{"record":{"id":"ATTACK:enterprise:T1560","title":"Archive Collected Data","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1560","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a","external_id":"T1560","domain":"enterprise","created":"2020-02-20T20:53:45.725Z","modified":"2026-05-12T15:12:00.633Z","version":"1.0","aliases":[],"tactics":["collection"],"source_references":[{"source_name":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"},{"source_name":"Wikipedia File Header Signatures","url":"https://en.wikipedia.org/wiki/List_of_file_signatures"}]},"assertions":[{"id":"enterprise:relationship--0082e86b-a7b7-496b-af03-88785b6c8fbb","subject":"ATTACK:enterprise:G0035","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0082e86b-a7b7-496b-af03-88785b6c8fbb","modified":"2026-07-31T20:48:28.298Z","references":[{"source_name":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--02174a5c-9cda-4ddc-9952-1ff1b956d31e","subject":"ATTACK:enterprise:S0667","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--02174a5c-9cda-4ddc-9952-1ff1b956d31e","modified":"2026-04-29T14:23:05.906Z","references":[{"source_name":"ESET Gelsemium June 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--03b18e87-f5f2-4d12-b5b3-2e1ba131b091","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--03b18e87-f5f2-4d12-b5b3-2e1ba131b091","modified":"2026-07-31T20:48:26.141Z","references":[{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1631a8e5-36e6-4468-9ed6-48df1138461c","subject":"ATTACK:enterprise:S0343","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1631a8e5-36e6-4468-9ed6-48df1138461c","modified":"2026-04-29T14:23:05.934Z","references":[{"source_name":"ESET TeleBots Oct 2018","url":"https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1f066ba6-31e2-48d1-a7ac-27a20879287b","subject":"ATTACK:enterprise:S0586","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1f066ba6-31e2-48d1-a7ac-27a20879287b","modified":"2026-04-29T14:23:05.947Z","references":[{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2202d670-a6f3-42eb-ae1b-1ae615c3b620","subject":"ATTACK:enterprise:G0001","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2202d670-a6f3-42eb-ae1b-1ae615c3b620","modified":"2026-07-31T18:48:12.235Z","references":[{"source_name":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--255eb82c-19d3-43bd-a13c-e7c54413bfd6","subject":"ATTACK:enterprise:S1101","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--255eb82c-19d3-43bd-a13c-e7c54413bfd6","modified":"2026-04-29T14:23:05.956Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2762485e-c8a2-4bbe-b3d8-8b20ca70197b","subject":"ATTACK:enterprise:S0521","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2762485e-c8a2-4bbe-b3d8-8b20ca70197b","modified":"2026-04-29T14:23:05.958Z","references":[{"source_name":"Trend Micro Black Basta October 2022","url":"https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html"},{"source_name":"GitHub Bloodhound","url":"https://github.com/BloodHoundAD/BloodHound"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2a8f0313-4059-42b9-b487-6c8f860588c0","subject":"ATTACK:enterprise:S0045","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2a8f0313-4059-42b9-b487-6c8f860588c0","modified":"2026-04-29T14:23:05.962Z","references":[{"source_name":"ESET Sednit Part 2","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2e3dd466-e330-4d59-9c23-59f1f697d60d","subject":"ATTACK:enterprise:G1003","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2e3dd466-e330-4d59-9c23-59f1f697d60d","modified":"2026-07-31T18:48:12.901Z","references":[{"source_name":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--32fc949c-2127-425b-9480-6d07ead49982","subject":"ATTACK:enterprise:S0363","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--32fc949c-2127-425b-9480-6d07ead49982","modified":"2026-04-29T14:23:05.986Z","references":[{"source_name":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3b8633ab-4fa5-4310-bd0f-80964ecfae41","subject":"ATTACK:enterprise:T1560.002","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3b8633ab-4fa5-4310-bd0f-80964ecfae41","modified":"2026-04-29T14:23:06.003Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3df9c843-4833-45f9-a1ae-f7231d8410c4","subject":"ATTACK:enterprise:S1039","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3df9c843-4833-45f9-a1ae-f7231d8410c4","modified":"2026-04-29T14:23:06.009Z","references":[{"source_name":"Cybereason Bumblebee August 2022","url":"https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--423b6f97-96c5-47f3-aa9f-f27bf5cd1ba0","subject":"ATTACK:enterprise:S0515","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--423b6f97-96c5-47f3-aa9f-f27bf5cd1ba0","modified":"2026-04-29T14:23:06.015Z","references":[{"source_name":"CISA WellMail July 