Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference.
{
  "record": {
    "id": "ATTACK:enterprise:T1560.001",
    "title": "Archive via Utility",
    "type": "Subtechnique",
    "source_url": "https://attack.mitre.org/techniques/T1560/001",
    "snapshot": "enterprise-attack-20.0.json",
    "status": "active",
    "rights": "Source metadata only; source notices retained; no operational prose or payloads",
    "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
    "stix_id": "attack-pattern--00f90846-cbd1-4fc5-9233-df5c2bf2a662",
    "external_id": "T1560.001",
    "domain": "enterprise",
    "created": "2020-02-20T21:01:25.428Z",
    "modified": "2026-05-12T15:12:00.619Z",
    "version": "1.3",
    "aliases": [

    ],
    "tactics": [
      "collection"
    ],
    "source_references": [
      {
        "source_name": "WinRAR Homepage",
        "url": "https://www.rarlab.com/"
      },
      {
        "source_name": "WinZip Homepage",
        "url": "https://www.winzip.com/win/en/"
      },
      {
        "source_name": "7zip Homepage",
        "url": "https://www.7-zip.org/"
      },
      {
        "source_name": "diantz.exe_lolbas",
        "url": "https://lolbas-project.github.io/lolbas/Binaries/Diantz/"
      },
      {
        "source_name": "Wikipedia File Header Signatures",
        "url": "https://en.wikipedia.org/wiki/List_of_file_signatures"
      }
    ]
  },
  "assertions": [
    {
      "id": "enterprise:relationship--01202a82-56cc-4770-abf1-1a37c8717dba",
      "subject": "ATTACK:enterprise:S0538",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--01202a82-56cc-4770-abf1-1a37c8717dba",
      "modified": "2026-04-29T14:23:05.904Z",
      "references": [
        {
          "source_name": "ESET Crutch December 2020",
          "url": "https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0b582433-b5e6-49d7-886c-e1edd1a0a802",
      "subject": "ATTACK:enterprise:S0439",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0b582433-b5e6-49d7-886c-e1edd1a0a802",
      "modified": "2026-04-29T14:23:05.919Z",
      "references": [
        {
          "source_name": "ESET Okrum July 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0b7dfe49-d8c3-46d8-84ed-bf1898638ac3",
      "subject": "ATTACK:enterprise:G0125",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0b7dfe49-d8c3-46d8-84ed-bf1898638ac3",
      "modified": "2026-07-31T18:47:44.113Z",
      "references": [
        {
          "source_name": "Microsoft HAFNIUM March 2020",
          "url": "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
        },
        {
          "source_name": "Volexity Exchange Marauder March 2021",
          "url": "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0f5462cb-ac39-49d1-848e-aefaaab321e3",
      "subject": "ATTACK:enterprise:S0160",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0f5462cb-ac39-49d1-848e-aefaaab321e3",
      "modified": "2026-04-29T14:23:05.925Z",
      "references": [
        {
          "source_name": "LOLBAS Certutil",
          "url": "https://lolbas-project.github.io/lolbas/Binaries/Certutil/"
        },
        {
          "source_name": "TechNet Certutil",
          "url": "https://technet.microsoft.com/library/cc732443.aspx"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--12ee5148-c274-4c94-a0da-69316cb329d2",
      "subject": "ATTACK:enterprise:C0012",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--12ee5148-c274-4c94-a0da-69316cb329d2",
      "modified": "2026-07-31T18:47:28.127Z",
      "references": [
        {
          "source_name": "Cybereason OperationCuckooBees May 2022",
          "url": "https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--17262c58-2f41-41d2-a86a-5bc86642ddb4",
      "subject": "ATTACK:enterprise:G0045",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--17262c58-2f41-41d2-a86a-5bc86642ddb4",
      "modified": "2026-07-31T18:47:43.638Z",
      "references": [
        {
          "source_name": "PWC Cloud Hopper Technical Annex April 2017",
          "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"
        },
        {
          "source_name": "PWC Cloud Hopper April 2017",
          "url": "https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"
        },
        {
          "source_name": "Symantec Cicada November 2020",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--18437772-ace9-4a63-b928-8f313dc44f1e",
      "subject": "ATTACK:enterprise:G0102",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--18437772-ace9-4a63-b928-8f313dc44f1e",
      "modified": "2026-07-31T20:48:50.015Z",
      "references": [
        {
          "source_name": "Mandiant FIN12 Oct 2021",
          "url": "https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1f48a517-c041-4845-9aba-2dce4f559b56",
      "subject": "ATTACK:enterprise:G0064",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1f48a517-c041-4845-9aba-2dce4f559b56",
      "modified": "2026-07-31T20:48:53.009Z",
      "references": [
        {
          "source_name": "Symantec Elfin Mar 2019",
          "url": "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--20a447db-9606-4f4a-a0e8-57167ba4535e",
      "subject": "ATTACK:enterprise:S9010",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--20a447db-9606-4f4a-a0e8-57167ba4535e",
      "modified": "2026-04-29T14:23:05.949Z",
      "references": [
        {
          "source_name": "Socket GlassWorm January 2026",
