Source assertions are not new attribution claims. No sole inventor or transitive actor-CVE inference.
{
  "record": {
    "id": "ATTACK:enterprise:T1566.001",
    "title": "Spearphishing Attachment",
    "type": "Subtechnique",
    "source_url": "https://attack.mitre.org/techniques/T1566/001",
    "snapshot": "enterprise-attack-20.0.json",
    "status": "active",
    "rights": "Source metadata only; source notices retained; no operational prose or payloads",
    "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
    "stix_id": "attack-pattern--2e34237d-8574-43f6-aace-ae2915de8597",
    "external_id": "T1566.001",
    "domain": "enterprise",
    "created": "2020-03-02T19:05:18.137Z",
    "modified": "2026-09-11T19:55:20.273Z",
    "version": "2.2",
    "aliases": [

    ],
    "tactics": [
      "initial-access"
    ],
    "source_references": [
      {
        "source_name": "ACSC Email Spoofing",
        "url": "https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"
      },
      {
        "source_name": "Unit 42 DarkHydrus July 2018",
        "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
      },
      {
        "source_name": "Microsoft Anti Spoofing",
        "url": "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"
      },
      {
        "source_name": "Elastic - Koadiac Detection with EQL",
        "url": "https://www.elastic.co/security-labs/embracing-offensive-tooling-building-detections-against-koadic-using-eql"
      }
    ]
  },
  "assertions": [
    {
      "id": "enterprise:relationship--029bdc73-5054-45eb-b9d0-e4281f69d85a",
      "subject": "ATTACK:enterprise:G0080",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--029bdc73-5054-45eb-b9d0-e4281f69d85a",
      "modified": "2026-07-31T18:48:22.763Z",
      "references": [
        {
          "source_name": "TrendMicro Cobalt Group Nov 2017",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/"
        },
        {
          "source_name": "RiskIQ Cobalt Nov 2017",
          "url": "https://web.archive.org/web/20190508170630/https://www.riskiq.com/blog/labs/cobalt-strike/"
        },
        {
          "source_name": "Group IB Cobalt Aug 2017",
          "url": "https://www.group-ib.com/blog/cobalt"
        },
        {
          "source_name": "Proofpoint Cobalt June 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integrates-cve-2017-0199-utilized-cobalt-group-target"
        },
        {
          "source_name": "PTSecurity Cobalt Dec 2016",
          "url": "https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"
        },
        {
          "source_name": "PTSecurity Cobalt Group Aug 2017",
          "url": "https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"
        },
        {
          "source_name": "Talos Cobalt Group July 2018",
          "url": "https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"
        },
        {
          "source_name": "Unit 42 Cobalt Gang Oct 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--02a8db04-60e6-437c-8f1a-12aff6a13c63",
      "subject": "ATTACK:enterprise:S0669",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--02a8db04-60e6-437c-8f1a-12aff6a13c63",
      "modified": "2026-04-29T14:23:05.906Z",
      "references": [
        {
          "source_name": "MalwareBytes LazyScripter Feb 2021",
          "url": "https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--04427a61-cef7-4197-9ff4-cb36c6a1895e",
      "subject": "ATTACK:enterprise:C0028",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--04427a61-cef7-4197-9ff4-cb36c6a1895e",
      "modified": "2026-08-04T20:48:44.652Z",
      "references": [
        {
          "source_name": "Ukraine15 - EISAC - 201603",
          "url": "https://nsarchive.gwu.edu/sites/default/files/documents/3891751/SANS-and-Electricity-Information-Sharing-and.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--060894ab-c1ec-488c-8d66-25924c82ad58",
      "subject": "ATTACK:enterprise:S0447",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--060894ab-c1ec-488c-8d66-25924c82ad58",
      "modified": "2026-04-29T14:23:05.911Z",
      "references": [
        {
          "source_name": "Talos Lokibot Jan 2021",
          "url": "https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--061841f1-5814-41e3-94b5-536b8a52d062",
      "subject": "ATTACK:enterprise:G0032",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--061841f1-5814-41e3-94b5-536b8a52d062",
      "modified": "2026-07-31T20:48:46.375Z",
      "references": [
        {
          "source_name": "Qualys LolZarus",
          "url": "https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"
        },
        {
          "source_name": "Lazarus APT January 2022",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"
        },
        {
          "source_name": "McAfee Bankshot",
          "url": "https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"
        },
        {
          "source_name": "Kaspersky ThreatNeedle Feb 2021",
          "url": "https://securelist.com/lazarus-threatneedle/100803/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--06957b67-183f-4320-94ca-15a138382323",
      "subject": "ATTACK:enterprise:G1031",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--06957b67-183f-4320-94ca-15a138382323",
      "modified": "2026-07-31T18:48:00.200Z",
      "references": [
        {
          "source_name": "Palo Alto Unit 42 OutSteel SaintBot February 2022 ",
          "url": "https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--06f7f9cd-4e6b-4abe-bff0-c9c0fcaf920e",
      "subject": "ATTACK:enterprise:S0331",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--06f7f9cd-4e6b-4abe-bff0-c9c0fcaf920e",
      "modified": "2026-04-29T14:23:05.913Z",
      "references": [
        {
          "source_name": "Bitdefender Agent Tesla April 2020",
          "url": "https://labs.bitdefender.com/2020/04/oil-gas-spearphishing-campaigns-drop-agent-tesla-spyware-in-advance-of-historic-opec-deal/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0be962d8-6281-4554-ad1f-4cba04c547de",
      "subject": "ATTACK:enterprise:G0081",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0be962d8-6281-4554-ad1f-4cba04c547de",
      "modified": "2026-07-31T18:47:56.925Z",
      "references": [
        {
          "source_name": "CitizenLab Tropic Trooper Aug 2018",
          "url": "https://citizenlab.ca/2018/08/familiar-feeling-a-malware-campaign-targeting-the-tibetan-diaspora-resurfaces/"
        },
        {
          "source_name": "TrendMicro TropicTrooper 2015",
          "url": "https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"
        },
        {
          "source_name": "TrendMicro Tropic Trooper May 2020",
          "url": "https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"
        },
        {
          "source_name": "Anomali Pirate Panda April 2020",
          "url": "https://www.anomali.com/blog/anomali-suspects-that-china-backed-apt-pirate-panda-may-be-seeking-access-to-vietnam-government-data-center#When:15:00:00Z"
        },
        {
          "source_name": "Unit 42 Tropic Trooper Nov 2016",
          "url": "https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--0e1bf920-fd5a-4859-bf55-62e5f9817289",
      "subject": "ATTACK:enterprise:G0037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--0e1bf920-fd5a-4859-bf55-62e5f9817289",
      "modified": "2026-07-31T20:48:30.737Z",
      "references": [
        {
          "source_name": "Visa FIN6 Feb 2019",
          "url": "https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1401717f-8315-430c-aae6-045602619d52",
      "subject": "ATTACK:enterprise:S1064",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1401717f-8315-430c-aae6-045602619d52",
      "modified": "2026-04-29T14:23:05.931Z",
      "references": [
        {
          "source_name": "HP SVCReady Jun 2022",
          "url": "https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--15bbd8e5-60ad-4906-8231-f92c231bb1ec",
      "subject": "ATTACK:enterprise:G0007",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--15bbd8e5-60ad-4906-8231-f92c231bb1ec",
      "modified": "2026-07-31T20:48:44.415Z",
      "references": [
        {
          "source_name": "Accenture SNAKEMACKEREL Nov 2018",
          "url": "https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"
        },
        {
          "source_name": "Sofacy DealersChoice",
          "url": "https://researchcenter.paloaltonetworks.com/2018/03/unit42-sofacy-uses-dealerschoice-target-european-government-agency/"
        },
        {
          "source_name": "TrendMicro Pawn Storm Dec 2020",
          "url": "https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"
        },
        {
          "source_name": "Securelist Sofacy Feb 2018",
          "url": "https://securelist.com/a-slice-of-2017-sofacy-activity/83930/"
        },
        {
          "source_name": "Unit 42 Sofacy Feb 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"
        },
        {
          "source_name": "Palo Alto Sofacy 06-2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"
        },
        {
          "source_name": "DOJ GRU Indictment Jul 2018",
          "url": "https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"
        },
        {
          "source_name": "Secureworks IRON TWILIGHT Active Measures March 2017",
          "url": "https://www.secureworks.com/research/iron-twilight-supports-active-measures"
        },
        {
          "source_name": "Cato LAMEHUG JUL 2025",
          "url": "https://www.catonetworks.com/blog/cato-ctrl-threat-research-analyzing-lamehug/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1813df9f-2bd9-4451-b4dd-aa80716ce151",
      "subject": "ATTACK:enterprise:S1066",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1813df9f-2bd9-4451-b4dd-aa80716ce151",
      "modified": "2026-04-29T14:23:05.937Z",
      "references": [
        {
          "source_name": "Secureworks DarkTortilla Aug 2022",
          "url": "https://www.secureworks.com/research/darktortilla-malware-analysis"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1a7f1f1e-511a-44bf-8d9e-fd3260febfc8",
      "subject": "ATTACK:enterprise:G0018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1a7f1f1e-511a-44bf-8d9e-fd3260febfc8",
      "modified": "2026-07-31T18:47:39.386Z",
      "references": [
        {
          "source_name": "FireEye admin@338",
          "url": "https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1ab045b8-35b4-4920-8223-d1a6b8c6ae1e",
      "subject": "ATTACK:enterprise:G0112",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1ab045b8-35b4-4920-8223-d1a6b8c6ae1e",
      "modified": "2026-09-02T18:52:46.903Z",
      "references": [
        {
          "source_name": "SANS Windshift August 2018",
          "url": "https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1ad674bb-c8e1-4f19-b96e-f56bfa10797c",
      "subject": "ATTACK:enterprise:G0060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1ad674bb-c8e1-4f19-b96e-f56bfa10797c",
      "modified": "2026-07-31T18:48:10.135Z",
      "references": [
        {
          "source_name": "Symantec Tick Apr 2016",
          "url": "https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan"
        },
        {
          "source_name": "Trend Micro Tick November 2019",
          "url": "https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--1aeb4dce-ac27-43ae-a0f4-1afcf84fc1a9",
      "subject": "ATTACK:enterprise:G0090",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--1aeb4dce-ac27-43ae-a0f4-1afcf84fc1a9",
      "modified": "2026-07-31T20:48:52.393Z",
      "references": [
        {
          "source_name": "Kaspersky WIRTE November 2021",
          "url": "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2305a634-b226-4da2-a766-bec5458f9447",