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198c"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--43b6c74f-57ee-4cf8-acf8-97cbaa85db38","subject":"ATTACK:enterprise:S9043","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--43b6c74f-57ee-4cf8-acf8-97cbaa85db38","modified":"2026-07-29T20:18:00.645Z","references":[{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4ad19c3f-54c6-4bc6-a6fc-95ffb6fe75be","subject":"ATTACK:enterprise:G1043","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4ad19c3f-54c6-4bc6-a6fc-95ffb6fe75be","modified":"2026-07-31T18:47:35.884Z","references":[{"source_name":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4ef8c5fb-1c73-4847-9aa0-0d83eec44993","subject":"ATTACK:enterprise:S9032","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4ef8c5fb-1c73-4847-9aa0-0d83eec44993","modified":"2026-04-29T14:23:06.033Z","references":[{"source_name":"ESET_MuddyWater_Dec2025","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--552ac18c-4fac-4cb0-aefc-811a10e1c320","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--552ac18c-4fac-4cb0-aefc-811a10e1c320","modified":"2026-07-31T20:48:46.721Z","references":[{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--59ad51ee-bc2e-4428-be3f-ddf50cf0deb9","subject":"ATTACK:enterprise:S0454","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--59ad51ee-bc2e-4428-be3f-ddf50cf0deb9","modified":"2026-04-29T14:23:06.047Z","references":[{"source_name":"Symantec Chafer Dec 2015","url":"https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--60fd7b53-b65a-49d3-ba1c-40beb74e8088","subject":"ATTACK:enterprise:S1140","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--60fd7b53-b65a-49d3-ba1c-40beb74e8088","modified":"2026-04-29T14:23:06.057Z","references":[{"source_name":"Google TAG COLDRIVER January 2024","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6259ae94-15ac-4343-9eb9-7315160bf58a","subject":"ATTACK:enterprise:S0395","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6259ae94-15ac-4343-9eb9-7315160bf58a","modified":"2026-04-29T14:23:06.059Z","references":[{"source_name":"ESET LightNeuron May 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--630e90a1-6600-4017-8fdc-c13222b59ee4","subject":"ATTACK:enterprise:S1196","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--630e90a1-6600-4017-8fdc-c13222b59ee4","modified":"2026-04-29T14:23:06.060Z","references":[{"source_name":"S2W Troll Stealer 2024","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--63ee7d80-372e-4841-87a4-825cb5dd7058","subject":"ATTACK:enterprise:G0007","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--63ee7d80-372e-4841-87a4-825cb5dd7058","modified":"2026-07-31T20:48:44.765Z","references":[{"source_name":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6a1d7178-8bad-42cc-81dd-cd74d949cede","subject":"ATTACK:enterprise:T1560.001","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6a1d7178-8bad-42cc-81dd-cd74d949cede","modified":"2026-04-29T14:23:06.069Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6b2770ca-bf5d-4994-8a7e-868c906f385a","subject":"ATTACK:enterprise:S0257","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6b2770ca-bf5d-4994-8a7e-868c906f385a","modified":"2026-04-29T14:23:06.071Z","references":[{"source_name":"Unit 42 VERMIN Jan 2018","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6eb19d8a-2a57-4089-9cd2-ae9023a1a337","subject":"ATTACK:enterprise:S9036","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6eb19d8a-2a57-4089-9cd2-ae9023a1a337","modified":"2026-04-29T14:23:06.076Z","references":[{"source_name":"ESET_MuddyWater_Dec2025","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--70af600c-ca7a-4ea3-8c03-3a166e2d88a7","subject":"ATTACK:enterprise:S0445","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--70af600c-ca7a-4ea3-8c03-3a166e2d88a7","modified":"2026-04-29T14:23:06.079Z","references":[{"source_name":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7723037f-0b2e-447b-811a-d18a109570bb","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7723037f-0b2e-447b-811a-d18a109570bb","modified":"2026-07-31T18:47:44.877Z","references":[{"source_name":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7bbd6131-24cd-437e-8057-02f84b357cbe","subject":"ATTACK:enterprise:S0658","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7bbd6131-24cd-437e-8057-02f84b357cbe","modified":"2026-04-29T14:23:06.095Z","references":[{"source_name":"trendmicro xcsset xcode project 2020","url":"https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7ee9b1ad-7f7b-4ae7-8cf4-8ab97b6a74b8","subject":"ATTACK:enterprise:S0249","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7ee9b1ad-7f7b-4ae7-8cf4-8ab97b6a74b8","modified":"2026-04-29T14:23:06.099Z","references":[{"source_name":"McAfee Gold Dragon","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--823fc0fa-1648-40ed-87a3-eec3138eb3dd","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--823fc0fa-1648-40ed-87a3-eec3138eb3dd","modified":"2026-04-29T14:23:06.103Z","references":[{"source_name":"Malwarebytes Konni Aug 