          "url": "https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--229d6377-d7a8-462c-8ead-c9fed3f08d10",
      "subject": "ATTACK:enterprise:C0051",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--229d6377-d7a8-462c-8ead-c9fed3f08d10",
      "modified": "2026-07-31T21:11:45.995Z",
      "references": [
        {
          "source_name": "Nearest Neighbor Volexity",
          "url": "https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--27fe3870-1ce3-4f62-be7c-6da08d09643c",
      "subject": "ATTACK:enterprise:S1043",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--27fe3870-1ce3-4f62-be7c-6da08d09643c",
      "modified": "2026-04-29T14:23:05.959Z",
      "references": [
        {
          "source_name": "Bitdefender FunnyDream Campaign November 2020",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--28d9ac63-ce5f-4d42-be72-6b4d99b6fda7",
      "subject": "ATTACK:enterprise:G0117",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--28d9ac63-ce5f-4d42-be72-6b4d99b6fda7",
      "modified": "2026-07-31T18:48:16.946Z",
      "references": [
        {
          "source_name": "CISA AA20-259A Iran-Based Actor September 2020",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-259a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2e82ef21-9fb2-421e-bd96-73599089b448",
      "subject": "ATTACK:enterprise:G0052",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2e82ef21-9fb2-421e-bd96-73599089b448",
      "modified": "2026-07-31T18:48:22.933Z",
      "references": [
        {
          "source_name": "ClearSky Wilted Tulip July 2017",
          "url": "http://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3d6d5bc0-2160-4152-9a4b-b2f19a8768b4",
      "subject": "ATTACK:enterprise:G1017",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3d6d5bc0-2160-4152-9a4b-b2f19a8768b4",
      "modified": "2026-07-31T18:47:39.995Z",
      "references": [
        {
          "source_name": "CISA AA24-038A PRC Critical Infrastructure February 2024",
          "url": "https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"
        },
        {
          "source_name": "Secureworks BRONZE SILHOUETTE May 2023",
          "url": "https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4082e0a3-e725-4f9f-98e2-3850c8cc8df2",
      "subject": "ATTACK:enterprise:S0260",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4082e0a3-e725-4f9f-98e2-3850c8cc8df2",
      "modified": "2026-04-29T14:23:06.013Z",
      "references": [
        {
          "source_name": "ESET InvisiMole June 2018",
          "url": "https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--43c34939-8236-4ddd-8def-0eb7b5fe62cf",
      "subject": "ATTACK:enterprise:G0006",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--43c34939-8236-4ddd-8def-0eb7b5fe62cf",
      "modified": "2026-07-31T18:48:01.078Z",
      "references": [
        {
          "source_name": "Mandiant APT1",
          "url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--449b3473-a6cc-4934-8441-84325f70e126",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--449b3473-a6cc-4934-8441-84325f70e126",
      "modified": "2026-07-31T18:47:52.203Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE PRESIDENT December 2019",
          "url": "https://www.secureworks.com/research/bronze-president-targets-ngos"
        },
        {
          "source_name": "Avira Mustang Panda January 2020",
          "url": "https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"
        },
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        },
        {
          "source_name": "Unit42 Chinese VSCode 06 September 2024",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--48ff3270-ada9-4f02-b4f4-bfd6a3a3865f",
      "subject": "ATTACK:enterprise:G1040",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--48ff3270-ada9-4f02-b4f4-bfd6a3a3865f",
      "modified": "2026-07-31T18:48:25.646Z",
      "references": [
        {
          "source_name": "CISA Play Ransomware Advisory December 2023",
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"
        },
        {
          "source_name": "Trend Micro Ransomware Spotlight Play July 2023",
          "url": "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--49fb7af8-50cf-4af5-9195-40b2351fa6dc",
      "subject": "ATTACK:enterprise:G0114",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--49fb7af8-50cf-4af5-9195-40b2351fa6dc",
      "modified": "2026-07-31T20:48:41.269Z",
      "references": [
        {
          "source_name": "Cycraft Chimera April 2020",
          "url": "https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"
        },
        {
          "source_name": "NCC Group Chimera January 2021",
          "url": "https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--51300de6-0f80-45dc-92f7-f48dbc887d8c",
      "subject": "ATTACK:enterprise:S0062",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--51300de6-0f80-45dc-92f7-f48dbc887d8c",
      "modified": "2026-04-29T14:23:06.036Z",
      "references": [
        {
          "source_name": "Kaspersky MoleRATs April 2019",
          "url": "https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5677034a-7015-44a2-94b3-9913bc76b9c7",
      "subject": "ATTACK:enterprise:G0084",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5677034a-7015-44a2-94b3-9913bc76b9c7",
      "modified": "2026-07-31T18:47:47.687Z",
      "references": [
        {
          "source_name": "Symantec Gallmaker Oct 2018",
          "url": "https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--57527643-2aef-4171-b61a-665ab8ed991b",
      "subject": "ATTACK:enterprise:S0187",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--57527643-2aef-4171-b61a-665ab8ed991b",
      "modified": "2026-04-29T14:23:06.044Z",
      "references": [
        {
          "source_name": "Symantec Tick Apr 2016",
          "url": "https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5808dec3-568e-41e4-8781-b1f6431965a2",
      "subject": "ATTACK:enterprise:C0063",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5808dec3-568e-41e4-8781-b1f6431965a2",
      "modified": "2026-07-31T20:48:19.648Z",
      "references": [
        {
          "source_name": "CERT Polska",
          "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--58401f64-b536-4a3c-a1e4-2c0d2da8db19",
      "subject": "ATTACK:enterprise:S1141",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--58401f64-b536-4a3c-a1e4-2c0d2da8db19",
      "modified": "2026-04-29T14:23:06.046Z",
      "references": [
        {
          "source_name": "ESET Turla Lunar toolset May 2024",
          "url": "https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5853e513-667f-4384-a803-e443889f8095",
      "subject": "ATTACK:enterprise:G1041",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5853e513-667f-4384-a803-e443889f8095",
      "modified": "2026-07-31T18:47:57.571Z",
      "references": [
        {
          "source_name": "Hunt Sea Turtle 2024",
          "url": "https://www.huntandhackett.com/blog/turkish-espionage-campaigns"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5d4ba3fe-d782-47e4-ad82-0b81142a5e1a",
      "subject": "ATTACK:enterprise:G0087",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5d4ba3fe-d782-47e4-ad82-0b81142a5e1a",
      "modified": "2026-07-31T18:47:53.645Z",
      "references": [
        {
          "source_name": "FireEye APT39 Jan 2019",
          "url": "https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--617ce344-2317-433a-b283-8e67b90b00f7",
      "subject": "ATTACK:enterprise:S0378",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--617ce344-2317-433a-b283-8e67b90b00f7",
      "modified": "2026-04-29T14:23:06.058Z",
      "references": [
        {
          "source_name": "GitHub PoshC2",
          "url": "https://github.com/nettitude/PoshC2_Python"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6239c9a5-5ab9-425d-a767-0d4e6262a598",
      "subject": "ATTACK:enterprise:C0014",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6239c9a5-5ab9-425d-a767-0d4e6262a598",
      "modified": "2026-07-31T18:47:31.581Z",
      "references": [
        {
          "source_name": "FoxIT Wocao December 2019",
          "url": "https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6559a4c7-ab95-45dc-ba38-0fb1b85aaa63",
      "subject": "ATTACK:enterprise:S9043",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6559a4c7-ab95-45dc-ba38-0fb1b85aaa63",
      "modified": "2026-07-29T19:22:46.670Z",
      "references": [
        {
          "source_name": "Trend Micro TeamPCP MAY 2026",
          "url": "https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--66573033-3145-402f-96ac-9bc2e26cac1d",
      "subject": "ATTACK:enterprise:S1168",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--66573033-3145-402f-96ac-9bc2e26cac1d",
      "modified": "2026-04-29T14:23:06.064Z",
      "references": [
        {
          "source_name": "ESET OilRig Downloaders DEC 2023",
          "url": "https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6a1d7178-8bad-42cc-81dd-cd74d949cede",
      "subject": "ATTACK:enterprise:T1560.001",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1560",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6a1d7178-8bad-42cc-81dd-cd74d949cede",
      "modified": "2026-04-29T14:23:06.069Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6d7ac1b0-acaa-4828-8863-9efda8f79589",
      "subject": "ATTACK:enterprise:G1039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6d7ac1b0-acaa-4828-8863-9efda8f79589",
      "modified": "2026-07-31T18:48:06.163Z",
      "references": [
        {
          "source_name": "trendmicro_redcurl",
          "url": "https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6e2fbf1f-9e92-4307-aaac-6d90c0f563f5",
      "subject": "ATTACK:enterprise:S1246",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6e2fbf1f-9e92-4307-aaac-6d90c0f563f5",
      "modified": "2026-04-29T14:23:06.075Z",
      "references": [
        {
          "source_name": "Socket BeaverTail XORIndex HexEval Contagious Interview July 2025",
          "url": "https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--705fe2ec-dbe1-4811-baf5-798f5f874639",
      "subject": "ATTACK:enterprise:G1023",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--705fe2ec-dbe1-4811-baf5-798f5f874639",
      "modified": "2026-07-31T18:48:17.033Z",
      "references": [
        {
          "source_name": "Mandiant Pulse Secure Update May 2021",
          "url": "https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--730b45b7-ec28-4402-933f-006e39ea2f60",
      "subject": "ATTACK:enterprise:G1030",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--730b45b7-ec28-4402-933f-006e39ea2f60",
      "modified": "2026-07-31T18:48:14.808Z",
      "references": [
        {
          "source_name": "Unit42 Agrius 2023",
          "url": "https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--73faed96-608b-4740-894f-0e2eaee92343",
      "subject": "ATTACK:enterprise:S0196",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--73faed96-608b-4740-894f-0e2eaee92343",
      "modified": "2026-04-29T14:23:06.084Z",
      "references": [
        {
          "source_name": "Morphisec ShellTea June 2019",
          "url": "http://blog.morphisec.com/security-alert-fin8-is-back"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--756f3884-c21b-4d00-ac2c-6c2ab386072f",
      "subject": "ATTACK:enterprise:S0458",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--756f3884-c21b-4d00-ac2c-6c2ab386072f",
      "modified": "2026-04-29T14:23:06.086Z",
      "references": [
        {
          "source_name": "Eset Ramsay May 2020",
          "url": "https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"
        },
        {
          "source_name": "Antiy CERT Ramsay April 2020",
          "url": "https://www.programmersought.com/article/62493896999/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7cad7951-1d39-4083-a394-37893df1fa3b",
      "subject": "ATTACK:enterprise:S9041",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7cad7951-1d39-4083-a394-37893df1fa3b",
      "modified": "2026-07-15T18:33:28.400Z",
      "references": [
        {
          "source_name": "Aqua Security Blog Trivy Compromise APR 2026",
          "url": "https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"
        },
        {
          "source_name": "Wiz Trivy Compromise MAR 2026",
          "url": "https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"
        },
        {
          "source_name": "Wiz TeamPCP KICS MAR 2026",
          "url": "https://www.wiz.io/blog/teampcp-attack-kics-github-action"
        },
        {
          "source_name": "Sysdig TeamPCP MAR 2026",
          "url": "https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--82c1c2da-e9c3-4e75-b563-22f4c1988035",
      "subject": "ATTACK:enterprise:C0007",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--82c1c2da-e9c3-4e75-b563-22f4c1988035",
      "modified": "2026-07-31T18:47:27.324Z",
      "references": [
        {
          "source_name": "Bitdefender FunnyDream Campaign November 2020",
          "url": "https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--855a735f-756f-4911-a69b-454439a38037",
      "subject": "ATTACK:enterprise:S0647",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--855a735f-756f-4911-a69b-454439a38037",
      "modified": "2026-04-29T14:23:06.107Z",
      "references": [
        {
          "source_name": "ESET BackdoorDiplomacy Jun 2021",
          "url": "https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--86246bef-ad4c-4c30-805a-d6f1928a7c20",
      "subject": "ATTACK:enterprise:G0093",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--86246bef-ad4c-4c30-805a-d6f1928a7c20",
      "modified": "2026-07-31T18:47:37.331Z",
      "references": [
        {
          "source_name": "Cybereason Soft Cell June 2019",
          "url": "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
        },
        {
          "source_name": "Microsoft GALLIUM December 2019",
          "url": "https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--89328749-11c5-416d-99b9-f3039afc487a",
      "subject": "ATTACK:enterprise:G0096",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--89328749-11c5-416d-99b9-f3039afc487a",
      "modified": "2026-07-31T20:48:27.330Z",
      "references": [
        {
          "source_name": "apt41_dcsocytec_dec2022",
          "url": "https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"
        },
        {
          "source_name": "FireEye APT41 Aug 2019",
          "url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8a45b5fc-2d41-445b-b478-fbf5d1bc3c30",
      "subject": "ATTACK:enterprise:S1022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8a45b5fc-2d41-445b-b478-fbf5d1bc3c30",
      "modified": "2026-04-29T14:23:06.114Z",
      "references": [
        {
          "source_name": "CrowdStrike IceApple May 2022",
          "url": "https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8cecace8-2820-4489-b3e8-baf4b9f33ff3",
      "subject": "ATTACK:enterprise:G0069",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8cecace8-2820-4489-b3e8-baf4b9f33ff3",
      "modified": "2026-07-31T20:48:29.990Z",
      "references": [
        {
          "source_name": "Symantec MuddyWater Dec 2018",
          "url": "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--90bb9179-c20a-4223-a177-731f015052aa",
      "subject": "ATTACK:enterprise:G0007",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--90bb9179-c20a-4223-a177-731f015052aa",
      "modified": "2026-07-31T20:48:44.937Z",
      "references": [
        {
          "source_name": "Cybersecurity Advisory GRU Brute Force Campaign July 2021",
          "url": "https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--90bd9900-a78f-47da-9504-393e8ece3fac",
      "subject": "ATTACK:enterprise:S0278",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--90bd9900-a78f-47da-9504-393e8ece3fac",
      "modified": "2026-04-29T14:23:06.122Z",
      "references": [
        {
          "source_name": "objsee mac malware 2017",