      "subject": "ATTACK:enterprise:G0069",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2305a634-b226-4da2-a766-bec5458f9447",
      "modified": "2026-07-31T20:48:29.685Z",
      "references": [
        {
          "source_name": "CloudSEK_RustyWater_Jan2026",
          "url": "https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"
        },
        {
          "source_name": "ClearSky MuddyWater June 2019",
          "url": "https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"
        },
        {
          "source_name": "ESET_MuddyWater_Dec2025",
          "url": "https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"
        },
        {
          "source_name": "DHS CISA AA22-055A MuddyWater February 2022",
          "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"
        },
        {
          "source_name": "Securelist MuddyWater Oct 2018",
          "url": "https://securelist.com/muddywater/88059/"
        },
        {
          "source_name": "Unit 42 MuddyWater Nov 2017",
          "url": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/"
        },
        {
          "source_name": "Anomali Static Kitten February 2021",
          "url": "https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"
        },
        {
          "source_name": "Proofpoint TA450 Phishing March 2024",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign"
        },
        {
          "source_name": "Trend Micro Muddy Water March 2021",
          "url": "https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
        },
        {
          "source_name": "FireEye MuddyWater Mar 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"
        },
        {
          "source_name": "SOCRadar_MuddyWaterDindoor_Mar2026",
          "url": "https://socradar.io/blog/iran-muddywater-dindoor-malware-us-networks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--239d98a7-f134-4270-8333-c2df2feaa9ca",
      "subject": "ATTACK:enterprise:G0045",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--239d98a7-f134-4270-8333-c2df2feaa9ca",
      "modified": "2026-07-31T18:47:43.656Z",
      "references": [
        {
          "source_name": "FireEye APT10 April 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"
        },
        {
          "source_name": "FireEye APT10 Sept 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"
        },
        {
          "source_name": "PWC Cloud Hopper Technical Annex April 2017",
          "url": "https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"
        },
        {
          "source_name": "District Court of NY APT10 Indictment December 2018",
          "url": "https://www.justice.gov/opa/page/file/1122671/download"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--26d24472-ae04-46e7-9166-5d8a8f6f16f7",
      "subject": "ATTACK:enterprise:M1049",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--26d24472-ae04-46e7-9166-5d8a8f6f16f7",
      "modified": "2026-04-29T14:23:05.958Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--29686ce0-db1e-4d77-a21c-7b1e97ee51ac",
      "subject": "ATTACK:enterprise:S0428",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--29686ce0-db1e-4d77-a21c-7b1e97ee51ac",
      "modified": "2026-04-29T14:23:05.961Z",
      "references": [
        {
          "source_name": "Talos PoetRAT April 2020",
          "url": "https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--2b948c49-f65d-4e60-969f-229030b4d311",
      "subject": "ATTACK:enterprise:S0148",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--2b948c49-f65d-4e60-969f-229030b4d311",
      "modified": "2026-04-29T14:23:05.964Z",
      "references": [
        {
          "source_name": "Unit42 Redaman January 2019",
          "url": "https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--30b93042-d56e-4ecf-82d8-8b287bd9c00c",
      "subject": "ATTACK:enterprise:G0027",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--30b93042-d56e-4ecf-82d8-8b287bd9c00c",
      "modified": "2026-07-31T18:48:28.582Z",
      "references": [
        {
          "source_name": "Trend Micro DRBControl February 2020",
          "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--35624bc2-caf0-4124-88e8-6f60ae52ed9c",
      "subject": "ATTACK:enterprise:G0047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--35624bc2-caf0-4124-88e8-6f60ae52ed9c",
      "modified": "2026-07-31T18:47:47.509Z",
      "references": [
        {
          "source_name": "ESET Gamaredon June 2020",
          "url": "https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"
        },
        {
          "source_name": "CERT-EE Gamaredon January 2021",
          "url": "https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"
        },
        {
          "source_name": "TrendMicro Gamaredon April 2020",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"
        },
        {
          "source_name": "Microsoft Actinium February 2022",
          "url": "https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"
        },
        {
          "source_name": "ESET Gamaredon Sept2024",
          "url": "https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"
        },
        {
          "source_name": "Secureworks IRON TILDEN Profile",
          "url": "https://www.secureworks.com/research/threat-profiles/iron-tilden"
        },
        {
          "source_name": "SilentPush_GamaredonFastFlux_Sept2023",
          "url": "https://www.silentpush.com/blog/from-russia-with-a-71/"
        },
        {
          "source_name": "unit42_gamaredon_dec2022",
          "url": "https://unit42.paloaltonetworks.com/trident-ursa/"
        },
        {
          "source_name": "Unit 42 Gamaredon February 2022",
          "url": "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"
        },
        {
          "source_name": "VenereCiscoTalos_Gamaredon_Mar2025",
          "url": "https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3577cdd8-c9fd-4b97-94a5-6332f9cad77a",
      "subject": "ATTACK:enterprise:S0622",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3577cdd8-c9fd-4b97-94a5-6332f9cad77a",
      "modified": "2026-04-29T14:23:05.991Z",
      "references": [
        {
          "source_name": "Malwarebytes Kimsuky June 2021",
          "url": "https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3890dead-331f-498d-b99d-2191150ae2ac",
      "subject": "ATTACK:enterprise:S0458",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3890dead-331f-498d-b99d-2191150ae2ac",
      "modified": "2026-04-29T14:23:05.997Z",
      "references": [
        {
          "source_name": "Antiy CERT Ramsay April 2020",
          "url": "https://www.programmersought.com/article/62493896999/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3a8d8063-3f4d-420d-8c72-2b99077aa487",
      "subject": "ATTACK:enterprise:G0050",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3a8d8063-3f4d-420d-8c72-2b99077aa487",
      "modified": "2026-07-31T18:47:44.163Z",
      "references": [
        {
          "source_name": "ESET OceanLotus",
          "url": "https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"
        },
        {
          "source_name": "Cybereason Oceanlotus May 2017",
          "url": "https://www.cybereason.com/blog/operation-cobalt-kitty-apt"
        },
        {
          "source_name": "Cybereason Cobalt Kitty 2017",
          "url": "https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"
        },
        {
          "source_name": "ESET OceanLotus Mar 2019",
          "url": "https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"
        },
        {
          "source_name": "FireEye APT32 April 2020",
          "url": "https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html"
        },
        {
          "source_name": "Amnesty Intl. Ocean Lotus February 2021",
          "url": "https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3b9a3c69-a667-4bba-b920-ee04e729800b",
      "subject": "ATTACK:enterprise:S9037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3b9a3c69-a667-4bba-b920-ee04e729800b",
      "modified": "2026-04-29T14:23:06.003Z",
      "references": [
        {
          "source_name": "CloudSEK_RustyWater_Jan2026",
          "url": "https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3cce0cb1-051f-48da-8712-e9d2eba871a0",
      "subject": "ATTACK:enterprise:G0012",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3cce0cb1-051f-48da-8712-e9d2eba871a0",
      "modified": "2026-07-31T18:48:11.889Z",
      "references": [
        {
          "source_name": "Securelist Darkhotel Aug 2015",
          "url": "https://securelist.com/darkhotels-attacks-in-2015/71713/"
        },
        {
          "source_name": "Microsoft DUBNIUM July 2016",
          "url": "https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--3efa9831-8d67-4bd1-92d4-ef252747b701",
      "subject": "ATTACK:enterprise:G1002",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--3efa9831-8d67-4bd1-92d4-ef252747b701",
      "modified": "2026-07-31T20:48:39.520Z",
      "references": [
        {
          "source_name": "Forcepoint BITTER Pakistan Oct 2016",
          "url": "https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"
        },
        {
          "source_name": "Cisco Talos Bitter Bangladesh May 2022",
          "url": "https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--410f6714-cd02-4253-b324-a8ac15e70bca",
      "subject": "ATTACK:enterprise:G0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--410f6714-cd02-4253-b324-a8ac15e70bca",
      "modified": "2026-07-31T18:48:07.817Z",
      "references": [
        {
          "source_name": "ESET T3 Threat Report 2021",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"
        },
        {
          "source_name": "F-Secure The Dukes",
          "url": "https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"
        },
        {
          "source_name": "MSTIC NOBELIUM May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
        },
        {
          "source_name": "Secureworks IRON HEMLOCK Profile",
          "url": "http://www.secureworks.com/research/threat-profiles/iron-hemlock"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--416fd781-438e-4130-bfac-8ac653e85c2c",
      "subject": "ATTACK:enterprise:S0011",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--416fd781-438e-4130-bfac-8ac653e85c2c",
      "modified": "2026-04-29T14:23:06.014Z",
      "references": [
        {
          "source_name": "TrendMicro Taidoor",
          "url": "http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4224c436-0960-4cea-b135-166008a1c087",
      "subject": "ATTACK:enterprise:S0585",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4224c436-0960-4cea-b135-166008a1c087",
      "modified": "2026-04-29T14:23:06.015Z",
      "references": [
        {
          "source_name": "Amnesty Intl. Ocean Lotus February 2021",
          "url": "https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--42580e44-781d-467d-b131-45f7d4651d0a",
      "subject": "ATTACK:enterprise:G0100",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--42580e44-781d-467d-b131-45f7d4651d0a",
      "modified": "2026-07-31T18:48:25.094Z",
      "references": [
        {
          "source_name": "Kaspersky Cloud Atlas December 2014",
          "url": "https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"
        },
        {
          "source_name": "Symantec Inception Framework March 2018",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"
        },
        {
          "source_name": "Unit 42 Inception November 2018",
          "url": "https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"
        },
        {
          "source_name": "Kaspersky Cloud Atlas August 2019",