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--88d26308-c00d-4394-8074-7d80d3deeea5","subject":"ATTACK:enterprise:S1148","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--88d26308-c00d-4394-8074-7d80d3deeea5","modified":"2026-04-29T14:23:06.112Z","references":[{"source_name":"Sekoia Raccoon2 2022","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8a2be44e-6a93-479f-ade9-7d49a1eb692a","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8a2be44e-6a93-479f-ade9-7d49a1eb692a","modified":"2026-04-29T14:23:06.114Z","references":[{"source_name":"Red Canary NETWIRE January 2020","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8b16a324-45f2-4e90-8c30-39229b352fb7","subject":"ATTACK:enterprise:S1012","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8b16a324-45f2-4e90-8c30-39229b352fb7","modified":"2026-04-29T14:23:06.115Z","references":[{"source_name":"Cybereason PowerLess February 2022","url":"https://www.cybereason.com/blog/research/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9076865a-8215-4536-bb31-60ab7fa20af6","subject":"ATTACK:enterprise:S0091","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9076865a-8215-4536-bb31-60ab7fa20af6","modified":"2026-04-29T14:23:06.122Z","references":[{"source_name":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source_name":"Kaspersky Turla Aug 2014","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08080105/KL_Epic_Turla_Technical_Appendix_20140806.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9433ea0e-0bae-44b6-b32b-5290356f057b","subject":"ATTACK:enterprise:S0487","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9433ea0e-0bae-44b6-b32b-5290356f057b","modified":"2026-04-29T14:23:06.127Z","references":[{"source_name":"ESET ForSSHe December 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--960accee-d5ea-4570-8697-84ada0cc266a","subject":"ATTACK:enterprise:S0251","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--960accee-d5ea-4570-8697-84ada0cc266a","modified":"2026-04-29T14:23:06.130Z","references":[{"source_name":"Securelist Sofacy Feb 2018","url":"https://securelist.com/a-slice-of-2017-sofacy-activity/83930/"},{"source_name":"ESET Zebrocy Nov 2018","url":"https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"},{"source_name":"CISA Zebrocy Oct 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--98229d5a-fce3-442e-91cf-7ec7b7994248","subject":"ATTACK:enterprise:G0037","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--98229d5a-fce3-442e-91cf-7ec7b7994248","modified":"2026-07-31T20:48:30.964Z","references":[{"source_name":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--982d9af7-45bb-4cc0-9819-aaadb3304783","subject":"ATTACK:enterprise:S0010","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--982d9af7-45bb-4cc0-9819-aaadb3304783","modified":"2026-04-29T14:23:06.132Z","references":[{"source_name":"Villeneuve 2011","url":"http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_dissecting-lurid-apt.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--985066fb-7fbb-4147-a69d-b33d45cd3e7f","subject":"ATTACK:enterprise:S0622","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--985066fb-7fbb-4147-a69d-b33d45cd3e7f","modified":"2026-04-29T14:23:06.133Z","references":[{"source_name":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--99e5781a-104c-49a7-b0b0-9f00b804f536","subject":"ATTACK:enterprise:S1206","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--99e5781a-104c-49a7-b0b0-9f00b804f536","modified":"2026-04-29T14:23:06.135Z","references":[{"source_name":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9e0cc38c-17a0-4320-b9b4-dc8458a9bb79","subject":"ATTACK:enterprise:M1047","predicate":"mitigates","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9e0cc38c-17a0-4320-b9b4-dc8458a9bb79","modified":"2026-04-29T14:23:06.140Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9e8e158e-31a9-406e-8b58-68ef645b0cc8","subject":"ATTACK:enterprise:G1014","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9e8e158e-31a9-406e-8b58-68ef645b0cc8","modified":"2026-07-31T18:48:14.953Z","references":[{"source_name":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a1dc7c15-bd44-43b3-a32b-8e4ea9856758","subject":"ATTACK:enterprise:S0093","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a1dc7c15-bd44-43b3-a32b-8e4ea9856758","modified":"2026-04-29T14:23:06.145Z","references":[{"source_name":"Symantec Dragonfly","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a4361a93-3ce2-4c35-a5d8-9a4fae2dc822","subject":"ATTACK:enterprise:S0657","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a4361a93-3ce2-4c35-a5d8-9a4fae2dc822","modified":"2026-04-29T14:23:06.148Z","references":[{"source_name":"Volexity InkySquid BLUELIGHT August 2021","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ab62293d-8f89-46b5-bab1-f7b564f5996f","subject":"ATTACK:enterprise:S0267","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ab62293d-8f89-46b5-bab1-f7b564f5996f","modified":"2026-04-29T14:23:06.158Z","references":[{"source_name":"FireEye FELIXROOT July 