          "url": "https://objective-see.com/blog/blog_0x25.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9284f651-5078-4b67-90dd-841397029edd",
      "subject": "ATTACK:enterprise:S0466",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9284f651-5078-4b67-90dd-841397029edd",
      "modified": "2026-04-29T14:23:06.125Z",
      "references": [
        {
          "source_name": "objective-see windtail2 jan 2019",
          "url": "https://objective-see.com/blog/blog_0x3D.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--929a1429-88a6-4ac8-b92e-39f242b1e0d6",
      "subject": "ATTACK:enterprise:C0026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--929a1429-88a6-4ac8-b92e-39f242b1e0d6",
      "modified": "2026-07-31T18:47:32.778Z",
      "references": [
        {
          "source_name": "Mandiant Suspected Turla Campaign February 2023",
          "url": "https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--931c0864-0b91-46b7-bdc0-0360777d95a6",
      "subject": "ATTACK:enterprise:G0010",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--931c0864-0b91-46b7-bdc0-0360777d95a6",
      "modified": "2026-07-31T18:48:04.148Z",
      "references": [
        {
          "source_name": "Symantec Waterbug Jun 2019",
          "url": "https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9448e565-a9ea-44c2-9c03-8f6112cd7d1d",
      "subject": "ATTACK:enterprise:M1047",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9448e565-a9ea-44c2-9c03-8f6112cd7d1d",
      "modified": "2026-04-29T14:23:06.127Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--948d9203-f418-4cf6-9618-e1e89f1ef2bb",
      "subject": "ATTACK:enterprise:S0212",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--948d9203-f418-4cf6-9618-e1e89f1ef2bb",
      "modified": "2026-04-29T14:23:06.127Z",
      "references": [
        {
          "source_name": "FireEye APT37 Feb 2018",
          "url": "https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--953134ab-5816-43b8-b2b1-8f4c9305f57a",
      "subject": "ATTACK:enterprise:G0054",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--953134ab-5816-43b8-b2b1-8f4c9305f57a",
      "modified": "2026-07-31T18:48:21.242Z",
      "references": [
        {
          "source_name": "Symantec Sowbug Nov 2017",
          "url": "https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--96d8b8bb-3bdc-481e-a554-41790acac66a",
      "subject": "ATTACK:enterprise:S0339",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--96d8b8bb-3bdc-481e-a554-41790acac66a",
      "modified": "2026-04-29T14:23:06.131Z",
      "references": [
        {
          "source_name": "Radware Micropsia July 2018",
          "url": "https://www.radware.com/blog/security/2018/07/micropsia-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--973ed739-22d9-433f-ba63-f4881639a22d",
      "subject": "ATTACK:enterprise:C0006",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--973ed739-22d9-433f-ba63-f4881639a22d",
      "modified": "2026-07-31T18:47:20.825Z",
      "references": [
        {
          "source_name": "McAfee Honeybee",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--99e9583f-433d-437d-bf37-7ea2b3f1b613",
      "subject": "ATTACK:enterprise:G0060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--99e9583f-433d-437d-bf37-7ea2b3f1b613",
      "modified": "2026-07-31T18:48:10.750Z",
      "references": [
        {
          "source_name": "Secureworks BRONZE BUTLER Oct 2017",
          "url": "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
        },
        {
          "source_name": "Trend Micro Tick November 2019",
          "url": "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9a8c6873-9807-4a83-99b0-16acd96ffde8",
      "subject": "ATTACK:enterprise:S1228",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9a8c6873-9807-4a83-99b0-16acd96ffde8",
      "modified": "2026-04-29T14:23:06.136Z",
      "references": [
        {
          "source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9f1f345a-043c-490f-8def-9b2bff370914",
      "subject": "ATTACK:enterprise:S9052",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9f1f345a-043c-490f-8def-9b2bff370914",
      "modified": "2026-09-24T18:53:43.232Z",
      "references": [
        {
          "source_name": "CheckPoint_NimbusManticore_May2026",
          "url": "https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9f7800b9-9152-4f4a-a7f7-ad5823b710c3",
      "subject": "ATTACK:enterprise:G1048",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9f7800b9-9152-4f4a-a7f7-ad5823b710c3",
      "modified": "2026-07-31T18:47:53.941Z",
      "references": [
        {
          "source_name": "Google Cloud Mandiant UNC3886 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"
        },
        {
          "source_name": "Google Cloud Threat Intelligence ESXi VIBs 2022",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9fdf1013-db2c-4aba-a723-e21ff9c18bee",
      "subject": "ATTACK:enterprise:C0029",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9fdf1013-db2c-4aba-a723-e21ff9c18bee",
      "modified": "2026-07-31T18:47:23.276Z",
      "references": [
        {
          "source_name": "Mandiant Cutting Edge Part 2 January 2024",
          "url": "https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a4d59eb9-9390-4f3c-9659-0083a041c576",
      "subject": "ATTACK:enterprise:S0332",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a4d59eb9-9390-4f3c-9659-0083a041c576",
      "modified": "2026-04-29T14:23:06.149Z",
      "references": [
        {
          "source_name": "Fortinet Remcos Campaign NOV 2024",
          "url": "https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ae4c3306-57b7-46da-8073-9336cf96e5cf",
      "subject": "ATTACK:enterprise:S0340",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ae4c3306-57b7-46da-8073-9336cf96e5cf",
      "modified": "2026-04-29T14:23:06.162Z",
      "references": [
        {
          "source_name": "ESET Nomadic Octopus 2018",
          "url": "https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b005a049-ecf3-4378-bff6-983b16f92482",
      "subject": "ATTACK:enterprise:G0094",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b005a049-ecf3-4378-bff6-983b16f92482",
      "modified": "2026-07-31T20:48:25.334Z",
      "references": [
        {
          "source_name": "Talos Kimsuky Nov 2021",
          "url": "https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"
        },
        {
          "source_name": "Aryaka Kimsuky July 2025",
          "url": "https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b028b9a6-4031-4b56-8dd5-0bdd3c59dbec",
      "subject": "ATTACK:enterprise:G0022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b028b9a6-4031-4b56-8dd5-0bdd3c59dbec",
      "modified": "2026-07-31T18:47:38.145Z",
      "references": [
        {
          "source_name": "aptsim",
          "url": "http://carnal0wnage.attackresearch.com/2012/09/more-on-aptsim.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b05da4f4-a47f-42d9-8464-58c6960a767a",
      "subject": "ATTACK:enterprise:S0264",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b05da4f4-a47f-42d9-8464-58c6960a767a",
      "modified": "2026-04-29T14:23:06.166Z",
      "references": [
        {
          "source_name": "Unit 42 OopsIE! Feb 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b6e427c5-ae51-4240-b91e-3c417cc4e1f0",
      "subject": "ATTACK:enterprise:G0061",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b6e427c5-ae51-4240-b91e-3c417cc4e1f0",
      "modified": "2026-07-31T18:48:29.931Z",
      "references": [
        {
          "source_name": "FireEye Know Your Enemy FIN8 Aug 2016",
          "url": "https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bde913a9-9895-4414-b79a-3156159033aa",
      "subject": "ATTACK:enterprise:G0004",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bde913a9-9895-4414-b79a-3156159033aa",
      "modified": "2026-07-31T18:48:01.614Z",
      "references": [
        {
          "source_name": "Mandiant Operation Ke3chang November 2014",
          "url": "https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"
        },
        {
          "source_name": "Microsoft NICKEL December 2021",
          "url": "https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cb4fc7aa-3ee0-4259-a2c7-58cd6ceb4053",
      "subject": "ATTACK:enterprise:C0040",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cb4fc7aa-3ee0-4259-a2c7-58cd6ceb4053",
      "modified": "2026-07-31T18:47:30.691Z",
      "references": [
        {
          "source_name": "Google Cloud APT41 2024",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cc58b10e-0fb0-4ee3-95b6-ae2bbaedcdea",
      "subject": "ATTACK:enterprise:G0030",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cc58b10e-0fb0-4ee3-95b6-ae2bbaedcdea",
      "modified": "2026-07-31T18:48:07.149Z",
      "references": [
        {
          "source_name": "Cisco LotusBlossom 2025",
          "url": "https://blog.talosintelligence.com/lotus-blossom-espionage-group/"
        },
        {
          "source_name": "Symantec Bilbug 2022",
          "url": "https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cca64a18-4601-4169-9a8e-63036403940f",
      "subject": "ATTACK:enterprise:S0274",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cca64a18-4601-4169-9a8e-63036403940f",
      "modified": "2026-04-29T14:23:06.205Z",
      "references": [
        {
          "source_name": "Securelist Calisto July 2018",
          "url": "https://securelist.com/calisto-trojan-for-macos/86543/"
        },
        {
          "source_name": "Symantec Calisto July 2018",
          "url": "https://web.archive.org/web/20190111082249/https://www.symantec.com/security-center/writeup/2018-073014-2512-99?om_rssid=sr-latestthreats30days"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cf401927-62cc-4b10-99c1-c48841054e1e",
      "subject": "ATTACK:enterprise:G1016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cf401927-62cc-4b10-99c1-c48841054e1e",
      "modified": "2026-07-31T18:48:31.490Z",
      "references": [
        {
          "source_name": "Sygnia Elephant Beetle Jan 2022",
          "url": "https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d0a3d891-2555-45eb-8aaf-99b86372607b",
      "subject": "ATTACK:enterprise:G1006",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d0a3d891-2555-45eb-8aaf-99b86372607b",
      "modified": "2026-07-31T20:48:48.406Z",
      "references": [
        {
          "source_name": "TrendMicro EarthLusca 2022",
          "url": "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d1323d9f-fcaa-4f41-84c2-ce0cac5cc13b",
      "subject": "ATTACK:enterprise:S9050",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d1323d9f-fcaa-4f41-84c2-ce0cac5cc13b",
      "modified": "2026-09-25T18:19:23.562Z",
      "references": [
        {