          "url": "https://securelist.com/recent-cloud-atlas-activity/92016/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--45f64e39-c3f8-4665-8433-af9503852e53",
      "subject": "ATTACK:enterprise:C0001",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--45f64e39-c3f8-4665-8433-af9503852e53",
      "modified": "2026-07-31T18:47:18.939Z",
      "references": [
        {
          "source_name": "Talos Frankenstein June 2019",
          "url": "https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4852a801-3cd3-4a97-90ef-8cb5974c80d9",
      "subject": "ATTACK:enterprise:S0455",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4852a801-3cd3-4a97-90ef-8cb5974c80d9",
      "modified": "2026-04-29T14:23:06.024Z",
      "references": [
        {
          "source_name": "FireEye Metamorfo Apr 2018",
          "url": "https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"
        },
        {
          "source_name": "ESET Casbaneiro Oct 2019",
          "url": "https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4ae86603-3199-4692-b37c-f26a7c7e3fc2",
      "subject": "ATTACK:enterprise:G1011",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4ae86603-3199-4692-b37c-f26a7c7e3fc2",
      "modified": "2026-07-31T18:47:38.700Z",
      "references": [
        {
          "source_name": "Proofpoint Bumblebee April 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"
        },
        {
          "source_name": "Google EXOTIC LILY March 2022",
          "url": "https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4b98c580-7907-487c-a5b1-202663762c47",
      "subject": "ATTACK:enterprise:G0130",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4b98c580-7907-487c-a5b1-202663762c47",
      "modified": "2026-07-31T18:48:28.061Z",
      "references": [
        {
          "source_name": "Check Point Rocket Kitten",
          "url": "https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4bd4de17-4aa2-4924-a1fd-d82a68209cf0",
      "subject": "ATTACK:enterprise:M1018",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4bd4de17-4aa2-4924-a1fd-d82a68209cf0",
      "modified": "2026-04-29T14:23:06.029Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--4cfed6dd-68ac-4b0a-acd1-b888c0c69c4f",
      "subject": "ATTACK:enterprise:S0631",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--4cfed6dd-68ac-4b0a-acd1-b888c0c69c4f",
      "modified": "2026-04-29T14:23:06.030Z",
      "references": [
        {
          "source_name": "Cybereason Chaes Nov 2020",
          "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--509eddb7-b86f-4831-953f-15017b5d987e",
      "subject": "ATTACK:enterprise:G0035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--509eddb7-b86f-4831-953f-15017b5d987e",
      "modified": "2026-07-31T20:48:28.448Z",
      "references": [
        {
          "source_name": "Gigamon Berserk Bear October 2021",
          "url": "https://vblocalhost.com/uploads/VB2021-Slowik.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5259c2ae-964d-49b6-a7e7-6246e748369f",
      "subject": "ATTACK:enterprise:G0034",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5259c2ae-964d-49b6-a7e7-6246e748369f",
      "modified": "2026-07-31T20:48:32.889Z",
      "references": [
        {
          "source_name": "ESET Telebots Dec 2016",
          "url": "https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"
        },
        {
          "source_name": "Google_WinRAR_vuln_2023",
          "url": "https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/"
        },
        {
          "source_name": "mandiant_apt44_unearthing_sandworm",
          "url": "https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"
        },
        {
          "source_name": "US District Court Indictment GRU Unit 74455 October 2020",
          "url": "https://www.justice.gov/opa/press-release/file/1328521/download"
        },
        {
          "source_name": "US-CERT Ukraine Feb 2016",
          "url": "https://www.us-cert.gov/ics/alerts/IR-ALERT-H-16-056-01"
        },
        {
          "source_name": "iSight Sandworm Oct 2014",
          "url": "https://web.archive.org/web/20160503234007/https:/www.isightpartners.com/2014/10/cve-2014-4114/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--537d027b-0559-4d1a-8f28-a918d3d23e63",
      "subject": "ATTACK:enterprise:G0066",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--537d027b-0559-4d1a-8f28-a918d3d23e63",
      "modified": "2026-07-31T18:47:35.937Z",
      "references": [
        {
          "source_name": "CSM Elderwood Sept 2012",
          "url": "https://www.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-two-huge-cyber-gangs-in-China"
        },
        {
          "source_name": "Symantec Elderwood Sept 2012",
          "url": "https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--538eb3a4-466e-42d0-9f12-bd9b6de0abe4",
      "subject": "ATTACK:enterprise:C0015",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--538eb3a4-466e-42d0-9f12-bd9b6de0abe4",
      "modified": "2026-07-31T18:47:25.321Z",
      "references": [
        {
          "source_name": "DFIR Conti Bazar Nov 2021",
          "url": "https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--54fd87c2-7d29-422f-bf92-96e7d603563f",
      "subject": "ATTACK:enterprise:G0064",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--54fd87c2-7d29-422f-bf92-96e7d603563f",
      "modified": "2026-07-31T20:48:53.073Z",
      "references": [
        {
          "source_name": "Microsoft Holmium June 2020",
          "url": "https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--550096e6-6ed2-41de-8cfc-3a59da54bf68",
      "subject": "ATTACK:enterprise:S1160",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--550096e6-6ed2-41de-8cfc-3a59da54bf68",
      "modified": "2026-04-29T14:23:06.041Z",
      "references": [
        {
          "source_name": "Bleeping Computer Latrodectus April 2024",
          "url": "https://www.bleepingcomputer.com/news/security/new-latrodectus-malware-attacks-use-microsoft-cloudflare-themes/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--554fbee8-58a9-4557-bf49-f1df2c5da442",
      "subject": "ATTACK:enterprise:S0499",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--554fbee8-58a9-4557-bf49-f1df2c5da442",
      "modified": "2026-04-29T14:23:06.042Z",
      "references": [
        {
          "source_name": "FireEye Hancitor",
          "url": "https://www.fireeye.com/blog/threat-research/2016/09/hancitor_aka_chanit.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--55b42570-f8fe-472f-ae12-e3dd0b6de9c6",
      "subject": "ATTACK:enterprise:S0332",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--55b42570-f8fe-472f-ae12-e3dd0b6de9c6",
      "modified": "2026-04-29T14:23:06.042Z",
      "references": [
        {
          "source_name": "Fortinet Remcos Campaign NOV 2024",
          "url": "https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5a9f2571-e611-4f7f-b0c9-6fc2d306b2f6",
      "subject": "ATTACK:enterprise:G0021",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5a9f2571-e611-4f7f-b0c9-6fc2d306b2f6",
      "modified": "2026-07-31T18:48:23.700Z",
      "references": [
        {
          "source_name": "Kaspersky MoleRATs April 2019",
          "url": "https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"
        },
        {
          "source_name": "Unit42 Molerat Mar 2020",
          "url": "https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"
        },
        {
          "source_name": "Cybereason Molerats Dec 2020",
          "url": "https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5b63f8fd-efc7-454f-b466-d5e0a525f64f",
      "subject": "ATTACK:enterprise:G0040",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5b63f8fd-efc7-454f-b466-d5e0a525f64f",
      "modified": "2026-07-31T20:48:26.276Z",
      "references": [
        {
          "source_name": "Cymmetria Patchwork",
          "url": "https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"
        },
        {
          "source_name": "Securelist Dropping Elephant",
          "url": "https://securelist.com/the-dropping-elephant-actor/75328/"
        },
        {
          "source_name": "TrendMicro Patchwork Dec 2017",
          "url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
        },
        {
          "source_name": "Volexity Patchwork June 2018",
          "url": "https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5d881746-44f9-4865-86de-97253fc197fb",
      "subject": "ATTACK:enterprise:G0127",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5d881746-44f9-4865-86de-97253fc197fb",
      "modified": "2026-07-31T18:48:10.195Z",
      "references": [
        {
          "source_name": "Unit 42 Valak July 2020",
          "url": "https://unit42.paloaltonetworks.com/valak-evolution/"
        },
        {
          "source_name": "Unit 42 TA551 Jan 2021",
          "url": "https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"
        },
        {
          "source_name": "Secureworks GOLD CABIN",
          "url": "https://www.secureworks.com/research/threat-profiles/gold-cabin"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5f1493e8-65d8-474a-b6b7-c1311fc24d98",
      "subject": "ATTACK:enterprise:G0048",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5f1493e8-65d8-474a-b6b7-c1311fc24d98",
      "modified": "2026-07-31T18:48:17.357Z",
      "references": [
        {
          "source_name": "Group IB RTM August 2019",
          "url": "https://www.group-ib.com/blog/rtm"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--5f338678-212e-4940-b0f1-79b14d8c8c96",
      "subject": "ATTACK:enterprise:G1039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--5f338678-212e-4940-b0f1-79b14d8c8c96",
      "modified": "2026-07-31T18:48:06.136Z",
      "references": [
        {
          "source_name": "group-ib_redcurl1",
          "url": "https://www.group-ib.com/resources/research-hub/red-curl/"
        },
        {
          "source_name": "trendmicro_redcurl",
          "url": "https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6160a359-35cc-4bbe-ac29-500f2751ed4b",
      "subject": "ATTACK:enterprise:G0096",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6160a359-35cc-4bbe-ac29-500f2751ed4b",
      "modified": "2026-07-31T20:48:27.120Z",
      "references": [
        {
          "source_name": "FireEye APT41 Aug 2019",
          "url": "https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--61853db1-63fa-464a-8ac0-a2e6996850e1",
      "subject": "ATTACK:enterprise:S1087",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--61853db1-63fa-464a-8ac0-a2e6996850e1",
      "modified": "2026-04-29T14:23:06.058Z",
      "references": [
        {
          "source_name": "Recorded Future TAG-144 AUG 2025",
          "url": "https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--63065346-29bd-40de-9826-04646cc5a9a6",
      "subject": "ATTACK:enterprise:G1035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--63065346-29bd-40de-9826-04646cc5a9a6",
      "modified": "2026-07-31T18:48:03.095Z",
      "references": [
        {
          "source_name": "CERT-UA WinterVivern 2023",
          "url": "https://cert.gov.ua/article/3761104"
        },
        {
          "source_name": "DomainTools WinterVivern 2021",
          "url": "https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/"
        },
        {
          "source_name": "SentinelOne WinterVivern 2023",
          "url": "https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--64153f57-7a26-4254-86ff-29e87ead133c",
      "subject": "ATTACK:enterprise:S9044",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--64153f57-7a26-4254-86ff-29e87ead133c",
      "modified": "2026-07-31T03:28:10.654Z",
      "references": [
        {
