tribe-part-1/98127/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f097444b-fa65-4457-943c-5061e29f9ef0","subject":"ATTACK:enterprise:G0037","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f097444b-fa65-4457-943c-5061e29f9ef0","modified":"2026-07-31T20:48:31.122Z","references":[{"source_name":"Visa FIN6 Feb 2019","url":"https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f0dd2703-4846-47b5-a8d8-471f70f9968e","subject":"ATTACK:enterprise:S0266","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f0dd2703-4846-47b5-a8d8-471f70f9968e","modified":"2026-04-29T14:23:06.253Z","references":[{"source_name":"Trend Micro Trickbot Nov 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-shows-off-new-trick-password-grabber-module/"},{"source_name":"Cyberreason Anchor December 2019","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"},{"source_name":"Bitdefender Trickbot VNC module Whitepaper 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/399/Bitdefender-PR-Whitepaper-Trickbot-creat5515-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f1952dea-f9d6-421b-947e-502796e2c883","subject":"ATTACK:enterprise:S0435","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f1952dea-f9d6-421b-947e-502796e2c883","modified":"2026-04-29T14:23:06.254Z","references":[{"source_name":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"},{"source_name":"ESET PLEAD Malware July 2018","url":"https://www.welivesecurity.com/2018/07/09/certificates-stolen-taiwanese-tech-companies-plead-malware-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f3927864-d7dd-4bf3-8b2a-2a5445eb4004","subject":"ATTACK:enterprise:S0428","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f3927864-d7dd-4bf3-8b2a-2a5445eb4004","modified":"2026-04-29T14:23:06.256Z","references":[{"source_name":"Talos PoetRAT April 2020","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f6a37d81-94e3-4746-901d-2e0f928153b6","subject":"ATTACK:enterprise:S9057","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f6a37d81-94e3-4746-901d-2e0f928153b6","modified":"2026-09-28T16:05:26.443Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f78a77ca-2a03-4a1f-8404-9adf1e504d48","subject":"ATTACK:enterprise:S0631","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f78a77ca-2a03-4a1f-8404-9adf1e504d48","modified":"2026-04-29T14:23:06.261Z","references":[{"source_name":"Cybereason Chaes Nov 2020","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fafa8b19-211d-4878-9d80-2126e1604b68","subject":"ATTACK:enterprise:S0484","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fafa8b19-211d-4878-9d80-2126e1604b68","modified":"2026-04-29T14:23:06.266Z","references":[{"source_name":"Prevx Carberp March 2011","url":"https://web.archive.org/web/20231227000328/http://pxnow.prevx.com/content/blog/carberp-a_modular_information_stealing_trojan.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fb4daaf8-3e27-4ec5-b2e0-932e8fa906c5","subject":"ATTACK:enterprise:G1044","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fb4daaf8-3e27-4ec5-b2e0-932e8fa906c5","modified":"2026-07-31T18:48:16.580Z","references":[{"source_name":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fd9b9c3a-544b-43e1-b4f4-aab6e646eb31","subject":"ATTACK:enterprise:S0251","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fd9b9c3a-544b-43e1-b4f4-aab6e646eb31","modified":"2026-04-29T14:23:06.269Z","references":[{"source_name":"ESET Zebrocy May 2019","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fe5fd754-0170-44ac-a51c-cf2efba3bfee","subject":"ATTACK:enterprise:C0044","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fe5fd754-0170-44ac-a51c-cf2efba3bfee","modified":"2026-07-31T21:13:47.760Z","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fe69bcdd-8df4-44e3-8994-b46e4d4c8aac","subject":"ATTACK:enterprise:S0447","predicate":"uses","object":"ATTACK:enterprise:T1555.003","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fe69bcdd-8df4-44e3-8994-b46e4d4c8aac","modified":"2026-04-29T14:23:06.270Z","references":[{"source_name":"Infoblox Lokibot January 2019","url":"https://insights.infoblox.com/threat-intelligence-reports/threat-intelligence--22"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}