          "source_name": "Logpoint_StealerMalwareFamilies_2024",
          "url": "https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf"
        },
        {
          "source_name": "Unit42_Vidar_July2026",
          "url": "https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/"
        },
        {
          "source_name": "QuorumCyber_Vidar_March2023",
          "url": "https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d1ee6feb-91cb-4cac-ae57-e71358af29c2",
      "subject": "ATTACK:enterprise:S0192",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d1ee6feb-91cb-4cac-ae57-e71358af29c2",
      "modified": "2026-04-29T14:23:06.212Z",
      "references": [
        {
          "source_name": "GitHub Pupy",
          "url": "https://github.com/n1nj4sec/pupy"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d263240f-c368-4796-96cc-f574f31fc2ae",
      "subject": "ATTACK:enterprise:S1040",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d263240f-c368-4796-96cc-f574f31fc2ae",
      "modified": "2026-04-29T14:23:06.213Z",
      "references": [
        {
          "source_name": "Rclone",
          "url": "https://rclone.org"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d5d9878c-4255-452e-810e-65816dfa2685",
      "subject": "ATTACK:enterprise:S1245",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d5d9878c-4255-452e-810e-65816dfa2685",
      "modified": "2026-04-29T14:23:06.217Z",
      "references": [
        {
          "source_name": "ESET Contagious Interview BeaverTail InvisibleFerret February 2025",
          "url": "https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"
        },
        {
          "source_name": "Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024",
          "url": "https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d7d1b763-5430-463a-bd2c-eb14001e2c64",
      "subject": "ATTACK:enterprise:G1054",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d7d1b763-5430-463a-bd2c-eb14001e2c64",
      "modified": "2026-07-31T18:48:09.104Z",
      "references": [
        {
          "source_name": "ESET MirrorFace DEC 2022",
          "url": "https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"
        },
        {
          "source_name": "JPCERT MirrorFace JUL 2024",
          "url": "https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"
        },
        {
          "source_name": "Trend Micro Earth Kasha NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d8609889-3d3e-4f6c-8f52-03ec41876b4d",
      "subject": "ATTACK:enterprise:G0059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d8609889-3d3e-4f6c-8f52-03ec41876b4d",
      "modified": "2026-07-31T18:48:29.553Z",
      "references": [
        {
          "source_name": "DFIR Phosphorus November 2021",
          "url": "https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"
        },
        {
          "source_name": "DFIR Report APT35 ProxyShell March 2022",
          "url": "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"
        },
        {
          "source_name": "FireEye APT35 2018",
          "url": "https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dd82b9d7-d60c-4dc0-97d7-244a1365a1e9",
      "subject": "ATTACK:enterprise:S0441",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dd82b9d7-d60c-4dc0-97d7-244a1365a1e9",
      "modified": "2026-04-29T14:23:06.227Z",
      "references": [
        {
          "source_name": "Kaspersky Cloud Atlas August 2019",
          "url": "https://securelist.com/recent-cloud-atlas-activity/92016/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dfd24960-6b7e-4fab-bb84-2fc2ed4fc772",
      "subject": "ATTACK:enterprise:S0622",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dfd24960-6b7e-4fab-bb84-2fc2ed4fc772",
      "modified": "2026-04-29T14:23:06.230Z",
      "references": [
        {
          "source_name": "Malwarebytes Kimsuky June 2021",
          "url": "https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e0d8b438-c7be-43b3-ba3f-9dd61c0e54cb",
      "subject": "ATTACK:enterprise:G0143",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e0d8b438-c7be-43b3-ba3f-9dd61c0e54cb",
      "modified": "2026-07-31T18:47:59.649Z",
      "references": [
        {
          "source_name": "Crowdstrike HuntReport 2022",
          "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"
        },
        {
          "source_name": "CrowdStrike AQUATIC PANDA December 2021",
          "url": "https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e1ed817f-9fd5-4bea-92b5-9cc77e6f829b",
      "subject": "ATTACK:enterprise:S1210",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e1ed817f-9fd5-4bea-92b5-9cc77e6f829b",
      "modified": "2026-04-29T14:23:06.233Z",
      "references": [
        {
          "source_name": "Cisco LotusBlossom 2025",
          "url": "https://blog.talosintelligence.com/lotus-blossom-espionage-group/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ef2873f3-3e8d-4ec0-ba63-e487dc36a005",
      "subject": "ATTACK:enterprise:G1032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ef2873f3-3e8d-4ec0-ba63-e487dc36a005",
      "modified": "2026-07-31T20:48:47.804Z",
      "references": [
        {
          "source_name": "Huntress INC Ransomware May 2024",
          "url": "https://www.huntress.com/blog/lolbin-to-inc-ransomware"
        },
        {
          "source_name": "Secureworks GOLD IONIC April 2024",