          "source_name": "Artic Wolf Labs Kali365 Device Code April 2026",
          "url": "https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--645949a0-21a3-4c31-846d-33c2055d8bfd",
      "subject": "ATTACK:enterprise:G0126",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--645949a0-21a3-4c31-846d-33c2055d8bfd",
      "modified": "2026-07-31T18:47:56.578Z",
      "references": [
        {
          "source_name": "Malwarebytes Higaisa 2020",
          "url": "https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"
        },
        {
          "source_name": "Zscaler Higaisa 2020",
          "url": "https://www.zscaler.com/blogs/security-research/return-higaisa-apt"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--67f3f607-8c27-4a90-b1bf-e84f75815a42",
      "subject": "ATTACK:enterprise:S0660",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--67f3f607-8c27-4a90-b1bf-e84f75815a42",
      "modified": "2026-04-29T14:23:06.066Z",
      "references": [
        {
          "source_name": "Trend Micro DRBControl February 2020",
          "url": "https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6813e94f-a123-4898-80c8-59e74c390fe3",
      "subject": "ATTACK:enterprise:S0634",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6813e94f-a123-4898-80c8-59e74c390fe3",
      "modified": "2026-04-29T14:23:06.067Z",
      "references": [
        {
          "source_name": "MSTIC Nobelium Toolset May 2021",
          "url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--69684ccb-b9c0-4284-b2e5-09f15a691f80",
      "subject": "ATTACK:enterprise:S1030",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--69684ccb-b9c0-4284-b2e5-09f15a691f80",
      "modified": "2026-04-29T14:23:06.068Z",
      "references": [
        {
          "source_name": "Netskope Squirrelwaffle Oct 2021",
          "url": "https://www.netskope.com/blog/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6c4c4e5d-0641-4441-a5aa-d27f3362811f",
      "subject": "ATTACK:enterprise:G0142",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6c4c4e5d-0641-4441-a5aa-d27f3362811f",
      "modified": "2026-07-31T20:48:37.561Z",
      "references": [
        {
          "source_name": "Uptycs Confucius APT Jan 2021",
          "url": "https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--6d1cd674-0466-4209-b9b5-7ce45ed359d1",
      "subject": "ATTACK:enterprise:S0373",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--6d1cd674-0466-4209-b9b5-7ce45ed359d1",
      "modified": "2026-04-29T14:23:06.074Z",
      "references": [
        {
          "source_name": "Securelist Brazilian Banking Malware July 2020",
          "url": "https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--713c3a5e-931b-4c43-a945-c26f031b0183",
      "subject": "ATTACK:enterprise:C0016",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--713c3a5e-931b-4c43-a945-c26f031b0183",
      "modified": "2026-07-31T20:48:14.694Z",
      "references": [
        {
          "source_name": "Cylance Dust Storm",
          "url": "https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--721320d4-36f0-4449-8331-8fbe40b1dba5",
      "subject": "ATTACK:enterprise:S1014",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--721320d4-36f0-4449-8331-8fbe40b1dba5",
      "modified": "2026-04-29T14:23:06.081Z",
      "references": [
        {
          "source_name": "SecureWorks August 2019",
          "url": "https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--725648c5-1938-4c61-86f7-34fbb66cacfc",
      "subject": "ATTACK:enterprise:C0037",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--725648c5-1938-4c61-86f7-34fbb66cacfc",
      "modified": "2026-07-31T18:47:23.419Z",
      "references": [
        {
          "source_name": "TrendMicro Pikabot 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/a/a-look-into-pikabot-spam-wave-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--72edd078-766e-4ae1-80de-f2c5248fb9bf",
      "subject": "ATTACK:enterprise:S1183",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--72edd078-766e-4ae1-80de-f2c5248fb9bf",
      "modified": "2026-04-29T14:23:06.082Z",
      "references": [
        {
          "source_name": "DCSO StrelaStealer 2022",
          "url": "https://medium.com/@DCSO_CyTec/shortandmalicious-strelastealer-aims-for-mail-credentials-a4c3e78c8abc"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--73e00ae6-71f1-4ad7-861a-f0643b42c2ac",
      "subject": "ATTACK:enterprise:S0670",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--73e00ae6-71f1-4ad7-861a-f0643b42c2ac",
      "modified": "2026-04-29T14:23:06.084Z",
      "references": [
        {
          "source_name": "Check Point Warzone Feb 2020",
          "url": "https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"
        },
        {
          "source_name": "Uptycs Confucius APT Jan 2021",
          "url": "https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--748d3716-e476-4677-979b-cb4c51c598c1",
      "subject": "ATTACK:enterprise:S9020",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--748d3716-e476-4677-979b-cb4c51c598c1",
      "modified": "2026-04-29T14:23:06.085Z",
      "references": [
        {
          "source_name": "ESET MirrorFace DEC 2022",
          "url": "https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"
        },
        {
          "source_name": "Kaspersky LODEINFO OCT 2022",
          "url": "https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"
        },
        {
          "source_name": "ITOCHU LODEINFO JAN 2024",
          "url": "https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--75122837-7638-4ff2-8cb4-fbb8001e96f2",
      "subject": "ATTACK:enterprise:M1047",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--75122837-7638-4ff2-8cb4-fbb8001e96f2",
      "modified": "2026-04-29T14:23:06.085Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--76021528-7cb6-461a-870a-f681cac19285",
      "subject": "ATTACK:enterprise:G0062",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--76021528-7cb6-461a-870a-f681cac19285",
      "modified": "2026-07-31T18:47:58.842Z",
      "references": [
        {
          "source_name": "Proofpoint TA459 April 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--795b9ebc-6bf1-47f9-b236-117c2216c5d4",
      "subject": "ATTACK:enterprise:G0098",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--795b9ebc-6bf1-47f9-b236-117c2216c5d4",
      "modified": "2026-07-31T18:48:01.728Z",
      "references": [
        {
          "source_name": "TrendMicro BlackTech June 2017",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"
        },
        {
          "source_name": "NTT Security Flagpro new December 2021",
          "url": "https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7a2f70b7-7b6e-4c05-8f71-42a494b055ce",
      "subject": "ATTACK:enterprise:G0078",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7a2f70b7-7b6e-4c05-8f71-42a494b055ce",
      "modified": "2026-07-31T18:47:42.668Z",
      "references": [
        {
          "source_name": "Unit 42 Gorgon Group Aug 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7a64af0b-aebe-47d1-9f96-ef0ecad52df9",
      "subject": "ATTACK:enterprise:G0065",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7a64af0b-aebe-47d1-9f96-ef0ecad52df9",
      "modified": "2026-07-31T20:48:38.256Z",
      "references": [
        {
          "source_name": "Proofpoint Leviathan Oct 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"
        },
        {
          "source_name": "CISA AA21-200A APT40 July 2021",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa21-200a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7a75d200-29f5-4f8a-b052-bcbe4e5ca236",
      "subject": "ATTACK:enterprise:M1031",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7a75d200-29f5-4f8a-b052-bcbe4e5ca236",
      "modified": "2026-04-29T14:23:06.093Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7b4af425-27a6-4330-85e2-d8d03911d923",
      "subject": "ATTACK:enterprise:G0103",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7b4af425-27a6-4330-85e2-d8d03911d923",
      "modified": "2026-07-31T18:48:06.607Z",
      "references": [
        {
          "source_name": "FOX-IT May 2016 Mofang",
          "url": "https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7d1c227c-25b9-4e8b-ad88-618d9f382420",
      "subject": "ATTACK:enterprise:S1086",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7d1c227c-25b9-4e8b-ad88-618d9f382420",
      "modified": "2026-04-29T14:23:06.097Z",
      "references": [
        {
          "source_name": "Telefonica Snip3 December 2021",
          "url": "https://telefonicatech.com/blog/snip3-investigacion-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7d93f85e-52a1-4771-8378-0fabfd707ece",
      "subject": "ATTACK:enterprise:S0433",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7d93f85e-52a1-4771-8378-0fabfd707ece",
      "modified": "2026-04-29T14:23:06.097Z",
      "references": [
        {
          "source_name": "Carbon Black HotCroissant April 2020",
          "url": "https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--7e9f9565-d9c5-47e5-a962-8dfa3dc77fc6",
      "subject": "ATTACK:enterprise:S0476",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--7e9f9565-d9c5-47e5-a962-8dfa3dc77fc6",
      "modified": "2026-04-29T14:23:06.098Z",
      "references": [
        {
          "source_name": "Unit 42 Valak July 2020",
          "url": "https://unit42.paloaltonetworks.com/valak-evolution/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--80fb05e9-68b8-4e3f-bc9a-2a5f828c397c",
      "subject": "ATTACK:enterprise:G0019",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--80fb05e9-68b8-4e3f-bc9a-2a5f828c397c",
      "modified": "2026-07-31T18:47:46.296Z",
      "references": [
        {
          "source_name": "CheckPoint Naikon May 2020",
          "url": "https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8126e72d-1be0-4237-b9c9-33045be072c3",
      "subject": "ATTACK:enterprise:G0005",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8126e72d-1be0-4237-b9c9-33045be072c3",
      "modified": "2026-07-31T18:48:18.136Z",
      "references": [
        {
          "source_name": "Moran 2014",
          "url": "https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html"
        },
        {
          "source_name": "Trend Micro IXESHE 2012",
          "url": "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--817f5a5a-c22b-4d49-8e5a-35b48da7c358",
      "subject": "ATTACK:enterprise:S0234",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--817f5a5a-c22b-4d49-8e5a-35b48da7c358",
      "modified": "2026-04-29T14:23:06.102Z",
      "references": [
        {
          "source_name": "CheckPoint Bandook Nov 2020",
          "url": "https://research.checkpoint.com/2020/bandook-signed-delivered/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--818b440b-075d-483d-83ff-9991a78e25f4",
      "subject": "ATTACK:enterprise:G0073",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--818b440b-075d-483d-83ff-9991a78e25f4",
      "modified": "2026-07-31T18:48:31.081Z",
      "references": [
        {
          "source_name": "FireEye APT19",
          "url": "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8328f7af-8b66-45fd-89dc-2833fa37af23",
      "subject": "ATTACK:enterprise:S0240",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8328f7af-8b66-45fd-89dc-2833fa37af23",
      "modified": "2026-04-29T14:23:06.105Z",
      "references": [
        {
          "source_name": "Malwarebytes RokRAT VBA January 2021",
          "url": "https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--83540a4e-9f12-4792-a541-910bb8fd0fe4",
      "subject": "ATTACK:enterprise:T1566.001",
      "predicate": "subtechnique-of",
      "object": "ATTACK:enterprise:T1566",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--83540a4e-9f12-4792-a541-910bb8fd0fe4",
      "modified": "2026-04-29T14:23:06.105Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--844a2a38-68aa-45ed-8fa8-4854500cb63d",
      "subject": "ATTACK:enterprise:C0011",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--844a2a38-68aa-45ed-8fa8-4854500cb63d",
      "modified": "2026-07-31T18:47:31.431Z",
      "references": [
        {
          "source_name": "Cisco Talos Transparent Tribe Education Campaign July 2022",
          "url": "https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8589a293-b318-4028-865c-7c5e5554aa60",
      "subject": "ATTACK:enterprise:G1033",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8589a293-b318-4028-865c-7c5e5554aa60",
      "modified": "2026-07-31T20:48:42.693Z",
      "references": [
        {
          "source_name": "Google TAG COLDRIVER January 2024",
          "url": "https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--85b4d635-f5f4-4f4f-abc2-31203cad496d",
      "subject": "ATTACK:enterprise:C0005",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--85b4d635-f5f4-4f4f-abc2-31203cad496d",
      "modified": "2026-07-31T18:47:22.599Z",
      "references": [
        {
          "source_name": "ESET Operation Spalax Jan 2021",
          "url": "https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--862470eb-b43a-42d9-ab06-4ca6fbc3671d",
      "subject": "ATTACK:enterprise:G0013",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--862470eb-b43a-42d9-ab06-4ca6fbc3671d",
      "modified": "2026-07-31T18:48:25.961Z",
      "references": [
        {
          "source_name": "FireEye APT30",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8c4e1965-b744-4d2e-b809-951d2b954098",
      "subject": "ATTACK:enterprise:G1059",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8c4e1965-b744-4d2e-b809-951d2b954098",
      "modified": "2026-10-01T21:17:53.210Z",
      "references": [
        {
          "source_name": "Mandiant_UNC1549TTPsTools_Nov2025",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--8f8caa9d-b728-4b54-88b0-b7cd3646f437",
      "subject": "ATTACK:enterprise:G0137",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--8f8caa9d-b728-4b54-88b0-b7cd3646f437",
      "modified": "2026-07-31T18:47:59.579Z",
      "references": [
        {
          "source_name": "Kaspersky Ferocious Kitten Jun 2021",
          "url": "https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--92c83d10-7e4f-4d4a-9766-b2162ee72cb1",
      "subject": "ATTACK:enterprise:G1026",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--92c83d10-7e4f-4d4a-9766-b2162ee72cb1",
      "modified": "2026-07-31T18:48:16.130Z",
      "references": [
        {
          "source_name": "SCILabs Malteiro 2021",
          "url": "https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--943577e6-928e-43dd-a175-60e6046c4499",
      "subject": "ATTACK:enterprise:G1008",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--943577e6-928e-43dd-a175-60e6046c4499",
      "modified": "2026-07-31T18:47:36.874Z",
      "references": [
        {
          "source_name": "MalwareBytes SideCopy Dec 2021",
          "url": "https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--960b8079-bc54-4bc1-841e-7e5a80c772a3",
      "subject": "ATTACK:enterprise:G1054",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--960b8079-bc54-4bc1-841e-7e5a80c772a3",
      "modified": "2026-07-31T18:48:08.855Z",
      "references": [
        {
          "source_name": "ESET MirrorFace DEC 2022",
          "url": "https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"
        },
        {
          "source_name": "Kaspersky LODEINFO OCT 2022",
          "url": "https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"
        },
        {
          "source_name": "ITOCHU LODEINFO JAN 2024",
          "url": "https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--97d36a97-c49f-4706-8597-3d9dd86d8c60",
      "subject": "ATTACK:enterprise:S1207",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--97d36a97-c49f-4706-8597-3d9dd86d8c60",
      "modified": "2026-04-29T14:23:06.132Z",
      "references": [
        {
          "source_name": "Acronis XLoader 2021",
          "url": "https://www.acronis.com/en-us/cyber-protection-center/posts/trojan-as-a-service-from-formbook-to-xloader/"
        },
        {
          "source_name": "Google XLoader 2017",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/formbook-malware-distribution-campaigns/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--985f770f-6068-4c5c-9405-0515e43aeed5",
      "subject": "ATTACK:enterprise:M1054",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--985f770f-6068-4c5c-9405-0515e43aeed5",
      "modified": "2026-04-29T14:23:06.133Z",
      "references": [
        {
          "source_name": "ACSC Email Spoofing",
          "url": "https://web.archive.org/web/20210708014107/https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf"
        },
        {
          "source_name": "Microsoft Anti Spoofing",
          "url": "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--98c14ff6-0e71-4cfe-ae3f-bc8a7f0c5260",
      "subject": "ATTACK:enterprise:C0022",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--98c14ff6-0e71-4cfe-ae3f-bc8a7f0c5260",
      "modified": "2026-07-31T21:14:22.755Z",
      "references": [
        {
          "source_name": "McAfee Lazarus Jul 2020",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27"
        },
        {
          "source_name": "ClearSky Lazarus Aug 2020",
          "url": "https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9acd37b4-5729-4c70-b943-d95dc0882cb8",
      "subject": "ATTACK:enterprise:S0268",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9acd37b4-5729-4c70-b943-d95dc0882cb8",
      "modified": "2026-04-29T14:23:06.136Z",
      "references": [
        {
          "source_name": "Talos Bisonal Mar 2020",
          "url": "https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9b9e1922-1b87-479d-8fcf-b75af9a0e850",
      "subject": "ATTACK:enterprise:C0060",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9b9e1922-1b87-479d-8fcf-b75af9a0e850",
      "modified": "2026-07-31T18:47:27.134Z",
      "references": [
        {
          "source_name": "ESET MirrorFace 2025",
          "url": "https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/"
        },
        {
          "source_name": "Trend Micro Earth Kasha Anel NOV 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9c1ec4da-96d9-4173-b944-77c341a19572",
      "subject": "ATTACK:enterprise:G0061",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9c1ec4da-96d9-4173-b944-77c341a19572",
      "modified": "2026-07-31T18:48:29.858Z",
      "references": [
        {
          "source_name": "FireEye Obfuscation June 2017",
          "url": "https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"
        },
        {
          "source_name": "FireEye Know Your Enemy FIN8 Aug 2016",
          "url": "https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"
        },
        {
          "source_name": "FireEye Fin8 May 2016",
          "url": "https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9c7679e8-2be6-4cbb-a7f4-8583162366b3",
      "subject": "ATTACK:enterprise:G0133",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9c7679e8-2be6-4cbb-a7f4-8583162366b3",
      "modified": "2026-07-31T18:48:31.072Z",
      "references": [
        {
          "source_name": "Security Affairs DustSquad Oct 2018",
          "url": "https://securityaffairs.co/wordpress/77165/apt/russia-linked-apt-dustsquad.html"
        },
        {
          "source_name": "ESET Nomadic Octopus 2018",
          "url": "https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9cd8ce7f-7440-4ac4-b4cf-a758dd158672",
      "subject": "ATTACK:enterprise:G0140",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9cd8ce7f-7440-4ac4-b4cf-a758dd158672",
      "modified": "2026-07-31T18:48:13.534Z",
      "references": [
        {
          "source_name": "MalwareBytes LazyScripter Feb 2021",
          "url": "https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9d239fc5-5d40-4991-ae41-761686ab43a2",
      "subject": "ATTACK:enterprise:G0129",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9d239fc5-5d40-4991-ae41-761686ab43a2",
      "modified": "2026-07-31T18:47:52.952Z",
      "references": [
        {
          "source_name": "Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022",
          "url": "https://blog.talosintelligence.com/mustang-panda-targets-europe/"
        },
        {
          "source_name": "CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024",
          "url": "https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"
        },
        {
          "source_name": "Lab52 MUSTANG PANDA PUBLOAD MAY 2023",
          "url": "https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"
        },
        {
          "source_name": "IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025",
          "url": "https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"
        },
        {
          "source_name": "2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA",
          "url": "https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"
        },
        {
          "source_name": "Google TAG Ukraine Threat Landscape March 2022",
          "url": "https://blog.google/threat-analysis-group/update-threat-landscape-ukraine"
        },
        {
          "source_name": "Recorded Future REDDELTA July 2020",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"
        },
        {
          "source_name": "Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024",
          "url": "https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"
        },
        {
          "source_name": "Proofpoint TA416 November 2020",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--9e92ab98-b547-4206-8158-a186f7570550",
      "subject": "ATTACK:enterprise:S1065",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--9e92ab98-b547-4206-8158-a186f7570550",
      "modified": "2026-04-29T14:23:06.141Z",
      "references": [
        {
          "source_name": "MalwareBytes WoodyRAT Aug 2022",
          "url": "https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a025d011-6e46-4d3a-a9f7-31324027b7cf",
      "subject": "ATTACK:enterprise:G0049",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a025d011-6e46-4d3a-a9f7-31324027b7cf",
      "modified": "2026-07-31T20:48:35.716Z",
      "references": [
        {
          "source_name": "ClearSky OilRig Jan 2017",
          "url": "http://www.clearskysec.com/oilrig/"
        },
        {
          "source_name": "Unit 42 OopsIE! Feb 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"
        },
        {
          "source_name": "Unit 42 QUADAGENT July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"
        },
        {
          "source_name": "Crowdstrike Helix Kitten Nov 2018",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a2c57145-9e7c-4536-87f6-428c8219377e",
      "subject": "ATTACK:enterprise:C0047",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a2c57145-9e7c-4536-87f6-428c8219377e",
      "modified": "2026-07-31T18:47:19.647Z",
      "references": [
        {
          "source_name": "Recorded Future RedDelta 2025",
          "url": "https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a4d2042a-c211-4145-a406-e39bc700d652",
      "subject": "ATTACK:enterprise:G1036",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a4d2042a-c211-4145-a406-e39bc700d652",
      "modified": "2026-07-31T18:48:24.894Z",
      "references": [
        {
          "source_name": "Microsoft Moonstone Sleet 2024",
          "url": "https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a4f5c455-7dd0-466d-8b58-b347bfadd09f",
      "subject": "ATTACK:enterprise:S9050",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a4f5c455-7dd0-466d-8b58-b347bfadd09f",
      "modified": "2026-09-11T19:55:20.003Z",
      "references": [
        {
          "source_name": "QuorumCyber_Vidar_March2023",
          "url": "https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a65fd9d5-0802-44ca-9d8b-025a62455faf",
      "subject": "ATTACK:enterprise:S0496",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a65fd9d5-0802-44ca-9d8b-025a62455faf",
      "modified": "2026-04-29T14:23:06.152Z",
      "references": [
        {
          "source_name": "G Data Sodinokibi June 2019",
          "url": "https://www.gdatasoftware.com/blog/2019/06/31724-strange-bits-sodinokibi-spam-cinarat-and-fake-g-data"
        },
        {
          "source_name": "Cylance Sodinokibi July 2019",
          "url": "https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"
        },
        {
          "source_name": "Secureworks REvil September 2019",
          "url": "https://www.secureworks.com/research/revil-sodinokibi-ransomware"
        },
        {
          "source_name": "McAfee Sodinokibi October 2019",
          "url": "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"
        },
        {
          "source_name": "Picus Sodinokibi January 2020",
          "url": "https://www.picussecurity.com/blog/a-brief-history-and-further-technical-analysis-of-sodinokibi-ransomware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--a9960bcf-c6aa-411c-80d0-556ec7230b68",
      "subject": "ATTACK:enterprise:S0648",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--a9960bcf-c6aa-411c-80d0-556ec7230b68",
      "modified": "2026-04-29T14:23:06.156Z",
      "references": [
        {
          "source_name": "eSentire FIN7 July 2021",
          "url": "https://www.esentire.com/security-advisories/notorious-cybercrime-gang-fin7-lands-malware-in-law-firm-using-fake-legal-complaint-against-jack-daniels-owner-brown-forman-inc"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--af48f343-0359-444b-b6b4-1cddd36ddfd7",
      "subject": "ATTACK:enterprise:S0642",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--af48f343-0359-444b-b6b4-1cddd36ddfd7",
      "modified": "2026-06-13T12:04:40.998Z",
      "references": [
        {
          "source_name": "Accenture MUDCARP March 2019",
          "url": "https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b23e8d31-bb6a-42b4-ab34-1c9e302a3b74",
      "subject": "ATTACK:enterprise:S0356",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b23e8d31-bb6a-42b4-ab34-1c9e302a3b74",
      "modified": "2026-04-29T14:23:06.168Z",
      "references": [
        {
          "source_name": "Malwarebytes Konni Aug 2021",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b43dfc0c-beca-45c0-bb47-5b57a6acada9",
      "subject": "ATTACK:enterprise:G0134",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b43dfc0c-beca-45c0-bb47-5b57a6acada9",
      "modified": "2026-07-31T18:48:24.282Z",
      "references": [
        {
          "source_name": "Proofpoint Operation Transparent Tribe March 2016",
          "url": "https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"
        },
        {
          "source_name": "Kaspersky Transparent Tribe August 2020",
          "url": "https://securelist.com/transparent-tribe-part-1/98127/"
        },
        {
          "source_name": "Talos Oblique RAT March 2021",
          "url": "https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"
        },
        {
          "source_name": "Talos Transparent Tribe May 2021",
          "url": "https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"
        },
        {
          "source_name": "Unit 42 ProjectM March 2016",
          "url": "https://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b50a211b-1c54-4e55-9285-584f4e7f9bda",
      "subject": "ATTACK:enterprise:S1111",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b50a211b-1c54-4e55-9285-584f4e7f9bda",
      "modified": "2026-04-29T14:23:06.173Z",
      "references": [
        {
          "source_name": "Ensilo Darkgate 2018",
          "url": "https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b7d44225-31cf-4766-b585-debf0ed8d965",
      "subject": "ATTACK:enterprise:S0483",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b7d44225-31cf-4766-b585-debf0ed8d965",
      "modified": "2026-04-29T14:23:06.176Z",
      "references": [
        {
          "source_name": "DFIR_Sodinokibi_Ransomware",
          "url": "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/"
        },
        {
          "source_name": "Juniper IcedID June 2020",
          "url": "https://blogs.juniper.net/en-us/threat-research/covid-19-and-fmla-campaigns-used-to-install-new-icedid-banking-malware"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b87f6c02-8f95-4e40-a848-b6e3c069d703",
      "subject": "ATTACK:enterprise:S0673",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b87f6c02-8f95-4e40-a848-b6e3c069d703",
      "modified": "2026-04-29T14:23:06.177Z",
      "references": [
        {
          "source_name": "Prevailion DarkWatchman 2021",
          "url": "https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--b9f1dec0-f9b8-4cc3-a26c-5fc819f603a0",
      "subject": "ATTACK:enterprise:G0094",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--b9f1dec0-f9b8-4cc3-a26c-5fc819f603a0",
      "modified": "2026-07-31T20:48:25.380Z",
      "references": [
        {
          "source_name": "Talos Kimsuky Nov 2021",
          "url": "https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"
        },
        {
          "source_name": "Zdnet Kimsuky Dec 2018",
          "url": "https://www.zdnet.com/article/cyber-espionage-group-uses-chrome-extension-to-infect-victims/"
        },
        {
          "source_name": "Cybereason Kimsuky November 2020",
          "url": "https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"
        },
        {
          "source_name": "Securonix Kimsuky February 2025",
          "url": "https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"
        },
        {
          "source_name": "Malwarebytes Kimsuky June 2021",
          "url": "https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"
        },
        {
          "source_name": "VirusBulletin Kimsuky October 2019",
          "url": "https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/"
        },
        {
          "source_name": "KISA Operation Muzabi",
          "url": "https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"
        },
        {
          "source_name": "NaumaanProofpoint_GlobalClickFix_April2025",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"
        },
        {
          "source_name": "Securelist Kimsuky Sept 2013",
          "url": "https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"
        },
        {
          "source_name": "ThreatConnect Kimsuky September 2020",
          "url": "https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bd097aa0-33e4-47a7-8ef4-b765aae9e76f",
      "subject": "ATTACK:enterprise:S9035",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bd097aa0-33e4-47a7-8ef4-b765aae9e76f",
      "modified": "2026-04-29T14:23:06.184Z",
      "references": [
        {
          "source_name": "Splunk LAMEHUG SEP 2025",
          "url": "https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bd3926e9-9c91-43f2-913d-16a7e94cc0ae",
      "subject": "ATTACK:enterprise:G0095",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bd3926e9-9c91-43f2-913d-16a7e94cc0ae",
      "modified": "2026-07-31T18:47:50.002Z",
      "references": [
        {
          "source_name": "Securelist Machete Aug 2014",
          "url": "https://securelist.com/el-machete/66108/"
        },
        {
          "source_name": "ESET Machete July 2019",
          "url": "https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"
        },
        {
          "source_name": "360 Machete Sep 2020",
          "url": "https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--bfa95fdc-6f4f-48a9-a155-189c81dc9ebd",
      "subject": "ATTACK:enterprise:M1017",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--bfa95fdc-6f4f-48a9-a155-189c81dc9ebd",
      "modified": "2026-04-29T14:23:06.187Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c191afcc-515a-4f0c-85cc-15af0fd3674a",
      "subject": "ATTACK:enterprise:S0650",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c191afcc-515a-4f0c-85cc-15af0fd3674a",
      "modified": "2026-04-29T14:23:06.190Z",
      "references": [
        {
          "source_name": "Cyberint Qakbot May 2021",
          "url": "https://blog.cyberint.com/qakbot-banking-trojan"
        },
        {
          "source_name": "Group IB Ransomware September 2020",
          "url": "https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"
        },
        {
          "source_name": "Kaspersky QakBot September 2021",
          "url": "https://securelist.com/qakbot-technical-analysis/103931/"
        },
        {
          "source_name": "Trend Micro Qakbot May 2020",
          "url": "https://www.trendmicro.com/vinfo/ph/security/news/cybercrime-and-digital-threats/qakbot-resurges-spreads-through-vbs-files"
        },
        {
          "source_name": "Microsoft Ransomware as a Service",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
        },
        {
          "source_name": "ATT QakBot April 2021",
          "url": "https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"
        },
        {
          "source_name": "Kroll Qakbot June 2020",
          "url": "https://www.kroll.com/en/insights/publications/cyber/qakbot-malware-exfiltrating-emails-thread-hijacking-attacks"
        },
        {
          "source_name": "Trend Micro Qakbot December 2020",
          "url": "https://success.trendmicro.com/en-US/solution/KA-0011282"
        },
        {
          "source_name": "Deep Instinct Black Basta August 2022",
          "url": "https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c35e3d28-f9f2-4547-9927-7b734ebec54c",
      "subject": "ATTACK:enterprise:G0085",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c35e3d28-f9f2-4547-9927-7b734ebec54c",
      "modified": "2026-07-31T20:48:48.797Z",
      "references": [
        {
          "source_name": "FireEye Hacking FIN4 Video Dec 2014",
          "url": "https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"
        },
        {
          "source_name": "FireEye Hacking FIN4 Dec 2014",
          "url": "https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c389a84f-0ab2-4ab8-aa65-cb668513fce8",
      "subject": "ATTACK:enterprise:S0340",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c389a84f-0ab2-4ab8-aa65-cb668513fce8",
      "modified": "2026-04-29T14:23:06.192Z",
      "references": [
        {
          "source_name": "ESET Nomadic Octopus 2018",
          "url": "https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c671056c-f213-4084-9e9e-3361274ceb80",
      "subject": "ATTACK:enterprise:G0102",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c671056c-f213-4084-9e9e-3361274ceb80",
      "modified": "2026-07-31T20:48:50.503Z",
      "references": [
        {
          "source_name": "Red Canary Hospital Thwarted Ryuk October 2020",
          "url": "https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/"
        },
        {
          "source_name": "CrowdStrike Grim Spider May 2019",
          "url": "https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"
        },
        {
          "source_name": "Mandiant FIN12 Oct 2021",
          "url": "https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c767de3c-af29-4e98-8292-067359765d5f",
      "subject": "ATTACK:enterprise:S1017",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c767de3c-af29-4e98-8292-067359765d5f",
      "modified": "2026-04-29T14:23:06.198Z",
      "references": [
        {
          "source_name": "Palo Alto Unit 42 OutSteel SaintBot February 2022 ",
          "url": "https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c7721c41-83aa-4988-b431-e3135028d11e",
      "subject": "ATTACK:enterprise:S1039",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c7721c41-83aa-4988-b431-e3135028d11e",
      "modified": "2026-04-29T14:23:06.198Z",
      "references": [
        {
          "source_name": "Cybereason Bumblebee August 2022",
          "url": "https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control"
        },
        {
          "source_name": "Symantec Bumblebee June 2022",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime"
        },
        {
          "source_name": "Proofpoint Bumblebee April 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"
        },
        {
          "source_name": "Medium Ali Salem Bumblebee April 2022",
          "url": "https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c7a94c1f-8b59-4bd7-9ab4-1f95b9927022",
      "subject": "ATTACK:enterprise:S1018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c7a94c1f-8b59-4bd7-9ab4-1f95b9927022",
      "modified": "2026-04-29T14:23:06.198Z",
      "references": [
        {
          "source_name": "Malwarebytes Saint Bot April 2021",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"
        },
        {
          "source_name": "Palo Alto Unit 42 OutSteel SaintBot February 2022 ",
          "url": "https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c801e7ac-dce5-4349-bc07-446b5eec9744",
      "subject": "ATTACK:enterprise:G0138",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c801e7ac-dce5-4349-bc07-446b5eec9744",
      "modified": "2026-07-31T18:47:50.853Z",
      "references": [
        {
          "source_name": "AhnLab Andariel Subgroup of Lazarus June 2018",
          "url": "https://web.archive.org/web/20230213154832/http://download.ahnlab.com/global/brochure/%5BAnalysis%5DAndariel_Group.pdf"
        },
        {
          "source_name": "MalwareBytes Lazarus-Andariel Conceals Code April 2021",
          "url": "https://blog.malwarebytes.com/threat-intelligence/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c8679afc-7e74-42aa-b009-baea6be724ef",
      "subject": "ATTACK:enterprise:G1018",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c8679afc-7e74-42aa-b009-baea6be724ef",
      "modified": "2026-07-31T18:47:55.587Z",
      "references": [
        {
          "source_name": "Proofpoint TA2541 February 2022",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"
        },
        {
          "source_name": "Cisco Operation Layover September 2021",
          "url": "https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--c91113cc-70d5-4daa-8283-d79898502be8",
      "subject": "ATTACK:enterprise:S0665",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--c91113cc-70d5-4daa-8283-d79898502be8",
      "modified": "2026-04-29T14:23:06.200Z",
      "references": [
        {
          "source_name": "Kaspersky ThreatNeedle Feb 2021",
          "url": "https://securelist.com/lazarus-threatneedle/100803/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cbadd419-3f8c-485a-a458-09caed90d82e",
      "subject": "ATTACK:enterprise:G0131",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cbadd419-3f8c-485a-a458-09caed90d82e",
      "modified": "2026-07-31T18:48:18.974Z",
      "references": [
        {
          "source_name": "TrendMicro Tonto Team October 2020",
          "url": "https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cbdb211a-2772-4905-99f1-0415fb0738b3",
      "subject": "ATTACK:enterprise:S0453",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cbdb211a-2772-4905-99f1-0415fb0738b3",
      "modified": "2026-04-29T14:23:06.204Z",
      "references": [
        {
          "source_name": "Malwarebytes Pony April 2016",
          "url": "https://blog.malwarebytes.com/threat-analysis/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cbfb1a32-4582-4ecb-8a0e-4c76caaa5063",
      "subject": "ATTACK:enterprise:G0121",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cbfb1a32-4582-4ecb-8a0e-4c76caaa5063",
      "modified": "2026-07-31T18:47:52.098Z",
      "references": [
        {
          "source_name": "ATT Sidewinder January 2021",
          "url": "https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cc4f0b64-db39-4546-a5fc-a518ecc5438b",
      "subject": "ATTACK:enterprise:S0367",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cc4f0b64-db39-4546-a5fc-a518ecc5438b",
      "modified": "2026-04-29T14:23:06.204Z",
      "references": [
        {
          "source_name": "CIS Emotet Apr 2017",
          "url": "https://www.cisecurity.org/blog/emotet-changes-ttp-and-arrives-in-united-states/"
        },
        {
          "source_name": "Malwarebytes Emotet Dec 2017",
          "url": "https://support.malwarebytes.com/docs/DOC-2295"
        },
        {
          "source_name": "Symantec Emotet Jul 2018",
          "url": "https://www.symantec.com/blogs/threat-intelligence/evolution-emotet-trojan-distributor"
        },
        {
          "source_name": "US-CERT Emotet Jul 2018",
          "url": "https://www.us-cert.gov/ncas/alerts/TA18-201A"
        },
        {
          "source_name": "Talos Emotet Jan 2019",
          "url": "https://blog.talosintelligence.com/2019/01/return-of-emotet.html"
        },
        {
          "source_name": "Trend Micro Emotet Jan 2019",
          "url": "https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf"
        },
        {
          "source_name": "Picus Emotet Dec 2018",
          "url": "https://www.picussecurity.com/blog/the-christmas-card-you-never-wanted-a-new-wave-of-emotet-is-back-to-wreak-havoc.html"
        },
        {
          "source_name": "Carbon Black Emotet Apr 2019",
          "url": "https://www.carbonblack.com/2019/04/24/cb-tau-threat-intelligence-notification-emotet-utilizing-wmi-to-launch-powershell-encoded-code/"
        },
        {
          "source_name": "IBM IcedID November 2017",
          "url": "https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ce962c48-3390-4286-91bb-b38d7fb4f07a",
      "subject": "ATTACK:enterprise:G0092",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ce962c48-3390-4286-91bb-b38d7fb4f07a",
      "modified": "2026-07-31T18:48:05.845Z",
      "references": [
        {
          "source_name": "IBM TA505 April 2020",
          "url": "https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"
        },
        {
          "source_name": "Trend Micro TA505 June 2019",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"
        },
        {
          "source_name": "Proofpoint TA505 Sep 2017",
          "url": "https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"
        },
        {
          "source_name": "ProofPoint SettingContent-ms July 2018",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ta505-abusing-settingcontent-ms-within-pdf-files-distribute-flawedammyy-rat"
        },
        {
          "source_name": "Proofpoint TA505 June 2018",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times"
        },
        {
          "source_name": "Proofpoint TA505 Mar 2018",
          "url": "https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware"
        },
        {
          "source_name": "Cybereason TA505 April 2019",
          "url": "https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware"
        },
        {
          "source_name": "Proofpoint TA505 Jan 2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"
        },
        {
          "source_name": "Proofpoint TA505 October 2019",
          "url": "https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--cf9e7512-c510-4605-9035-f60335c351f4",
      "subject": "ATTACK:enterprise:G0046",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--cf9e7512-c510-4605-9035-f60335c351f4",
      "modified": "2026-07-31T20:48:32.222Z",
      "references": [
        {
          "source_name": "FireEye FIN7 April 2017",
          "url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
        },
        {
          "source_name": "DOJ FIN7 Aug 2018",
          "url": "https://www.justice.gov/opa/press-release/file/1084361/download"
        },
        {
          "source_name": "eSentire FIN7 July 2021",
          "url": "https://www.esentire.com/security-advisories/notorious-cybercrime-gang-fin7-lands-malware-in-law-firm-using-fake-legal-complaint-against-jack-daniels-owner-brown-forman-inc"
        },
        {
          "source_name": "CrowdStrike Carbon Spider August 2021",
          "url": "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"
        },
        {
          "source_name": "Flashpoint FIN 7 March 2019",
          "url": "https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d0061edc-becf-4ce9-ae91-5e1816d4a894",
      "subject": "ATTACK:enterprise:G0067",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d0061edc-becf-4ce9-ae91-5e1816d4a894",
      "modified": "2026-07-31T18:47:55.692Z",
      "references": [
        {
          "source_name": "FireEye APT37 Feb 2018",
          "url": "https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"
        },
        {
          "source_name": "Securelist ScarCruft May 2019",
          "url": "https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"
        },
        {
          "source_name": "Talos Group123",
          "url": "https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d095926f-b161-46ea-ac52-b7295ce42b80",
      "subject": "ATTACK:enterprise:S1013",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d095926f-b161-46ea-ac52-b7295ce42b80",
      "modified": "2026-04-29T14:23:06.211Z",
      "references": [
        {
          "source_name": "Cisco Talos Bitter Bangladesh May 2022",
          "url": "https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d37d5ca7-59f1-4938-83a6-64d30675a386",
      "subject": "ATTACK:enterprise:S0528",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d37d5ca7-59f1-4938-83a6-64d30675a386",
      "modified": "2026-04-29T14:23:06.214Z",
      "references": [
        {
          "source_name": "Securelist Brazilian Banking Malware July 2020",
          "url": "https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--d4545a14-77d8-4662-a773-648103524097",
      "subject": "ATTACK:enterprise:G1012",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--d4545a14-77d8-4662-a773-648103524097",
      "modified": "2026-07-31T18:47:51.542Z",
      "references": [
        {
          "source_name": "PWC Yellow Liderc 2023",
          "url": "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--da37b8c0-7006-43f9-aebb-44ae51a54dd0",
      "subject": "ATTACK:enterprise:S1075",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--da37b8c0-7006-43f9-aebb-44ae51a54dd0",
      "modified": "2026-04-29T14:23:06.223Z",
      "references": [
        {
          "source_name": "Mandiant Suspected Turla Campaign February 2023",
          "url": "https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--da6a811d-2a77-4f6f-a19e-2aff8662f12f",
      "subject": "ATTACK:enterprise:G0091",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--da6a811d-2a77-4f6f-a19e-2aff8662f12f",
      "modified": "2026-07-31T18:48:21.493Z",
      "references": [
        {
          "source_name": "SecureList Silence Nov 2017",
          "url": "https://securelist.com/the-silence/83009/"
        },
        {
          "source_name": "Group IB Silence Sept 2018",
          "url": "https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."
        },
        {
          "source_name": "Cyber Forensicator Silence Jan 2019",
          "url": "https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--db142c7e-9145-477a-bc52-1545bcacee83",
      "subject": "ATTACK:enterprise:S0696",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--db142c7e-9145-477a-bc52-1545bcacee83",
      "modified": "2026-04-29T14:23:06.224Z",
      "references": [
        {
          "source_name": "NTT Security Flagpro new December 2021",
          "url": "https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--db8bb9fc-49b8-49b7-9123-6468176dd1ad",
      "subject": "ATTACK:enterprise:S0520",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--db8bb9fc-49b8-49b7-9123-6468176dd1ad",
      "modified": "2026-04-29T14:23:06.225Z",
      "references": [
        {
          "source_name": "US-CERT BLINDINGCAN Aug 2020",
          "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dd9e0f42-5d9d-4690-9d34-4e08a29d4868",
      "subject": "ATTACK:enterprise:G0136",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dd9e0f42-5d9d-4690-9d34-4e08a29d4868",
      "modified": "2026-07-31T18:48:24.410Z",
      "references": [
        {
          "source_name": "HackerNews IndigoZebra July 2021",
          "url": "https://thehackernews.com/2021/07/indigozebra-apt-hacking-campaign.html"
        },
        {
          "source_name": "Checkpoint IndigoZebra July 2021",
          "url": "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--de4ae50a-0561-4d01-885a-eab60008d5eb",
      "subject": "ATTACK:enterprise:G0006",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--de4ae50a-0561-4d01-885a-eab60008d5eb",
      "modified": "2026-07-31T18:48:01.561Z",
      "references": [
        {
          "source_name": "Mandiant APT1",
          "url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--dfb8dd3b-3700-4708-a9ea-ddcc6b750705",
      "subject": "ATTACK:enterprise:G0082",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--dfb8dd3b-3700-4708-a9ea-ddcc6b750705",
      "modified": "2026-09-30T20:02:34.616Z",
      "references": [
        {
          "source_name": "CISA AA20-239A BeagleBoyz August 2020",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-239a"
        },
        {
          "source_name": "Microsoft Sapphire Sleet APR 2026",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e00219f2-3915-47db-a9fb-25c97a81e745",
      "subject": "ATTACK:enterprise:S1242",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e00219f2-3915-47db-a9fb-25c97a81e745",
      "modified": "2026-04-29T14:23:06.231Z",
      "references": [
        {
          "source_name": "SentinelOne Qilin NOV 2022",
          "url": "https://www.sentinelone.com/anthology/agenda-qilin/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e3425903-a09d-44e2-b033-daadc8208ff5",
      "subject": "ATTACK:enterprise:G0079",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e3425903-a09d-44e2-b033-daadc8208ff5",
      "modified": "2026-07-31T20:48:37.215Z",
      "references": [
        {
          "source_name": "Unit 42 Phishery Aug 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/08/unit42-darkhydrus-uses-phishery-harvest-credentials-middle-east/"
        },
        {
          "source_name": "Unit 42 DarkHydrus July 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
        },
        {
          "source_name": "Unit 42 Playbook Dec 2017",
          "url": "https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e3d8a792-5c54-4e37-9ce1-6a8555e76a03",
      "subject": "ATTACK:enterprise:G0089",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e3d8a792-5c54-4e37-9ce1-6a8555e76a03",
      "modified": "2026-07-31T18:47:59.892Z",
      "references": [
        {
          "source_name": "Cylance Shaheen Nov 2018",
          "url": "https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e4d36f81-8028-4eae-8bc2-d856296afb46",
      "subject": "ATTACK:enterprise:S0198",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e4d36f81-8028-4eae-8bc2-d856296afb46",
      "modified": "2026-04-29T14:23:06.237Z",
      "references": [
        {
          "source_name": "Unit 42 NETWIRE April 2020",
          "url": "https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/"
        },
        {
          "source_name": "Proofpoint NETWIRE December 2020",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/geofenced-netwire-campaigns"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--e797fcd8-4ad6-43d3-a36a-3c05d0ce8832",
      "subject": "ATTACK:enterprise:G0068",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--e797fcd8-4ad6-43d3-a36a-3c05d0ce8832",
      "modified": "2026-07-31T18:48:27.976Z",
      "references": [
        {
          "source_name": "Microsoft PLATINUM April 2016",
          "url": "https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--eab39c6d-8ebc-4961-9c16-e7bb00bacc43",
      "subject": "ATTACK:enterprise:S1213",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--eab39c6d-8ebc-4961-9c16-e7bb00bacc43",
      "modified": "2026-04-29T14:23:06.244Z",
      "references": [
        {
          "source_name": "Cybereason LumaStealer Undated",
          "url": "https://www.cybereason.com/blog/threat-analysis-rise-of-lummastealer"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ebed8156-bce1-4710-bd99-7cdcfa887d28",
      "subject": "ATTACK:enterprise:G0075",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ebed8156-bce1-4710-bd99-7cdcfa887d28",
      "modified": "2026-07-31T18:48:27.158Z",
      "references": [
        {
          "source_name": "Rancor Unit42 June 2018",
          "url": "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--ee00cd55-254b-4780-be47-e0f78a327c93",
      "subject": "ATTACK:enterprise:G0099",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--ee00cd55-254b-4780-be47-e0f78a327c93",
      "modified": "2026-07-31T18:48:18.897Z",
      "references": [
        {
          "source_name": "Kaspersky BlindEagle AUG 2024",
          "url": "https://securelist.com/blindeagle-apt/113414/"
        },
        {
          "source_name": "Recorded Future TAG-144 AUG 2025",
          "url": "https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"
        },
        {
          "source_name": "QiAnXin APT-C-36 Feb2019",
          "url": "https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f2f68eb7-4110-4750-9d1c-58774036672b",
      "subject": "ATTACK:enterprise:M1021",
      "predicate": "mitigates",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f2f68eb7-4110-4750-9d1c-58774036672b",
      "modified": "2026-04-29T14:23:06.255Z",
      "references": [

      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--f60a3a4e-ba53-47ba-8e31-e301f3983f6e",
      "subject": "ATTACK:enterprise:G0087",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--f60a3a4e-ba53-47ba-8e31-e301f3983f6e",
      "modified": "2026-07-31T18:47:54.173Z",
      "references": [
        {
          "source_name": "FireEye APT39 Jan 2019",
          "url": "https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"
        },
        {
          "source_name": "Symantec Chafer February 2018",
          "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"
        },
        {
          "source_name": "FBI FLASH APT39 September 2020",
          "url": "https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--faf1e821-465d-40cc-b523-73f1ba308932",
      "subject": "ATTACK:enterprise:S0346",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--faf1e821-465d-40cc-b523-73f1ba308932",
      "modified": "2026-04-29T14:23:06.266Z",
      "references": [
        {
          "source_name": "McAfee Oceansalt Oct 2018",
          "url": "https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fb0121a7-4ba2-4e6d-a12d-b7375581b943",
      "subject": "ATTACK:enterprise:G0084",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fb0121a7-4ba2-4e6d-a12d-b7375581b943",
      "modified": "2026-07-31T18:47:47.745Z",
      "references": [
        {
          "source_name": "Symantec Gallmaker Oct 2018",
          "url": "https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    },
    {
      "id": "enterprise:relationship--fb27a498-e1c1-47a4-a668-32c58c359f71",
      "subject": "ATTACK:enterprise:S0266",
      "predicate": "uses",
      "object": "ATTACK:enterprise:T1566.001",
      "asserted_by": "MITRE ATT&CK",
      "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
      "snapshot": "enterprise-attack-20.0.json",
      "evidence_locator": "relationship--fb27a498-e1c1-47a4-a668-32c58c359f71",
      "modified": "2026-04-29T14:23:06.266Z",
      "references": [
        {
          "source_name": "TrendMicro Trickbot Feb 2019",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-adds-remote-application-credential-grabbing-capabilities-to-its-repertoire/"
        }
      ],
      "qualification": "Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.",
      "source_occurrences": 1
    }
  ],
  "source_snapshot": {
    "file": "enterprise-attack-20.0.json",
    "url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json",
    "sha256": "81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352",
    "bytes": 55271014,
    "checked_at": "2026-10-16T03:31:39Z"
  },
  "notices_url": "https://aol.pm/source-notices.txt",
  "notices": "License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"
}

License
-------
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,
development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce
MITRE's copyright designation and this license in any such copy.

"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."

Disclaimers
-----------
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part
of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover
full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or
variations on existing techniques not documented by ATT&CK.

ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE
ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,
AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT
THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE.