{"record":{"id":"ATTACK:enterprise:T1571","title":"Non-Standard Port","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1571","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--b18eae87-b469-4e14-b454-b171b416bc18","external_id":"T1571","domain":"enterprise","created":"2020-03-14T18:18:32.443Z","modified":"2026-09-03T19:46:48.006Z","version":"1.3","aliases":[],"tactics":["command-and-control"],"source_references":[{"source_name":"University of Birmingham C2","url":"https://arxiv.org/pdf/1408.1136"},{"source_name":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"},{"source_name":"change_rdp_port_conti","url":"https://x.com/TheDFIRReport/status/1498657772254240768"},{"source_name":"Fortinet Agent Tesla April 2018","url":"https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html"}]},"assertions":[{"id":"enterprise:relationship--0076c114-0e7a-45c3-a851-7a877a9eefd0","subject":"ATTACK:enterprise:G0090","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0076c114-0e7a-45c3-a851-7a877a9eefd0","modified":"2026-09-03T19:46:52.583Z","references":[{"source_name":"Kaspersky WIRTE November 2021","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--015aa3fc-58b6-4ee0-afa2-7bb60d5b108f","subject":"ATTACK:enterprise:S1211","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--015aa3fc-58b6-4ee0-afa2-7bb60d5b108f","modified":"2026-09-03T19:46:52.787Z","references":[{"source_name":"Symantec Bilbug 2022","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--01c982c2-f610-443f-ae60-1b4a1f508f81","subject":"ATTACK:enterprise:G0091","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--01c982c2-f610-443f-ae60-1b4a1f508f81","modified":"2026-09-03T19:46:52.904Z","references":[{"source_name":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0b2b567c-718c-485f-b187-2bf6c6bb0c76","subject":"ATTACK:enterprise:S1031","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0b2b567c-718c-485f-b187-2bf6c6bb0c76","modified":"2026-09-03T19:46:53.117Z","references":[{"source_name":"Unit 42 PingPull Jun 2022","url":"https://unit42.paloaltonetworks.com/pingpull-gallium/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d44a3cb-f0f1-4b8a-a39d-536783735e8c","subject":"ATTACK:enterprise:G1052","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d44a3cb-f0f1-4b8a-a39d-536783735e8c","modified":"2026-09-03T19:46:53.286Z","references":[{"source_name":"Socket Contagious Interview NPM April 2025","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1080e9e7-df85-4f83-8b7f-5b5edd1e4aee","subject":"ATTACK:enterprise:G1042","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1080e9e7-df85-4f83-8b7f-5b5edd1e4aee","modified":"2026-09-03T19:46:53.405Z","references":[{"source_name":"RecordedFuture RedEcho 2021","url":"https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--12c14ace-db29-4b08-a052-ba867c9ba534","subject":"ATTACK:enterprise:S0367","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--12c14ace-db29-4b08-a052-ba867c9ba534","modified":"2026-09-03T19:46:53.599Z","references":[{"source_name":"Binary Defense Emotes Wi-Fi Spreader","url":"https://www.binarydefense.com/resources/blog/emotet-evolves-with-new-wi-fi-spreader/"},{"source_name":"Talos Emotet Jan 2019","url":"https://blog.talosintelligence.com/2019/01/return-of-emotet.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--14787d55-5815-43ee-ae4b-a31334ceed97","subject":"ATTACK:enterprise:S9010","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--14787d55-5815-43ee-ae4b-a31334ceed97","modified":"2026-09-03T19:46:53.717Z","references":[{"source_name":"Koi Glassworm InvisibleCode October 2025","url":"https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--18714758-e6ea-4f61-87c9-6340c0001b9c","subject":"ATTACK:enterprise:S0491","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--18714758-e6ea-4f61-87c9-6340c0001b9c","modified":"2026-09-03T19:46:53.834Z","references":[{"source_name":"Bitdefender StrongPity June 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--207f1084-a466-4e08-a157-886db373f09a","subject":"ATTACK:enterprise:S0428","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--207f1084-a466-4e08-a157-886db373f09a","modified":"2026-09-03T19:46:54.064Z","references":[{"source_name":"Talos PoetRAT April 2020","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2243acac-6401-41df-b658-2a36f7977d15","subject":"ATTACK:enterprise:S0493","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2243acac-6401-41df-b658-2a36f7977d15","modified":"2026-09-03T19:46:54.193Z","references":[{"source_name":"Trustwave GoldenSpy June 2020","url":"https://www.trustwave.com/en-us/resources/library/documents/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--22fac24b-a5a4-45ef-b6c4-0247a877b23a","subject":"ATTACK:enterprise:S1155","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--22fac24b-a5a4-45ef-b6c4-0247a877b23a","modified":"2026-09-03T19:46:54.387Z","references":[{"source_name":"Github Covenant","url":"https://github.com/cobbr/Covenant"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2311b504-e0c3-4594-8174-f9ce86941bc3","subject":"ATTACK:enterprise:S1049","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2311b504-e0c3-4594-8174-f9ce86941bc3","modified":"2026-09-03T19:46:54.468Z","references":[{"source_name":"Mandiant UNC3890 Aug 2022","url":"https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2ab4296f-bc5c-4589-863f-e42f5f334ae2","subject":"ATTACK:enterprise:C0063","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2ab4296f-bc5c-4589-863f-e42f5f334ae2","modified":"2026-09-03T19:46:54.567Z","references":[{"source_name":"CERT Polska","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"},{"source_name":"ESET DynoWiper Update JAN 2026","url":"https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2d50f9cb-8164-4cbe-bff9-d7ecfa55f123","subject":"ATTACK:enterprise:S9023","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2d50f9cb-8164-4cbe-bff9-d7ecfa55f123","modified":"2026-09-03T19:46:54.645Z","references":[{"source_name":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source_name":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30cfec26-a5ff-460d-876c-ca7f9d1e639f","subject":"ATTACK:enterprise:S1130","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30cfec26-a5ff-460d-876c-ca7f9d1e639f","modified":"2026-09-03T19:46:54.829Z","references":[{"source_name":"RedCanary RaspberryRobin 2022","url":"https://redcanary.com/blog/threat-intelligence/raspberry-robin/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30f0fc1f-d2fb-4bc8-98b1-431324127f07","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30f0fc1f-d2fb-4bc8-98b1-431324127f07","modified":"2026-09-03T19:46:54.957Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--31b54e57-8a8c-4c0f-9170-b3694dd82005","subject":"ATTACK:enterprise:S0515","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--31b54e57-8a8c-4c0f-9170-b3694dd82005","modified":"2026-09-03T19:46:55.070Z","references":[{"source_name":"CISA WellMail July 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198c"},{"source_name":"NCSC APT29 July 2020","url":"https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--31e2a6f9-065f-44ca-82eb-5cf12f6fd07a","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--31e2a6f9-065f-44ca-82eb-5cf12f6fd07a","modified":"2026-09-03T19:46:55.266Z","references":[{"source_name":"FalconFeeds_MuddyWaterPSRust_Mar2026","url":"https://falconfeeds.io/blogs/muddywater-in-the-iran-israel-cyber-war-from-powershell-scripts-to-rust-implants"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--36983a10-4fdb-4bfc-83a0-78f4d11e83df","subject":"ATTACK:enterprise:S0376","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--36983a10-4fdb-4bfc-83a0-78f4d11e83df","modified":"2026-09-03T19:46:55.378Z","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3a5c4e73-3657-470e-882b-563f3ca599e7","subject":"ATTACK:enterprise:S0412","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3a5c4e73-3657-470e-882b-563f3ca599e7","modified":"2026-09-03T19:46:55.587Z","references":[{"source_name":"Talos ZxShell Oct 2014","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3cae7fc8-e671-486b-a431-791a32df92a7","subject":"ATTACK:enterprise:G1003","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3cae7fc8-e671-486b-a431-791a32df92a7","modified":"2026-09-03T19:46:55.695Z","references":[{"source_name":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3ffac9f5-9a5e-41dd-aa7d-c981842015d7","subject":"ATTACK:enterprise:S0149","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3ffac9f5-9a5e-41dd-aa7d-c981842015d7","modified":"2026-09-03T19:46:55.802Z","references":[{"source_name":"Palo Alto MoonWind March 2017","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4050ee68-3f26-49e6-beec-e2a62133a1c3","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4050ee68-3f26-49e6-beec-e2a62133a1c3","modified":"2026-09-03T19:46:55.990Z","references":[{"source_name":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--42af62e7-3e38-46e7-ac70-c557f33d377d","subject":"ATTACK:enterprise:C0018","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--42af62e7-3e38-46e7-ac70-c557f33d377d","modified":"2026-09-03T19:46:56.118Z","references":[{"source_name":"Costa AvosLocker May 2022","url":"https://www.linkedin.com/pulse/raas-avoslocker-incident-response-analysis-fl%C3%A1vio-costa?trk=articles_directory"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--47e672a4-8646-420a-9847-ba801b0ff52a","subject":"ATTACK:enterprise:G1047","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--47e672a4-8646-420a-9847-ba801b0ff52a","modified":"2026-09-03T19:46:56.206Z","references":[{"source_name":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--53e123a8-0794-4bec-b71b-3c4b4a94057f","subject":"ATTACK:enterprise:S0246","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--53e123a8-0794-4bec-b71b-3c4b4a94057f","modified":"2026-09-03T19:46:56.286Z","references":[{"source_name":"US-CERT HARDRAIN March 2018","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-F.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--554b85dc-40d2-47ac-9ba5-90765feb4e8e","subject":"ATTACK:enterprise:C0056","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--554b85dc-40d2-47ac-9ba5-90765feb4e8e","modified":"2026-09-03T19:46:56.468Z","references":[{"source_name":"Mandiant UNC3886 Juniper Routers MAR 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--569abeb3-4d27-4157-a50f-0ec8fc4b3f92","subject":"ATTACK:enterprise:S1145","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--569abeb3-4d27-4157-a50f-0ec8fc4b3f92","modified":"2026-09-03T19:46:56.584Z","references":[{"source_name":"Elastic Pikabot 2024","url":"https://www.elastic.co/security-labs/pikabot-i-choose-you"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5a34e6af-f5e1-4191-aec0-06a92201f414","subject":"ATTACK:enterprise:S0352","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5a34e6af-f5e1-4191-aec0-06a92201f414","modified":"2026-09-03T19:46:56.654Z","references":[{"source_name":"Unit42 OceanLotus 2017","url":"https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--62bfecb7-7388-410a-afb3-fcd60fbc0af9","subject":"ATTACK:enterprise:S9001","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--62bfecb7-7388-410a-afb3-fcd60fbc0af9","modified":"2026-09-03T19:46:56.726Z","references":[{"source_name":"TrumanKroll_SYSTEMBCServer_Jan2024","url":"https://www.kroll.com/en/publications/cyber/inside-the-systembc-malware-server"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6cc8e1ce-c007-4a26-bd3b-cac73bb98c73","subject":"ATTACK:enterprise:S0455","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6cc8e1ce-c007-4a26-bd3b-cac73bb98c73","modified":"2026-09-03T19:46:56.807Z","references":[{"source_name":"FireEye Metamorfo Apr 2018","url":"https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7098d4d8-3fac-406e-84e1-508771c89802","subject":"ATTACK:enterprise:C0032","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7098d4d8-3fac-406e-84e1-508771c89802","modified":"2026-09-03T19:46:56.881Z","references":[{"source_name":"FireEye TRITON 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--730a735c-1008-490e-b0c8-6938b858b28a","subject":"ATTACK:enterprise:S0574","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--730a735c-1008-490e-b0c8-6938b858b28a","modified":"2026-09-03T19:46:56.952Z","references":[{"source_name":"Unit42 BendyBear Feb 2021","url":"https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--759af051-f194-4a68-98af-224f7d9916e8","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--759af051-f194-4a68-98af-224f7d9916e8","modified":"2026-09-03T19:46:57.029Z","references":[{"source_name":"ESET BlackEnergy Jan 2016","url":"https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7a61c895-add6-4631-aa2e-53efe5a85f44","subject":"ATTACK:enterprise:S1246","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7a61c895-add6-4631-aa2e-53efe5a85f44","modified":"2026-09-03T19:46:57.109Z","references":[{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source_name":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--800f3241-62f4-4eb4-b9a2-df62f67d27d6","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--800f3241-62f4-4eb4-b9a2-df62f67d27d6","modified":"2026-09-03T19:46:57.171Z","references":[{"source_name":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8131a5ed-f95f-406d-ae56-e5e10c8ced74","subject":"ATTACK:enterprise:S0385","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8131a5ed-f95f-406d-ae56-e5e10c8ced74","modified":"2026-09-03T19:46:57.225Z","references":[{"source_name":"Trend Micro njRAT 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--82548a34-d074-4c8f-af32-c7c5851377a8","subject":"ATTACK:enterprise:G1045","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--82548a34-d074-4c8f-af32-c7c5851377a8","modified":"2026-09-22T21:49:02.720Z","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--840fc319-2583-4a2b-8363-1a7e3fa33157","subject":"ATTACK:enterprise:M1030","predicate":"mitigates","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--840fc319-2583-4a2b-8363-1a7e3fa33157","modified":"2026-09-03T19:46:57.280Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--921b9a4d-091a-442b-981a-0b34daa2ed6a","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--921b9a4d-091a-442b-981a-0b34daa2ed6a","modified":"2026-09-03T19:46:57.398Z","references":[{"source_name":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"},{"source_name":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--946ccfa8-eef3-41f6-99ef-74d6caa817ce","subject":"ATTACK:enterprise:C0055","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--946ccfa8-eef3-41f6-99ef-74d6caa817ce","modified":"2026-09-03T19:46:57.445Z","references":[{"source_name":"Sekoia 7777 Botnet JUL 2024","url":"https://blog.sekoia.io/solving-the-7777-botnet-enigma-a-cybersecurity-quest/"},{"source_name":"Microsoft Storm-0940","url":"https://www.microsoft.com/en-us/security/blog/2024/10/31/chinese-threat-actor-storm-0940-uses-credentials-from-password-spray-attacks-from-a-covert-network/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9ee6eb40-881c-4928-a036-58a8df0e8f95","subject":"ATTACK:enterprise:S1085","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9ee6eb40-881c-4928-a036-58a8df0e8f95","modified":"2026-09-03T19:46:57.495Z","references":[{"source_name":"Bitdefender Sardonic Aug 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a06533f5-02f9-4246-9315-0fa8df3465e0","subject":"ATTACK:enterprise:S1016","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a06533f5-02f9-4246-9315-0fa8df3465e0","modified":"2026-09-03T19:46:57.537Z","references":[{"source_name":"ESET DazzleSpy Jan 2022","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a5bb3ddf-446a-42c4-b522-112ad643c678","subject":"ATTACK:enterprise:S0021","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a5bb3ddf-446a-42c4-b522-112ad643c678","modified":"2026-09-03T19:46:57.581Z","references":[{"source_name":"Fidelis Turbo","url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2016/2016.02.29.Turbo_Campaign_Derusbi/TA_Fidelis_Turbo_1602_0.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--acb3d56b-d5bc-4be9-be1e-f1bda4c7771e","subject":"ATTACK:enterprise:S1218","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--acb3d56b-d5bc-4be9-be1e-f1bda4c7771e","modified":"2026-09-03T19:46:57.634Z","references":[{"source_name":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--af74a9b1-6c74-45b6-a21d-38686afb202c","subject":"ATTACK:enterprise:S1078","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--af74a9b1-6c74-45b6-a21d-38686afb202c","modified":"2026-09-03T19:46:57.677Z","references":[{"source_name":"netlab360 rotajakiro vs oceanlotus","url":"https://blog.netlab.360.com/rotajakiro_linux_version_of_oceanlotus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b2848d62-76a1-465c-b12e-7dc3113e6bbe","subject":"ATTACK:enterprise:S0148","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b2848d62-76a1-465c-b12e-7dc3113e6bbe","modified":"2026-09-03T19:46:57.734Z","references":[{"source_name":"ESET RTM Feb 2017","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b35cd29e-1439-4f7a-a81e-44d4db29cd8b","subject":"ATTACK:enterprise:G0059","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b35cd29e-1439-4f7a-a81e-44d4db29cd8b","modified":"2026-09-03T19:46:57.807Z","references":[{"source_name":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source_name":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b75e158b-3c2e-425d-a14e-84a974d86c8c","subject":"ATTACK:enterprise:S0266","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b75e158b-3c2e-425d-a14e-84a974d86c8c","modified":"2026-09-03T19:46:57.861Z","references":[{"source_name":"Trend Micro Totbrick Oct 2016","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/tspy_trickload.n"},{"source_name":"Bitdefender Trickbot VNC module Whitepaper 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/399/Bitdefender-PR-Whitepaper-Trickbot-creat5515-en-EN.pdf"},{"source_name":"Fidelis TrickBot Oct 2016","url":"https://www.fidelissecurity.com/threatgeek/2016/10/trickbot-we-missed-you-dyre"},{"source_name":"S2 Grupo TrickBot June 2017","url":"https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bfbabaff-1918-4a35-b5ab-8aa981e50027","subject":"ATTACK:enterprise:S0262","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bfbabaff-1918-4a35-b5ab-8aa981e50027","modified":"2026-09-03T19:46:57.915Z","references":[{"source_name":"CISA AR18-352A Quasar RAT December 2018","url":"https://www.cisa.gov/uscert/ncas/analysis-reports/AR18-352A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c0a3674d-ff9b-49e0-8a18-43ba8d795163","subject":"ATTACK:enterprise:S9024","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c0a3674d-ff9b-49e0-8a18-43ba8d795163","modified":"2026-09-03T19:46:57.966Z","references":[{"source_name":"Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"},{"source_name":"JPCERT SPAWNCHIMERA Ivanti February 2025","url":"https://blogs.jpcert.or.jp/en/2025/02/spawnchimera.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c13bc6b0-a8fa-4c52-9774-3738a5f1ce90","subject":"ATTACK:enterprise:S0245","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c13bc6b0-a8fa-4c52-9774-3738a5f1ce90","modified":"2026-09-03T19:46:58.008Z","references":[{"source_name":"US-CERT BADCALL","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-G.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c308ceda-6c7c-4f7f-847b-e64f992d0104","subject":"ATTACK:enterprise:G0047","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c308ceda-6c7c-4f7f-847b-e64f992d0104","modified":"2026-09-03T19:46:58.052Z","references":[{"source_name":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c5692c9d-8cac-4105-ae0b-f3b6c60a2253","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c5692c9d-8cac-4105-ae0b-f3b6c60a2253","modified":"2026-09-03T19:46:58.090Z","references":[{"source_name":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c57b65a3-294a-43fd-af9c-b764e9305190","subject":"ATTACK:enterprise:S1245","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c57b65a3-294a-43fd-af9c-b764e9305190","modified":"2026-09-03T19:46:58.134Z","references":[{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ca38f31f-3551-49e3-835b-588693a8b512","subject":"ATTACK:enterprise:G0105","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ca38f31f-3551-49e3-835b-588693a8b512","modified":"2026-09-03T19:46:58.173Z","references":[{"source_name":"Securelist DarkVishnya Dec 2018","url":"https://securelist.com/darkvishnya/89169/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d00a3ec5-cdbf-4646-a12e-4269dce56774","subject":"ATTACK:enterprise:C0043","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d00a3ec5-cdbf-4646-a12e-4269dce56774","modified":"2026-09-03T19:46:58.231Z","references":[{"source_name":"RecordedFuture RedEcho 2021","url":"https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d21527b8-a8c8-4c95-9061-21c49155232e","subject":"ATTACK:enterprise:S0263","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d21527b8-a8c8-4c95-9061-21c49155232e","modified":"2026-09-03T19:46:58.284Z","references":[{"source_name":"US-CERT TYPEFRAME June 2018","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d2fc5856-5010-41e7-9175-958e3029df47","subject":"ATTACK:enterprise:S1217","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d2fc5856-5010-41e7-9175-958e3029df47","modified":"2026-09-03T19:46:58.321Z","references":[{"source_name":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d40daa58-ca17-400c-b488-4508775e55e7","subject":"ATTACK:enterprise:C0035","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d40daa58-ca17-400c-b488-4508775e55e7","modified":"2026-09-03T19:46:58.360Z","references":[{"source_name":"Lumen KVBotnet 2023","url":"https://blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--db0f9f05-6f76-47c3-81bf-a59d85045188","subject":"ATTACK:enterprise:G0099","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--db0f9f05-6f76-47c3-81bf-a59d85045188","modified":"2026-09-03T19:46:58.398Z","references":[{"source_name":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e61e5dc3-b6ac-4909-b188-eaede02385df","subject":"ATTACK:enterprise:S0237","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e61e5dc3-b6ac-4909-b188-eaede02385df","modified":"2026-09-03T19:46:58.493Z","references":[{"source_name":"Talos GravityRAT","url":"https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e6b9c4c1-3b84-4957-8533-f96a92dcab2a","subject":"ATTACK:enterprise:G0064","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e6b9c4c1-3b84-4957-8533-f96a92dcab2a","modified":"2026-09-03T19:46:58.533Z","references":[{"source_name":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e9092e54-ff13-4180-9850-c50e45dc1b41","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e9092e54-ff13-4180-9850-c50e45dc1b41","modified":"2026-09-30T19:13:37.092Z","references":[{"source_name":"Microsoft Axios Compromise APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"},{"source_name":"Microsoft Sapphire Sleet APR 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"},{"source_name":"MIcrosoft Mastra npm Compromise JUN 2026","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e9b71895-a9d2-4023-930b-4204f6c2d325","subject":"ATTACK:enterprise:S0239","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e9b71895-a9d2-4023-930b-4204f6c2d325","modified":"2026-09-03T19:46:58.563Z","references":[{"source_name":"US-CERT Bankshot Dec 2017","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ec55cdc1-8ca2-42c9-a1d9-9755d24bc294","subject":"ATTACK:enterprise:S0153","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ec55cdc1-8ca2-42c9-a1d9-9755d24bc294","modified":"2026-09-03T19:46:58.595Z","references":[{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f07b76ab-6e72-4112-bc23-3b64b50131f0","subject":"ATTACK:enterprise:M1031","predicate":"mitigates","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f07b76ab-6e72-4112-bc23-3b64b50131f0","modified":"2026-09-03T19:46:58.624Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f4a65903-0b28-4e52-ad3b-bb7c55772509","subject":"ATTACK:enterprise:S0687","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f4a65903-0b28-4e52-ad3b-bb7c55772509","modified":"2026-09-03T19:46:58.666Z","references":[{"source_name":"NCSC Cyclops Blink February 2022","url":"https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f7f947cd-6e0c-499c-8cdf-293e38657e31","subject":"ATTACK:enterprise:G0106","predicate":"uses","object":"ATTACK:enterprise:T1571","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f7f947cd-6e0c-499c-8cdf-293e38657e31","modified":"2026-09-03T19:46:58.696Z","references":[{"source_name":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}