2018","url":"https://web.archive.org/web/20200607025424/https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ab7eb363-c775-4065-a80d-1b324f22d0b8","subject":"ATTACK:enterprise:G0004","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ab7eb363-c775-4065-a80d-1b324f22d0b8","modified":"2026-07-31T18:48:01.572Z","references":[{"source_name":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b516dc1a-69c7-4dd2-935a-b0b1dcee150f","subject":"ATTACK:enterprise:S0375","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b516dc1a-69c7-4dd2-935a-b0b1dcee150f","modified":"2026-04-29T14:23:06.173Z","references":[{"source_name":"Securelist Remexi Jan 2019","url":"https://securelist.com/chafer-used-remexi-malware/89538/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b997d866-0aef-4ba6-a812-cfa2fccb05af","subject":"ATTACK:enterprise:S0253","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b997d866-0aef-4ba6-a812-cfa2fccb05af","modified":"2026-04-29T14:23:06.178Z","references":[{"source_name":"McAfee Gold Dragon","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c254bf89-3726-4c56-aae5-700c59427daf","subject":"ATTACK:enterprise:S0409","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c254bf89-3726-4c56-aae5-700c59427daf","modified":"2026-04-29T14:23:06.191Z","references":[{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c48ff628-9276-492f-a61c-73989785b292","subject":"ATTACK:enterprise:S0331","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c48ff628-9276-492f-a61c-73989785b292","modified":"2026-04-29T14:23:06.194Z","references":[{"source_name":"Talos Agent Tesla Oct 2018","url":"https://blog.talosintelligence.com/2018/10/old-dog-new-tricks-analysing-new-rtf_15.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d80207ae-0b3c-4f5f-ac89-9caa8c2c9beb","subject":"ATTACK:enterprise:S0567","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d80207ae-0b3c-4f5f-ac89-9caa8c2c9beb","modified":"2026-04-29T14:23:06.220Z","references":[{"source_name":"Securelist Dtrack","url":"https://securelist.com/my-name-is-dtrack/93338/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d844fdcc-a0d1-46b4-a4dc-f56063ef9584","subject":"ATTACK:enterprise:G0045","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d844fdcc-a0d1-46b4-a4dc-f56063ef9584","modified":"2026-07-31T18:47:44.679Z","references":[{"source_name":"DOJ APT10 Dec 2018","url":"https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion"},{"source_name":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df6c39fa-9d95-45ee-911b-0ca2fc167086","subject":"ATTACK:enterprise:S0187","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df6c39fa-9d95-45ee-911b-0ca2fc167086","modified":"2026-04-29T14:23:06.230Z","references":[{"source_name":"Symantec Tick Apr 2016","url":"https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e2980209-0a3b-4d12-8a85-1984b8e1844b","subject":"ATTACK:enterprise:T1560.003","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e2980209-0a3b-4d12-8a85-1984b8e1844b","modified":"2026-04-29T14:23:06.234Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e37d3456-b3a0-4502-b502-a505f383cb4c","subject":"ATTACK:enterprise:G0065","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e37d3456-b3a0-4502-b502-a505f383cb4c","modified":"2026-07-31T20:48:38.475Z","references":[{"source_name":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e898c937-29b0-4e30-aeed-017ac3bbc3ed","subject":"ATTACK:enterprise:S0279","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e898c937-29b0-4e30-aeed-017ac3bbc3ed","modified":"2026-04-29T14:23:06.242Z","references":[{"source_name":"objsee mac malware 2017","url":"https://objective-see.com/blog/blog_0x25.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--efea6d26-7372-45bb-81bb-1e300abd5b13","subject":"ATTACK:enterprise:S0517","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--efea6d26-7372-45bb-81bb-1e300abd5b13","modified":"2026-04-29T14:23:06.251Z","references":[{"source_name":"Trustwave Pillowmint June 2020","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa77baa1-a258-4059-aa84-6822fe023d70","subject":"ATTACK:enterprise:S0456","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa77baa1-a258-4059-aa84-6822fe023d70","modified":"2026-04-29T14:23:06.265Z","references":[{"source_name":"CheckPoint Naikon May 2020","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fada6223-ba24-4c26-aa89-3998f07604f9","subject":"ATTACK:enterprise:S0113","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fada6223-ba24-4c26-aa89-3998f07604f9","modified":"2026-04-29T14:23:06.265Z","references":[{"source_name":"ESET Operation Groundbait","url":"http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff9e8d81-dc74-4494-a4aa-54f8039f9ad7","subject":"ATTACK:enterprise:S0681","predicate":"uses","object":"ATTACK:enterprise:T1560","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff9e8d81-dc74-4494-a4aa-54f8039f9ad7","modified":"2026-04-29T14:23:06.272Z","references":[{"source_name":"BiZone Lizar May 2021","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}