          "url": "https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware"
        },
        {
          "source_name": "SOCRadar INC Ransom January 2024",
          "url": "https://socradar.io/dark-web-profile-inc-ransom/"
        },
        {
          "source_name": "Huntress INC Ransom Group August 2023",
          "url": "https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f028f4d1-4e68-4092-abc6-4d144d2f95a7",
      "subject": "ATTACK:enterprise:S9035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f028f4d1-4e68-4092-abc6-4d144d2f95a7",
      "modified": "2026-04-29T14:23:06.252Z",
      "references": [
        {
          "source_name": "Splunk LAMEHUG SEP 2025",
          "url": "https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f5c854b7-6c1e-48bd-b8fd-c8fbebf4e326",
      "subject": "ATTACK:enterprise:C0024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f5c854b7-6c1e-48bd-b8fd-c8fbebf4e326",
      "modified": "2026-07-31T18:47:27.688Z",
      "references": [
        {
          "source_name": "Volexity SolarWinds",
          "url": "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/"
        },
        {
          "source_name": "CrowdStrike StellarParticle January 2022",
          "url": "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/"
        },
        {
          "source_name": "Microsoft Deep Dive Solorigate January 2021",
          "url": "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f64733fd-acc7-4570-90ee-79c117c37d7e",
      "subject": "ATTACK:enterprise:S0428",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f64733fd-acc7-4570-90ee-79c117c37d7e",
      "modified": "2026-04-29T14:23:06.260Z",
      "references": [
        {
          "source_name": "Talos PoetRAT April 2020",
          "url": "https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f6f25674-a46f-4df0-94b4-e2b08f72b862",
      "subject": "ATTACK:enterprise:G1055",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f6f25674-a46f-4df0-94b4-e2b08f72b862",
      "modified": "2026-07-31T18:48:26.208Z",
      "references": [
        {
          "source_name": "FBI IC3 Flash VOID MANTICORE Handala Hack March 2026",
          "url": "https://www.ic3.gov/CSA/2026/260320.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f7416b2f-b3b3-4fc4-a463-05ae302a6b24",
      "subject": "ATTACK:enterprise:G1024",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f7416b2f-b3b3-4fc4-a463-05ae302a6b24",
      "modified": "2026-07-31T18:47:55.450Z",
      "references": [
        {
          "source_name": "Secureworks GOLD SAHARA",
          "url": "https://www.secureworks.com/research/threat-profiles/gold-sahara"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fc62ec8c-5015-4f02-b9b6-3964082d101d",
      "subject": "ATTACK:enterprise:C0022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fc62ec8c-5015-4f02-b9b6-3964082d101d",
      "modified": "2026-07-31T21:14:22.952Z",
      "references": [
        {
          "source_name": "ESET Lazarus Jun 2020",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fde8efd4-7191-4eee-ada8-52bef4daac98",
      "subject": "ATTACK:enterprise:G0082",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fde8efd4-7191-4eee-ada8-52bef4daac98",
      "modified": "2026-09-30T20:44:38.628Z",
      "references": [
        {
          "source_name": "Microsoft Sapphire Sleet APR 2026",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ff1715e6-2b65-47a3-86f2-d5d09f2e31e4",
      "subject": "ATTACK:enterprise:S1239",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ff1715e6-2b65-47a3-86f2-d5d09f2e31e4",
      "modified": "2026-04-29T14:23:06.271Z",
      "references": [
        {
          "source_name": "Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"
        },
        {
          "source_name": "Unit42 Chinese VSCode 06 September 2024",
          "url": "https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fff9a9cb-3032-4f18-a626-ce34a82e59ec",
      "subject": "ATTACK:enterprise:G1022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1560.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fff9a9cb-3032-4f18-a626-ce34a82e59ec",
      "modified": "2026-07-31T18:48:14.477Z",
      "references": [
        {
          "source_name": "Kaspersky ToddyCat Check Logs October 2023",
          "url": "https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    }
  ],
  "source_snapshot": {
    "file": "enterprise-attack-20.0.json",
    "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
    "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352",
    "bytes": 55271014,
    "checked_at": "2026-10-16T03:31:39Z"
  },
  "notices_url": "https://aol.pm/source-notices.txt",
  "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"
}

License
-------
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,
development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce
MITRE's copyright designation and this license in any such copy.

"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

Disclaimers
-----------
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part
of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover
full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or
variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE
ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,
AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE.