{"record":{"id":"ATTACK:enterprise:T1573.001","title":"Symmetric Cryptography","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1573/001","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--24bfaeba-cb0d-4525-b3dc-507c77ecec41","external_id":"T1573.001","domain":"enterprise","created":"2020-03-16T15:45:17.032Z","modified":"2026-09-02T20:07:39.622Z","version":"1.3","aliases":[],"tactics":["command-and-control"],"source_references":[{"source_name":"Destination Certification","url":"https://destcert.com/resources/symmetric-cryptography/"},{"source_name":"Symmetric vs Asymmetric Cryptography","url":"https://www.keyfactor.com/blog/symmetric-vs-asymmetric-cryptography-whats-the-difference-and-when-to-use-each/"}]},"assertions":[{"id":"enterprise:relationship--0245022b-05ac-4d66-ae9f-e4c2f604c07a","subject":"ATTACK:enterprise:S0384","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0245022b-05ac-4d66-ae9f-e4c2f604c07a","modified":"2026-09-02T20:07:41.001Z","references":[{"source_name":"Kaspersky Dridex May 2017","url":"https://securelist.com/dridex-a-history-of-evolution/78531/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0335dd7e-1f5e-4068-b680-197de6c0af68","subject":"ATTACK:enterprise:S0649","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0335dd7e-1f5e-4068-b680-197de6c0af68","modified":"2026-09-02T20:07:41.929Z","references":[{"source_name":"FireEye SMOKEDHAM June 2021","url":"https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--03927dc7-2ef0-43e4-ad71-94243e29bca4","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--03927dc7-2ef0-43e4-ad71-94243e29bca4","modified":"2026-09-02T20:07:42.405Z","references":[{"source_name":"ESET InvisiMole June 2018","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0618bd56-0ca0-4750-ac4e-ab6fa475298c","subject":"ATTACK:enterprise:S1227","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0618bd56-0ca0-4750-ac4e-ab6fa475298c","modified":"2026-09-02T20:07:43.033Z","references":[{"source_name":"Zscaler","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--089ad94f-daa3-437d-931a-9fc2b782595c","subject":"ATTACK:enterprise:S0663","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--089ad94f-daa3-437d-931a-9fc2b782595c","modified":"2026-09-02T20:07:43.542Z","references":[{"source_name":"Lunghi Iron Tiger Linux","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--095a259d-79c7-42b0-b65a-e423f110d187","subject":"ATTACK:enterprise:S0367","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--095a259d-79c7-42b0-b65a-e423f110d187","modified":"2026-09-02T20:07:44.141Z","references":[{"source_name":"Trend Micro Emotet Jan 2019","url":"https://documents.trendmicro.com/assets/white_papers/ExploringEmotetsActivities_Final.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d3e115b-ff08-4bff-8802-be3d21cec68f","subject":"ATTACK:enterprise:S0113","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d3e115b-ff08-4bff-8802-be3d21cec68f","modified":"2026-09-02T20:07:44.396Z","references":[{"source_name":"ESET Operation Groundbait","url":"http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0e630f6b-8662-4ffe-b666-709e17aad69f","subject":"ATTACK:enterprise:S0066","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0e630f6b-8662-4ffe-b666-709e17aad69f","modified":"2026-09-02T20:07:45.101Z","references":[{"source_name":"CrowdStrike Putter Panda","url":"http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0ef68afe-92bf-48f6-800c-f20431abdd7e","subject":"ATTACK:enterprise:S1202","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0ef68afe-92bf-48f6-800c-f20431abdd7e","modified":"2026-09-02T20:07:45.168Z","references":[{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--122e6f20-ab3b-4bf0-bef1-0372399bee7c","subject":"ATTACK:enterprise:S0034","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--122e6f20-ab3b-4bf0-bef1-0372399bee7c","modified":"2026-09-02T20:07:45.297Z","references":[{"source_name":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--140046d6-8cb6-4a09-bd74-fd7696ac4247","subject":"ATTACK:enterprise:S0409","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--140046d6-8cb6-4a09-bd74-fd7696ac4247","modified":"2026-09-02T20:07:45.367Z","references":[{"source_name":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--14568d94-858d-4b8a-af94-88cd17f6ab10","subject":"ATTACK:enterprise:S0344","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--14568d94-858d-4b8a-af94-88cd17f6ab10","modified":"2026-09-02T20:07:45.432Z","references":[{"source_name":"Unit42 Azorult Nov 2018","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"},{"source_name":"Proofpoint Azorult July 2018","url":"https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--180f0c7c-c7bb-4131-b831-f406ee0516e2","subject":"ATTACK:enterprise:S0268","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--180f0c7c-c7bb-4131-b831-f406ee0516e2","modified":"2026-09-02T20:07:45.488Z","references":[{"source_name":"Unit 42 Bisonal July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-attacks-russia-south-korea/"},{"source_name":"Talos Bisonal Mar 2020","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"},{"source_name":"Kaspersky CactusPete Aug 2020","url":"https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--19c33297-1efd-4489-b09c-a4230ce194f4","subject":"ATTACK:enterprise:S0060","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--19c33297-1efd-4489-b09c-a4230ce194f4","modified":"2026-09-02T20:07:45.631Z","references":[{"source_name":"Baumgartner Naikon 2015","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1a028242-1896-4867-a691-c97867f1663d","subject":"ATTACK:enterprise:S0081","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1a028242-1896-4867-a691-c97867f1663d","modified":"2026-09-02T20:07:45.652Z","references":[{"source_name":"Lotus Blossom Jun 2015","url":"https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1a20c3db-a33c-4129-9fad-3f5605c0cbcb","subject":"ATTACK:enterprise:S0141","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1a20c3db-a33c-4129-9fad-3f5605c0cbcb","modified":"2026-09-02T20:07:46.090Z","references":[{"source_name":"Novetta Winnti April 2015","url":"https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1b418159-e33b-407e-9849-1ebeddaa4074","subject":"ATTACK:enterprise:S0664","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1b418159-e33b-407e-9849-1ebeddaa4074","modified":"2026-09-02T20:07:46.116Z","references":[{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1ba38510-0489-4305-944f-451e6869b30f","subject":"ATTACK:enterprise:S0128","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1ba38510-0489-4305-944f-451e6869b30f","modified":"2026-09-02T20:07:46.126Z","references":[{"source_name":"Forcepoint Monsoon","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"},{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1bc5328a-e079-4478-9d04-d840626d4976","subject":"ATTACK:enterprise:S0272","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1bc5328a-e079-4478-9d04-d840626d4976","modified":"2026-09-02T20:07:46.137Z","references":[{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1ca66056-792e-4e19-8742-a782d87806e4","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1ca66056-792e-4e19-8742-a782d87806e4","modified":"2026-09-02T20:07:46.147Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Recorded Future REDDELTA July 2020","url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"},{"source_name":"Unit42 Bookworm Nov2015","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1ccef9f1-9fb4-460d-81a9-e0353e9440bd","subject":"ATTACK:enterprise:S1076","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1ccef9f1-9fb4-460d-81a9-e0353e9440bd","modified":"2026-09-02T20:07:46.159Z","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1de3d895-7bf9-4b60-b819-d49b31a26b38","subject":"ATTACK:enterprise:S1085","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1de3d895-7bf9-4b60-b819-d49b31a26b38","modified":"2026-09-02T20:07:46.168Z","references":[{"source_name":"Bitdefender Sardonic Aug 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e05bf60-ac1b-4497-a9bc-55eff65cf927","subject":"ATTACK:enterprise:G0012","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e05bf60-ac1b-4497-a9bc-55eff65cf927","modified":"2026-09-02T20:07:46.179Z","references":[{"source_name":"Microsoft DUBNIUM July 2016","url":"https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e3a1ea2-55fb-4abc-970a-e384b4c7d314","subject":"ATTACK:enterprise:S0438","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e3a1ea2-55fb-4abc-970a-e384b4c7d314","modified":"2026-09-02T20:07:46.189Z","references":[{"source_name":"ESET Attor Oct 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--21717b6b-1fc6-4619-9877-bb36237a8efd","subject":"ATTACK:enterprise:S0010","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--21717b6b-1fc6-4619-9877-bb36237a8efd","modified":"2026-09-02T20:07:46.200Z","references":[{"source_name":"Villeneuve 2011","url":"http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_dissecting-lurid-apt.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2315fa7f-2161-45c1-9f23-d47a96488465","subject":"ATTACK:enterprise:S1034","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2315fa7f-2161-45c1-9f23-d47a96488465","modified":"2026-09-02T20:07:46.221Z","references":[{"source_name":"Cybereason StrifeWater Feb 2022","url":"https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--25d4fa6d-4f88-4604-8b9f-cce6f3b5ae4d","subject":"ATTACK:enterprise:S0220","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--25d4fa6d-4f88-4604-8b9f-cce6f3b5ae4d","modified":"2026-09-02T20:07:46.235Z","references":[{"source_name":"Chaos Stolen Backdoor","url":"http://gosecure.net/2018/02/14/chaos-stolen-backdoor-rising/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2624fd3f-9282-4080-bace-6a673fd31b9f","subject":"ATTACK:enterprise:S0371","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2624fd3f-9282-4080-bace-6a673fd31b9f","modified":"2026-09-02T20:07:46.246Z","references":[{"source_name":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--27ebfbf5-7d18-457d-899a-9a1213d01729","subject":"ATTACK:enterprise:S1229","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--27ebfbf5-7d18-457d-899a-9a1213d01729","modified":"2026-09-02T20:07:46.257Z","references":[{"source_name":"Zscaler Havoc FEB 2023","url":"https://www.zscaler.com/blogs/security-research/havoc-across-cyberspace"},{"source_name":"Fortinet Havoc MAR 2025","url":"https://www.fortinet.com/blog/threat-research/havoc-sharepoint-with-microsoft-graph-api-turns-into-fud-c2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--28b3fb26-c7f8-481d-8424-895953bfb492","subject":"ATTACK:enterprise:S0559","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--28b3fb26-c7f8-481d-8424-895953bfb492","modified":"2026-09-02T20:07:46.269Z","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2b454322-5ad5-449f-86c9-092867acd51c","subject":"ATTACK:enterprise:S0284","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2b454322-5ad5-449f-86c9-092867acd51c","modified":"2026-09-02T20:07:46.279Z","references":[{"source_name":"Security Intelligence More Eggs Aug 2019","url":"https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2c29e6cf-a177-4578-bf1f-fd73ae254edd","subject":"ATTACK:enterprise:S0009","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2c29e6cf-a177-4578-bf1f-fd73ae254edd","modified":"2026-09-02T20:07:46.290Z","references":[{"source_name":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2c339e33-c290-42bc-9f2c-056aa0a321d8","subject":"ATTACK:enterprise:S0198","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2c339e33-c290-42bc-9f2c-056aa0a321d8","modified":"2026-09-02T20:07:46.301Z","references":[{"source_name":"Red Canary NETWIRE January 2020","url":"https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2d8cdbf3-1be2-4e64-ba18-f8b65fcbae8f","subject":"ATTACK:enterprise:S0170","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2d8cdbf3-1be2-4e64-ba18-f8b65fcbae8f","modified":"2026-09-02T20:07:46.311Z","references":[{"source_name":"Palo Alto OilRig May 2016","url":"http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f3ff7c9-ea14-45ad-b295-6f2f3c40cff7","subject":"ATTACK:enterprise:S0262","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f3ff7c9-ea14-45ad-b295-6f2f3c40cff7","modified":"2026-09-02T20:07:46.325Z","references":[{"source_name":"CISA AR18-352A Quasar RAT December 2018","url":"https://www.cisa.gov/uscert/ncas/analysis-reports/AR18-352A"},{"source_name":"GitHub QuasarRAT","url":"https://github.com/quasar/QuasarRAT"},{"source_name":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30a4c248-9477-4eba-8925-f559682b0a1f","subject":"ATTACK:enterprise:S9020","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30a4c248-9477-4eba-8925-f559682b0a1f","modified":"2026-09-02T20:07:46.340Z","references":[{"source_name":"Kaspersky LODEINFO Part II OCT 2022","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30da2329-c7ee-4ac9-a38d-af79e6c1389c","subject":"ATTACK:enterprise:S0431","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30da2329-c7ee-4ac9-a38d-af79e6c1389c","modified":"2026-09-02T20:07:46.351Z","references":[{"source_name":"Carbon Black HotCroissant April 2020","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"},{"source_name":"US-CERT HOTCROISSANT February 2020","url":"https://www.us-cert.gov/ncas/analysis-reports/ar20-045d"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--31912c9b-b79c-45f4-bef0-9beafe1ccedd","subject":"ATTACK:enterprise:S1218","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--31912c9b-b79c-45f4-bef0-9beafe1ccedd","modified":"2026-09-02T20:07:46.361Z","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"},{"source_name":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--327f0f36-bcc5-42fa-9b17-024ebee99466","subject":"ATTACK:enterprise:S9007","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--327f0f36-bcc5-42fa-9b17-024ebee99466","modified":"2026-09-02T20:07:46.373Z","references":[{"source_name":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--336e0a87-8ee2-420d-8fb8-10ea2c015723","subject":"ATTACK:enterprise:S0486","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--336e0a87-8ee2-420d-8fb8-10ea2c015723","modified":"2026-09-02T20:07:46.383Z","references":[{"source_name":"ESET ForSSHe December 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--339746da-8c6e-4273-8e17-895d3b50fe4d","subject":"ATTACK:enterprise:S0532","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--339746da-8c6e-4273-8e17-895d3b50fe4d","modified":"2026-09-02T20:07:46.395Z","references":[{"source_name":"Unit 42 Lucifer June 2020","url":"https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--34e75ef5-b2de-41dc-96d3-2c5388c570be","subject":"ATTACK:enterprise:S0011","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--34e75ef5-b2de-41dc-96d3-2c5388c570be","modified":"2026-09-02T20:07:46.405Z","references":[{"source_name":"TrendMicro Taidoor","url":"http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf"},{"source_name":"CISA MAR-10292089-1.v2 TAIDOOR August 2021","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--34e9fc0a-75b9-4100-91ef-30ca3225958a","subject":"ATTACK:enterprise:S0087","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--34e9fc0a-75b9-4100-91ef-30ca3225958a","modified":"2026-09-02T20:07:46.415Z","references":[{"source_name":"Fidelis Hi-Zor","url":"https://www.fidelissecurity.com/threatgeek/archive/introducing-hi-zor-rat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--35f02c40-d46f-44fa-8ba2-5106357494b4","subject":"ATTACK:enterprise:S0181","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--35f02c40-d46f-44fa-8ba2-5106357494b4","modified":"2026-09-02T20:07:46.426Z","references":[{"source_name":"US-CERT FALLCHILL Nov 2017","url":"https://www.us-cert.gov/ncas/alerts/TA17-318A"},{"source_name":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3658d2f3-25f5-404a-bf0b-7c5fce9978f6","subject":"ATTACK:enterprise:C0022","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3658d2f3-25f5-404a-bf0b-7c5fce9978f6","modified":"2026-09-02T20:07:46.438Z","references":[{"source_name":"McAfee Lazarus Jul 2020","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3671c28f-927b-40e0-ba75-079c0aafea5b","subject":"ATTACK:enterprise:S0256","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3671c28f-927b-40e0-ba75-079c0aafea5b","modified":"2026-09-02T20:07:46.452Z","references":[{"source_name":"ESET Turla Mosquito Jan 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--36b2817e-5f07-4f70-927c-8e04b955d5a3","subject":"ATTACK:enterprise:S0200","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--36b2817e-5f07-4f70-927c-8e04b955d5a3","modified":"2026-09-02T20:07:46.467Z","references":[{"source_name":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--38848a62-c389-4344-8bed-094292cef803","subject":"ATTACK:enterprise:S9032","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--38848a62-c389-4344-8bed-094292cef803","modified":"2026-09-02T20:07:46.478Z","references":[{"source_name":"ESET_MuddyWater_Dec2025","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--39cf6431-f800-4911-8434-49ce1b2874f1","subject":"ATTACK:enterprise:S0674","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--39cf6431-f800-4911-8434-49ce1b2874f1","modified":"2026-09-02T20:07:46.489Z","references":[{"source_name":"Check Point APT35 CharmPower January 2022","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3a11eb81-545a-4153-8c3b-feb47db1f288","subject":"ATTACK:enterprise:S0245","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3a11eb81-545a-4153-8c3b-feb47db1f288","modified":"2026-09-02T20:07:46.500Z","references":[{"source_name":"US-CERT BADCALL","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-G.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3db5259f-5426-4c47-8fc3-44118f63f985","subject":"ATTACK:enterprise:S0670","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3db5259f-5426-4c47-8fc3-44118f63f985","modified":"2026-09-02T20:07:46.513Z","references":[{"source_name":"Check Point Warzone Feb 2020","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3ebc8829-f260-4d75-817a-cd23a4ebb194","subject":"ATTACK:enterprise:S0037","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3ebc8829-f260-4d75-817a-cd23a4ebb194","modified":"2026-09-02T20:07:46.525Z","references":[{"source_name":"FireEye APT29","url":"https://services.google.com/fh/files/misc/rpt-apt29-hammertoss-stealthy-tactics-define-en.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f4442d9-b61e-4f78-a364-e62f6ab364b1","subject":"ATTACK:enterprise:S1169","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f4442d9-b61e-4f78-a364-e62f6ab364b1","modified":"2026-09-02T20:07:46.535Z","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f86f383-8536-4d0b-913a-458ac9d414b8","subject":"ATTACK:enterprise:S1141","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f86f383-8536-4d0b-913a-458ac9d414b8","modified":"2026-09-02T20:07:46.548Z","references":[{"source_name":"ESET Turla Lunar toolset May 2024","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--40364e9d-b579-440e-9528-0edb6c790c25","subject":"ATTACK:enterprise:S1222","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--40364e9d-b579-440e-9528-0edb6c790c25","modified":"2026-09-02T20:07:46.558Z","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4114a4a5-c9e7-4f61-90f3-4a13789a6b37","subject":"ATTACK:enterprise:S9037","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4114a4a5-c9e7-4f61-90f3-4a13789a6b37","modified":"2026-09-02T20:07:46.569Z","references":[{"source_name":"CloudSEK_RustyWater_Jan2026","url":"https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4153632f-9ac5-4f8b-af83-b4b089ce5429","subject":"ATTACK:enterprise:S0022","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4153632f-9ac5-4f8b-af83-b4b089ce5429","modified":"2026-09-02T20:07:46.581Z","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4256a056-d15a-4323-8e04-92e623d5e899","subject":"ATTACK:enterprise:S0610","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4256a056-d15a-4323-8e04-92e623d5e899","modified":"2026-09-02T20:07:46.595Z","references":[{"source_name":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--47b5c142-c0e5-4754-ae7f-b95bf01d3a5b","subject":"ATTACK:enterprise:S0352","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--47b5c142-c0e5-4754-ae7f-b95bf01d3a5b","modified":"2026-09-02T20:07:46.605Z","references":[{"source_name":"Unit42 OceanLotus 2017","url":"https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4b5540e5-eac1-40f4-93d0-155f60e9395a","subject":"ATTACK:enterprise:S0082","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4b5540e5-eac1-40f4-93d0-155f60e9395a","modified":"2026-09-02T20:07:46.616Z","references":[{"source_name":"Lotus Blossom Dec 2015","url":"http://researchcenter.paloaltonetworks.com/2015/12/attack-on-french-diplomat-linked-to-operation-lotus-blossom/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4b6bee9b-469e-48ce-84fa-5322de03470a","subject":"ATTACK:enterprise:S0076","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4b6bee9b-469e-48ce-84fa-5322de03470a","modified":"2026-09-02T20:07:46.626Z","references":[{"source_name":"Scarlet Mimic Jan 2016","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4b70ec83-7488-4b4e-bd0b-58fb45da3a15","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4b70ec83-7488-4b4e-bd0b-58fb45da3a15","modified":"2026-09-02T20:07:46.637Z","references":[{"source_name":"Kaspersky QakBot September 2021","url":"https://securelist.com/qakbot-technical-analysis/103931/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4c06e313-2cde-494c-a8dc-449649a1afa6","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4c06e313-2cde-494c-a8dc-449649a1afa6","modified":"2026-09-02T20:07:46.646Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4c131eaa-c7c1-4c17-bcab-25cdf35e743c","subject":"ATTACK:enterprise:S1026","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4c131eaa-c7c1-4c17-bcab-25cdf35e743c","modified":"2026-09-02T20:07:46.660Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4d6a3a5b-58c2-4dab-8710-fe7e6b893f98","subject":"ATTACK:enterprise:S0348","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4d6a3a5b-58c2-4dab-8710-fe7e6b893f98","modified":"2026-09-02T20:07:46.670Z","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4e5dff55-c686-4fa6-bad1-caa8507083d9","subject":"ATTACK:enterprise:S0074","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4e5dff55-c686-4fa6-bad1-caa8507083d9","modified":"2026-09-02T20:07:46.682Z","references":[{"source_name":"Dell Sakula","url":"http://www.secureworks.com/cyber-threat-intelligence/threats/sakula-malware-family/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--53da7e18-3812-47d5-a8de-af49e84f796a","subject":"ATTACK:enterprise:G0128","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--53da7e18-3812-47d5-a8de-af49e84f796a","modified":"2026-09-02T20:07:46.692Z","references":[{"source_name":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--56160c7f-03d1-48e7-ad66-f959b13115bb","subject":"ATTACK:enterprise:S1193","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--56160c7f-03d1-48e7-ad66-f959b13115bb","modified":"2026-09-02T20:07:46.704Z","references":[{"source_name":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5a347320-15ce-40b9-8b9f-05f7c0c3ff9c","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5a347320-15ce-40b9-8b9f-05f7c0c3ff9c","modified":"2026-09-02T20:07:46.720Z","references":[{"source_name":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5ac475f9-f253-44db-861e-c7303961aa6c","subject":"ATTACK:enterprise:S0180","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5ac475f9-f253-44db-861e-c7303961aa6c","modified":"2026-09-02T20:07:46.733Z","references":[{"source_name":"US-CERT Volgmer 2 Nov 2017","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-D_WHITE_S508C.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5b3d2b2f-73f4-4fef-9cb9-b11db3eb4c4f","subject":"ATTACK:enterprise:S0068","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5b3d2b2f-73f4-4fef-9cb9-b11db3eb4c4f","modified":"2026-09-02T20:07:46.744Z","references":[{"source_name":"CrowdStrike Putter Panda","url":"http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5bef15c2-1aa4-4f94-b594-0b5e03c26a41","subject":"ATTACK:enterprise:S1119","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5bef15c2-1aa4-4f94-b594-0b5e03c26a41","modified":"2026-09-02T20:07:46.763Z","references":[{"source_name":"Mandiant Cutting Edge Part 2 January 2024","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--603d13cd-f6f7-4321-99db-3d3326878de4","subject":"ATTACK:enterprise:S0394","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--603d13cd-f6f7-4321-99db-3d3326878de4","modified":"2026-09-02T20:07:46.773Z","references":[{"source_name":"Intezer HiddenWasp Map 2019","url":"https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--609d3d8c-1995-43ef-a102-a39d668a774d","subject":"ATTACK:enterprise:S0149","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--609d3d8c-1995-43ef-a102-a39d668a774d","modified":"2026-09-02T20:07:46.783Z","references":[{"source_name":"Palo Alto MoonWind March 2017","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--60ef22cb-b7e7-4426-ab3a-11254fe63154","subject":"ATTACK:enterprise:S1100","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--60ef22cb-b7e7-4426-ab3a-11254fe63154","modified":"2026-09-02T20:07:46.793Z","references":[{"source_name":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--63113486-c2a1-4a83-8d49-2065f972f83f","subject":"ATTACK:enterprise:S1145","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--63113486-c2a1-4a83-8d49-2065f972f83f","modified":"2026-09-02T20:07:46.805Z","references":[{"source_name":"Zscaler Pikabot 2023","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot"},{"source_name":"Elastic Pikabot 2024","url":"https://www.elastic.co/security-labs/pikabot-i-choose-you"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--639a960d-8cc1-4f6f-aca1-cf3c6445d056","subject":"ATTACK:enterprise:S0632","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--639a960d-8cc1-4f6f-aca1-cf3c6445d056","modified":"2026-09-02T20:07:46.816Z","references":[{"source_name":"Group IB GrimAgent July 2021","url":"https://www.group-ib.com/blog/grimagent/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64eefbfb-5241-4325-919d-4739504644c2","subject":"ATTACK:enterprise:S0275","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64eefbfb-5241-4325-919d-4739504644c2","modified":"2026-09-02T20:07:46.828Z","references":[{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"},{"source_name":"Trend Micro Earth Kasha Updates APR 2025","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"},{"source_name":"FireEye APT10 Sept 2018","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--64fa019e-5eb1-404c-9488-d4083ccc8b65","subject":"ATTACK:enterprise:M1031","predicate":"mitigates","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--64fa019e-5eb1-404c-9488-d4083ccc8b65","modified":"2026-09-02T20:07:46.846Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6613ed52-5c6c-43f2-bd0c-9809769cb022","subject":"ATTACK:enterprise:S0065","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6613ed52-5c6c-43f2-bd0c-9809769cb022","modified":"2026-09-02T20:07:46.856Z","references":[{"source_name":"CrowdStrike Putter Panda","url":"http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--670d65e8-59a9-46ae-bdb6-6cb94a0528ba","subject":"ATTACK:enterprise:S0430","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--670d65e8-59a9-46ae-bdb6-6cb94a0528ba","modified":"2026-09-02T20:07:46.866Z","references":[{"source_name":"Chronicle Winnti for Linux May 2019","url":"https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6961d915-0d1e-4d5b-8a4a-163ce529fdaf","subject":"ATTACK:enterprise:S1228","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6961d915-0d1e-4d5b-8a4a-163ce529fdaf","modified":"2026-09-02T20:07:46.876Z","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024","url":"https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6e922719-0648-40df-b457-fb26b01e54ae","subject":"ATTACK:enterprise:S1223","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6e922719-0648-40df-b457-fb26b01e54ae","modified":"2026-09-02T20:07:46.888Z","references":[{"source_name":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7038419d-7138-436c-9486-5a800579a67f","subject":"ATTACK:enterprise:G1039","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7038419d-7138-436c-9486-5a800579a67f","modified":"2026-09-02T20:07:46.898Z","references":[{"source_name":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--71bb09bc-0405-43ed-9848-bf685234c670","subject":"ATTACK:enterprise:S0266","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--71bb09bc-0405-43ed-9848-bf685234c670","modified":"2026-09-02T20:07:46.912Z","references":[{"source_name":"Fidelis TrickBot Oct 2016","url":"https://www.fidelissecurity.com/threatgeek/2016/10/trickbot-we-missed-you-dyre"},{"source_name":"Bitdefender Trickbot C2 infra Nov 2020","url":"https://www.bitdefender.com/blog/labs/trickbot-is-dead-long-live-trickbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--73da57b5-e64f-44ee-85f7-d294c21fb534","subject":"ATTACK:enterprise:G0038","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--73da57b5-e64f-44ee-85f7-d294c21fb534","modified":"2026-09-02T20:07:46.922Z","references":[{"source_name":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--73fa4b5d-e75f-4050-b7aa-d003b3a31bf3","subject":"ATTACK:enterprise:S0603","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--73fa4b5d-e75f-4050-b7aa-d003b3a31bf3","modified":"2026-09-02T20:07:46.931Z","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--76c24fde-66fe-47f8-95f1-49deee5df54b","subject":"ATTACK:enterprise:C0056","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--76c24fde-66fe-47f8-95f1-49deee5df54b","modified":"2026-09-02T20:07:46.942Z","references":[{"source_name":"Juniper RedPenguin MAR 2025","url":"https://supportportal.juniper.net/sfc/servlet.shepherd/document/download/069Dp00000FzdmIIAR?operationContext=S1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--773ba80b-0dbc-4ed9-9fbb-bcfef08da01d","subject":"ATTACK:enterprise:S0678","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--773ba80b-0dbc-4ed9-9fbb-bcfef08da01d","modified":"2026-09-02T20:07:46.956Z","references":[{"source_name":"McAfee Lazarus Nov 2020","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--77bcb339-4a2f-4fa6-9145-c653000952dc","subject":"ATTACK:enterprise:S0377","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--77bcb339-4a2f-4fa6-9145-c653000952dc","modified":"2026-09-02T20:07:46.965Z","references":[{"source_name":"ESET Ebury Feb 2014","url":"https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--78665233-dd3d-4a86-981f-4342e4e0cbee","subject":"ATTACK:enterprise:S0495","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--78665233-dd3d-4a86-981f-4342e4e0cbee","modified":"2026-09-02T20:07:46.974Z","references":[{"source_name":"Unit42 RDAT July 2020","url":"https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--78adc73a-0f8c-498e-9451-7f9081f81595","subject":"ATTACK:enterprise:S0658","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--78adc73a-0f8c-498e-9451-7f9081f81595","modified":"2026-09-02T20:07:46.983Z","references":[{"source_name":"trendmicro xcsset xcode project 2020","url":"https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7943f92f-8956-4bb9-9f92-c932fb267b19","subject":"ATTACK:enterprise:S1099","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7943f92f-8956-4bb9-9f92-c932fb267b19","modified":"2026-09-02T20:07:46.993Z","references":[{"source_name":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7965d9c8-82db-4fde-a017-27e4de931546","subject":"ATTACK:enterprise:S1114","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7965d9c8-82db-4fde-a017-27e4de931546","modified":"2026-09-02T20:07:47.008Z","references":[{"source_name":"Mandiant Cutting Edge Part 2 January 2024","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7a41dd37-a5a0-4469-9ed9-74eb8ac57af3","subject":"ATTACK:enterprise:S0534","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7a41dd37-a5a0-4469-9ed9-74eb8ac57af3","modified":"2026-09-02T20:07:47.019Z","references":[{"source_name":"NCC Group Team9 June 2020","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7cb48d6d-1171-4e9d-87c7-4779293f6921","subject":"ATTACK:enterprise:S0038","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7cb48d6d-1171-4e9d-87c7-4779293f6921","modified":"2026-09-02T20:07:47.031Z","references":[{"source_name":"Symantec W32.Duqu","url":"https://web.archive.org/web/20111213083345/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e80ade6-a566-4e2b-b2e4-021f9dd6889a","subject":"ATTACK:enterprise:S0433","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e80ade6-a566-4e2b-b2e4-021f9dd6889a","modified":"2026-09-02T20:07:47.041Z","references":[{"source_name":"Carbon Black HotCroissant April 2020","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7feb6ceb-8a7c-45a9-902a-9b9c2c9a5e2c","subject":"ATTACK:enterprise:S0203","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7feb6ceb-8a7c-45a9-902a-9b9c2c9a5e2c","modified":"2026-09-02T20:07:47.051Z","references":[{"source_name":"Symantec Hydraq Jan 2010","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--805f7ba3-a904-410c-b9fd-20356c595b19","subject":"ATTACK:enterprise:S0127","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--805f7ba3-a904-410c-b9fd-20356c595b19","modified":"2026-09-02T20:07:47.061Z","references":[{"source_name":"Palo Alto Networks BBSRAT","url":"http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--846c52e8-41dc-4fe1-ab99-53d280d21748","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--846c52e8-41dc-4fe1-ab99-53d280d21748","modified":"2026-09-02T20:07:47.078Z","references":[{"source_name":"Talos MuddyWater Jan 2022","url":"https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--85a92b0f-f8c3-41a9-a1b3-cfbf8b442b39","subject":"ATTACK:enterprise:S0045","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--85a92b0f-f8c3-41a9-a1b3-cfbf8b442b39","modified":"2026-09-02T20:07:47.088Z","references":[{"source_name":"Bitdefender APT28 Dec 2015","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--862ddb07-08f2-4a83-b5ab-18cbed6582dc","subject":"ATTACK:enterprise:S1239","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--862ddb07-08f2-4a83-b5ab-18cbed6582dc","modified":"2026-09-02T20:07:47.105Z","references":[{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"Zscaler","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86db4034-d33f-4067-b133-70ea904fa461","subject":"ATTACK:enterprise:S0395","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86db4034-d33f-4067-b133-70ea904fa461","modified":"2026-09-02T20:07:47.119Z","references":[{"source_name":"ESET LightNeuron May 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--87480e5f-2284-43cb-86e6-01c0c49c2c23","subject":"ATTACK:enterprise:S0569","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--87480e5f-2284-43cb-86e6-01c0c49c2c23","modified":"2026-09-02T20:07:47.130Z","references":[{"source_name":"ClearSky Lebanese Cedar Jan 2021","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--87fb2671-e71a-4630-bde2-67e546fdeaa6","subject":"ATTACK:enterprise:S0148","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--87fb2671-e71a-4630-bde2-67e546fdeaa6","modified":"2026-09-02T20:07:47.141Z","references":[{"source_name":"ESET RTM Feb 2017","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8900d51e-b7ee-44d1-9e07-4416fb2474c1","subject":"ATTACK:enterprise:S1166","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8900d51e-b7ee-44d1-9e07-4416fb2474c1","modified":"2026-09-02T20:07:47.155Z","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8c418cb5-2cff-45f9-ad5d-b8b65cde713c","subject":"ATTACK:enterprise:S0582","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8c418cb5-2cff-45f9-ad5d-b8b65cde713c","modified":"2026-09-02T20:07:47.171Z","references":[{"source_name":"Proofpoint LookBack Malware Aug 2019","url":"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8d12dc63-d18a-43ef-b4bb-f4e9f67d2251","subject":"ATTACK:enterprise:S0586","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8d12dc63-d18a-43ef-b4bb-f4e9f67d2251","modified":"2026-09-02T20:07:47.182Z","references":[{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8d75c103-c7d8-44cd-afb6-f36f763c031f","subject":"ATTACK:enterprise:S0641","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8d75c103-c7d8-44cd-afb6-f36f763c031f","modified":"2026-09-02T20:07:47.192Z","references":[{"source_name":"ESET Kobalos Feb 2021","url":"https://www.welivesecurity.com/2021/02/02/kobalos-complex-linux-threat-high-performance-computing-infrastructure/"},{"source_name":"ESET Kobalos Jan 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8df1a464-9623-46bf-b23b-0430aa0a8c44","subject":"ATTACK:enterprise:S0032","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8df1a464-9623-46bf-b23b-0430aa0a8c44","modified":"2026-09-02T20:07:47.204Z","references":[{"source_name":"Nccgroup Gh0st April 2018","url":"https://research.nccgroup.com/2018/04/17/decoding-network-data-from-a-gh0st-rat-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8f7137e7-6d6b-4550-a8fd-bc5f09a81157","subject":"ATTACK:enterprise:S1224","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8f7137e7-6d6b-4550-a8fd-bc5f09a81157","modified":"2026-09-02T20:07:47.219Z","references":[{"source_name":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8fd3fb7d-29be-4199-87e4-6fb270925ab1","subject":"ATTACK:enterprise:S1060","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8fd3fb7d-29be-4199-87e4-6fb270925ab1","modified":"2026-09-02T20:07:47.229Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--90c3e922-1a21-4dc1-ad89-a72e013b5977","subject":"ATTACK:enterprise:S0615","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--90c3e922-1a21-4dc1-ad89-a72e013b5977","modified":"2026-09-02T20:07:47.239Z","references":[{"source_name":"BlackBerry CostaRicto November 2020","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--90ca7f0e-f0fd-47d5-9d40-8ae6d77c0897","subject":"ATTACK:enterprise:S0514","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--90ca7f0e-f0fd-47d5-9d40-8ae6d77c0897","modified":"2026-09-02T20:07:47.249Z","references":[{"source_name":"PWC WellMess July 2020","url":"https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"},{"source_name":"PWC WellMess C2 August 2020","url":"https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmess-analysis-command-control.html"},{"source_name":"CISA WellMess July 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9139c3d3-c466-4847-8b1b-257af487d5ef","subject":"ATTACK:enterprise:S9001","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9139c3d3-c466-4847-8b1b-257af487d5ef","modified":"2026-09-02T20:07:47.260Z","references":[{"source_name":"SophosGnGal_SystemBC_Dec2020","url":"https://news.sophos.com/en-us/2020/12/16/systembc/"},{"source_name":"HarmonProofpoint_SystemBC_Aug2019","url":"https://www.proofpoint.com/us/threat-insight/post/systembc-christmas-july-socks5-malware-and-exploit-kits"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9253e8b3-9fbb-4149-a2e4-60d36c006ba6","subject":"ATTACK:enterprise:S0134","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9253e8b3-9fbb-4149-a2e4-60d36c006ba6","modified":"2026-09-02T20:07:47.270Z","references":[{"source_name":"ESET Sednit Part 3","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--92dc384d-3644-4b75-834d-d85c33aec69b","subject":"ATTACK:enterprise:S1226","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--92dc384d-3644-4b75-834d-d85c33aec69b","modified":"2026-09-02T20:07:47.280Z","references":[{"source_name":"Unit42 Bookworm Nov2015","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--93f51dcb-f2cf-4aa2-880d-c2b9388252ff","subject":"ATTACK:enterprise:S0244","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--93f51dcb-f2cf-4aa2-880d-c2b9388252ff","modified":"2026-09-02T20:07:47.290Z","references":[{"source_name":"Palo Alto Comnie","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-comnie-continues-target-organizations-east-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--96fad0c2-f880-4fab-8aee-5573e1737dd8","subject":"ATTACK:enterprise:S0574","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--96fad0c2-f880-4fab-8aee-5573e1737dd8","modified":"2026-09-02T20:07:47.299Z","references":[{"source_name":"Unit42 BendyBear Feb 2021","url":"https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9bfcecc9-1a59-427c-9189-59a19c58e201","subject":"ATTACK:enterprise:S0501","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9bfcecc9-1a59-427c-9189-59a19c58e201","modified":"2026-09-02T20:07:47.309Z","references":[{"source_name":"ESET PipeMon May 2020","url":"https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9ce0b5a6-b0e8-45b3-9c5c-bbb6b891a216","subject":"ATTACK:enterprise:S0537","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9ce0b5a6-b0e8-45b3-9c5c-bbb6b891a216","modified":"2026-09-02T20:07:47.329Z","references":[{"source_name":"Accenture HyperStack October 2020","url":"https://web.archive.org/web/20201101015247/https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a392aa7e-b3ce-477c-acfc-e0f6b1d38556","subject":"ATTACK:enterprise:S0168","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a392aa7e-b3ce-477c-acfc-e0f6b1d38556","modified":"2026-09-02T20:07:47.339Z","references":[{"source_name":"ESET Gazer Aug 2017","url":"https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf"},{"source_name":"Securelist WhiteBear Aug 2017","url":"https://securelist.com/introducing-whitebear/81638/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a4c82341-ac27-4966-9496-23affadc1baa","subject":"ATTACK:enterprise:S1144","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a4c82341-ac27-4966-9496-23affadc1baa","modified":"2026-09-02T20:07:47.349Z","references":[{"source_name":"FRP GitHub","url":"https://github.com/fatedier/frp"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a56eef39-6908-4aed-ad7d-c2dc44b0b9d1","subject":"ATTACK:enterprise:S1106","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a56eef39-6908-4aed-ad7d-c2dc44b0b9d1","modified":"2026-09-02T20:07:47.359Z","references":[{"source_name":"NGLite Trojan","url":"https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a5f33976-796d-46b8-9c5f-5545ef25c03f","subject":"ATTACK:enterprise:S0336","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a5f33976-796d-46b8-9c5f-5545ef25c03f","modified":"2026-09-02T20:07:47.370Z","references":[{"source_name":"PaloAlto NanoCore Feb 2016","url":"https://researchcenter.paloaltonetworks.com/2016/02/nanocorerat-behind-an-increase-in-tax-themed-phishing-e-mails/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a7cb0193-e854-4361-b1a1-fc4e68354c59","subject":"ATTACK:enterprise:S0021","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a7cb0193-e854-4361-b1a1-fc4e68354c59","modified":"2026-09-02T20:07:47.380Z","references":[{"source_name":"Fidelis Turbo","url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2016/2016.02.29.Turbo_Campaign_Derusbi/TA_Fidelis_Turbo_1602_0.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a8822aba-51e7-44de-91f0-24e84390ee7c","subject":"ATTACK:enterprise:S1110","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a8822aba-51e7-44de-91f0-24e84390ee7c","modified":"2026-09-02T20:07:47.390Z","references":[{"source_name":"Mandiant Pulse Secure Zero-Day April 2021","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a9bd68ed-2602-4225-838e-2d9b7f8761b4","subject":"ATTACK:enterprise:S0030","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a9bd68ed-2602-4225-838e-2d9b7f8761b4","modified":"2026-09-02T20:07:47.400Z","references":[{"source_name":"Kaspersky Carbanak","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"},{"source_name":"FireEye CARBANAK June 2017","url":"https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aa56ecfa-9eaf-457c-b46c-0710a0c8ff7c","subject":"ATTACK:enterprise:S0653","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aa56ecfa-9eaf-457c-b46c-0710a0c8ff7c","modified":"2026-09-02T20:07:47.410Z","references":[{"source_name":"Checkpoint IndigoZebra July 2021","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--abf2a4b0-d0d7-4f13-9b7c-647abc3694e2","subject":"ATTACK:enterprise:S0439","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--abf2a4b0-d0d7-4f13-9b7c-647abc3694e2","modified":"2026-09-02T20:07:47.420Z","references":[{"source_name":"ESET Okrum July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ae459f2c-926a-4e11-b9ab-8b174ed47081","subject":"ATTACK:enterprise:G1052","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ae459f2c-926a-4e11-b9ab-8b174ed47081","modified":"2026-09-02T20:07:47.432Z","references":[{"source_name":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--af052dd3-641e-4954-a08f-74d56ad29b53","subject":"ATTACK:enterprise:G0126","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--af052dd3-641e-4954-a08f-74d56ad29b53","modified":"2026-09-02T20:07:47.447Z","references":[{"source_name":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b41c9b77-536b-49bc-8cb9-a873aa121002","subject":"ATTACK:enterprise:S0012","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b41c9b77-536b-49bc-8cb9-a873aa121002","modified":"2026-09-02T20:07:47.457Z","references":[{"source_name":"FireEye Poison Ivy","url":"https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b5cbd882-e5dc-468e-b853-5e6e24583741","subject":"ATTACK:enterprise:S1039","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b5cbd882-e5dc-468e-b853-5e6e24583741","modified":"2026-09-02T20:07:47.467Z","references":[{"source_name":"Proofpoint Bumblebee April 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b644de55-05f0-4e2e-93ee-db7915097ed1","subject":"ATTACK:enterprise:S0342","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b644de55-05f0-4e2e-93ee-db7915097ed1","modified":"2026-09-02T20:07:47.477Z","references":[{"source_name":"ESET GreyEnergy Oct 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b85998e0-9f93-4cb3-a1cf-64e510b109c4","subject":"ATTACK:enterprise:S0633","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b85998e0-9f93-4cb3-a1cf-64e510b109c4","modified":"2026-09-02T20:07:47.488Z","references":[{"source_name":"GitHub Sliver Encryption","url":"https://github.com/BishopFox/sliver/wiki/Transport-Encryption"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b947983f-2c0a-4082-b102-8f8497e2b045","subject":"ATTACK:enterprise:S0627","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b947983f-2c0a-4082-b102-8f8497e2b045","modified":"2026-09-02T20:07:47.498Z","references":[{"source_name":"Securelist APT10 March 2021","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b94e707d-b2f8-4b68-acac-44d3777dd93f","subject":"ATTACK:enterprise:S0153","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b94e707d-b2f8-4b68-acac-44d3777dd93f","modified":"2026-09-02T20:07:47.509Z","references":[{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bc054b77-6622-4742-8acc-e2e31e63426c","subject":"ATTACK:enterprise:S9019","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bc054b77-6622-4742-8acc-e2e31e63426c","modified":"2026-09-02T20:07:47.521Z","references":[{"source_name":"Check Point Blind Eagle MAR 2025","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bc4b8f68-3570-474e-8157-225afddda463","subject":"ATTACK:enterprise:S0381","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bc4b8f68-3570-474e-8157-225afddda463","modified":"2026-09-02T20:07:47.533Z","references":[{"source_name":"Proofpoint TA505 Mar 2018","url":"https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bcc48bba-95a6-465b-ad37-90e2faee5707","subject":"ATTACK:enterprise:S0091","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bcc48bba-95a6-465b-ad37-90e2faee5707","modified":"2026-09-02T20:07:47.547Z","references":[{"source_name":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bccb7ac3-c374-445b-aad2-14991a8641e5","subject":"ATTACK:enterprise:T1573.001","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1573","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bccb7ac3-c374-445b-aad2-14991a8641e5","modified":"2026-09-03T19:46:54.829Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--be2d7f8b-8e7d-45ac-b855-385bc1e03b7e","subject":"ATTACK:enterprise:S1160","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--be2d7f8b-8e7d-45ac-b855-385bc1e03b7e","modified":"2026-09-02T20:07:47.574Z","references":[{"source_name":"Bitsight Latrodectus June 2024","url":"https://www.bitsight.com/blog/latrodectus-are-you-coming-back"},{"source_name":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"},{"source_name":"Elastic Latrodectus May 2024","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bf8ae26c-c28c-4de7-a3e2-ad1a2851c1c0","subject":"ATTACK:enterprise:S0077","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bf8ae26c-c28c-4de7-a3e2-ad1a2851c1c0","modified":"2026-09-02T20:07:47.586Z","references":[{"source_name":"Scarlet Mimic Jan 2016","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bfe30cdf-a0c8-440d-b471-d9fef00c559b","subject":"ATTACK:enterprise:S0436","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bfe30cdf-a0c8-440d-b471-d9fef00c559b","modified":"2026-09-02T20:07:47.598Z","references":[{"source_name":"JPCert TSCookie March 2018","url":"https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c08ef8e9-9e12-4bb2-9e6a-061934f33ea0","subject":"ATTACK:enterprise:S0162","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c08ef8e9-9e12-4bb2-9e6a-061934f33ea0","modified":"2026-09-02T20:07:47.612Z","references":[{"source_name":"Sofacy Komplex Trojan","url":"https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c420d58d-2a7e-4eef-a12d-d37e4c9fc9b4","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c420d58d-2a7e-4eef-a12d-d37e4c9fc9b4","modified":"2026-09-02T20:07:47.623Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c5695fbd-768f-4652-a8f1-9ed41d8cbd60","subject":"ATTACK:enterprise:S1115","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c5695fbd-768f-4652-a8f1-9ed41d8cbd60","modified":"2026-09-02T20:07:47.636Z","references":[{"source_name":"Mandiant Cutting Edge January 2024","url":"https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c7aa0575-5434-4a42-ae9d-9a7a52eac99b","subject":"ATTACK:enterprise:S0154","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c7aa0575-5434-4a42-ae9d-9a7a52eac99b","modified":"2026-09-02T20:07:47.647Z","references":[{"source_name":"Talos Cobalt Strike September 2020","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c8d0e862-20af-4f9f-84e8-0419c8080008","subject":"ATTACK:enterprise:S0053","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c8d0e862-20af-4f9f-84e8-0419c8080008","modified":"2026-09-02T20:07:47.659Z","references":[{"source_name":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"},{"source_name":"Unit 42 SeaDuke 2015","url":"http://researchcenter.paloaltonetworks.com/2015/07/unit-42-technical-analysis-seaduke/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c945e5f2-5622-46ce-8b35-468d41d2af46","subject":"ATTACK:enterprise:S0003","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c945e5f2-5622-46ce-8b35-468d41d2af46","modified":"2026-09-02T20:07:47.671Z","references":[{"source_name":"Moran 2014","url":"https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ca8ed9e2-f7a6-4d54-b450-94c187b1f9b6","subject":"ATTACK:enterprise:S0132","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ca8ed9e2-f7a6-4d54-b450-94c187b1f9b6","modified":"2026-09-02T20:07:47.682Z","references":[{"source_name":"Cisco H1N1 Part 2","url":"https://web.archive.org/web/20231210122239/https://blogs.cisco.com/security/h1n1-technical-analysis-reveals-new-capabilities-part-2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cd89dfdb-5c48-4a91-ba2f-e3c6e74c5094","subject":"ATTACK:enterprise:G0100","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cd89dfdb-5c48-4a91-ba2f-e3c6e74c5094","modified":"2026-09-02T20:07:47.693Z","references":[{"source_name":"Kaspersky Cloud Atlas December 2014","url":"https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ce43264e-ab32-45a7-898f-0320c477c581","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ce43264e-ab32-45a7-898f-0320c477c581","modified":"2026-09-02T20:07:47.711Z","references":[{"source_name":"Malwarebytes KONNI Evolves Jan 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/konni-evolves-into-stealthier-rat/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ce9dbe5b-1b16-41d6-a7af-a2a1b33c4552","subject":"ATTACK:enterprise:S0187","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ce9dbe5b-1b16-41d6-a7af-a2a1b33c4552","modified":"2026-09-02T20:07:47.722Z","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cf8f6cd4-cd87-430b-b286-3790c5a97efa","subject":"ATTACK:enterprise:S0230","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cf8f6cd4-cd87-430b-b286-3790c5a97efa","modified":"2026-09-02T20:07:47.733Z","references":[{"source_name":"Proofpoint TA459 April 2017","url":"https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts"},{"source_name":"Proofpoint ZeroT Feb 2017","url":"https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cfe4f343-6c24-42c0-826d-1c371abad98e","subject":"ATTACK:enterprise:S9023","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cfe4f343-6c24-42c0-826d-1c371abad98e","modified":"2026-09-02T20:07:47.743Z","references":[{"source_name":"ESET HiddenFace 2024","url":"https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d14ae483-48aa-441f-b6b2-9bf8031b561d","subject":"ATTACK:enterprise:S1196","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d14ae483-48aa-441f-b6b2-9bf8031b561d","modified":"2026-09-02T20:07:47.754Z","references":[{"source_name":"S2W Troll Stealer 2024","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d6a29b67-d323-4579-9c8e-1c95a0ea7c20","subject":"ATTACK:enterprise:S0512","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d6a29b67-d323-4579-9c8e-1c95a0ea7c20","modified":"2026-09-02T20:07:47.765Z","references":[{"source_name":"ESET Dukes October 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d7cdf423-5fed-4402-b970-f6cf2d8df2bb","subject":"ATTACK:enterprise:S0271","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d7cdf423-5fed-4402-b970-f6cf2d8df2bb","modified":"2026-09-02T20:07:47.776Z","references":[{"source_name":"US-CERT KEYMARBLE Aug 2018","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-221A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d7f3c107-cf9c-4cb3-9d58-56199962e8c5","subject":"ATTACK:enterprise:S0234","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d7f3c107-cf9c-4cb3-9d58-56199962e8c5","modified":"2026-09-02T20:07:47.786Z","references":[{"source_name":"CheckPoint Bandook Nov 2020","url":"https://research.checkpoint.com/2020/bandook-signed-delivered/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d8f14118-ba84-44b0-a0b6-ad2348e42906","subject":"ATTACK:enterprise:S1022","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d8f14118-ba84-44b0-a0b6-ad2348e42906","modified":"2026-09-02T20:07:47.796Z","references":[{"source_name":"CrowdStrike IceApple May 2022","url":"https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d9108692-8e7e-4289-825b-29f471c914eb","subject":"ATTACK:enterprise:C0057","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d9108692-8e7e-4289-825b-29f471c914eb","modified":"2026-09-02T20:07:47.806Z","references":[{"source_name":"Mandiant 3cx UNC4736 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--db908ada-4337-40a5-b84b-74053fdb1e7d","subject":"ATTACK:enterprise:S9041","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--db908ada-4337-40a5-b84b-74053fdb1e7d","modified":"2026-09-02T20:07:47.817Z","references":[{"source_name":"Aqua Security Trivy Compromise MAR 2026","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"},{"source_name":"Wiz Trivy Compromise MAR 2026","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source_name":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"},{"source_name":"Sysdig TeamPCP MAR 2026","url":"https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e053cb07-3e4d-41a1-85a6-38cd2ac0e6ea","subject":"ATTACK:enterprise:G0064","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e053cb07-3e4d-41a1-85a6-38cd2ac0e6ea","modified":"2026-09-02T20:07:47.833Z","references":[{"source_name":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e08a510f-65b2-4676-9667-848166ba22b4","subject":"ATTACK:enterprise:S0629","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e08a510f-65b2-4676-9667-848166ba22b4","modified":"2026-09-02T20:07:47.843Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e0d5dda2-3fc1-4dde-aebe-fb6e31023195","subject":"ATTACK:enterprise:S0254","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e0d5dda2-3fc1-4dde-aebe-fb6e31023195","modified":"2026-09-02T20:07:47.853Z","references":[{"source_name":"Rancor Unit42 June 2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e1e07e90-7012-4a38-82b4-e521ef21e8d9","subject":"ATTACK:enterprise:S0661","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e1e07e90-7012-4a38-82b4-e521ef21e8d9","modified":"2026-09-02T20:07:47.863Z","references":[{"source_name":"MSTIC FoggyWeb September 2021","url":"https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e2f9132b-cb32-4b39-8d6d-fec48be3e92f","subject":"ATTACK:enterprise:S0520","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e2f9132b-cb32-4b39-8d6d-fec48be3e92f","modified":"2026-09-02T20:07:47.875Z","references":[{"source_name":"US-CERT BLINDINGCAN Aug 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e376d1ed-a35a-47c1-98c6-4d37f52b1b84","subject":"ATTACK:enterprise:S0144","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e376d1ed-a35a-47c1-98c6-4d37f52b1b84","modified":"2026-09-02T20:07:47.885Z","references":[{"source_name":"Palo Alto menuPass Feb 2017","url":"http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/"},{"source_name":"JPCERT ChChes Feb 2017","url":"https://blogs.jpcert.or.jp/en/2017/02/chches-malware--93d6.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e4fa961c-e72b-47b3-b0fb-8051f9ca4d63","subject":"ATTACK:enterprise:S1059","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e4fa961c-e72b-47b3-b0fb-8051f9ca4d63","modified":"2026-09-02T20:07:47.897Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e9404ebb-fce5-4596-b0f1-7f8a61578b32","subject":"ATTACK:enterprise:S0333","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e9404ebb-fce5-4596-b0f1-7f8a61578b32","modified":"2026-09-02T20:07:47.909Z","references":[{"source_name":"PaloAlto UBoatRAT Nov 2017","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ea2f41fe-0701-4607-aa70-d6531c7461c6","subject":"ATTACK:enterprise:G0007","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ea2f41fe-0701-4607-aa70-d6531c7461c6","modified":"2026-09-02T20:07:47.919Z","references":[{"source_name":"ESET Zebrocy May 2019","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ec4d07a2-8c8b-4df8-bb9e-b8c3e23d8dc5","subject":"ATTACK:enterprise:G0060","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ec4d07a2-8c8b-4df8-bb9e-b8c3e23d8dc5","modified":"2026-09-02T20:07:47.931Z","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eeccfd34-bc7a-4a94-bc27-3f5f20063ee7","subject":"ATTACK:enterprise:S0455","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eeccfd34-bc7a-4a94-bc27-3f5f20063ee7","modified":"2026-09-02T20:07:47.941Z","references":[{"source_name":"ESET Casbaneiro Oct 2019","url":"https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f02f0a58-a76b-4966-8717-8a9b40b07e81","subject":"ATTACK:enterprise:S0159","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f02f0a58-a76b-4966-8717-8a9b40b07e81","modified":"2026-09-02T20:07:47.957Z","references":[{"source_name":"FireEye APT10 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f09f6c15-193c-406a-ab64-bf730d83f39f","subject":"ATTACK:enterprise:S0435","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f09f6c15-193c-406a-ab64-bf730d83f39f","modified":"2026-09-02T20:07:47.968Z","references":[{"source_name":"JPCert PLEAD Downloader June 2018","url":"https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f29a3a93-e697-4d6f-8087-eec72856bae5","subject":"ATTACK:enterprise:S0023","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f29a3a93-e697-4d6f-8087-eec72856bae5","modified":"2026-09-02T20:07:47.979Z","references":[{"source_name":"ESET Sednit Part 2","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f4e53b40-abcf-4157-9e53-4ab9632619f1","subject":"ATTACK:enterprise:S0137","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f4e53b40-abcf-4157-9e53-4ab9632619f1","modified":"2026-09-02T20:07:47.990Z","references":[{"source_name":"FireEye APT28","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f6ae27d6-5391-467d-a25d-e4172daa963d","subject":"ATTACK:enterprise:S1078","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f6ae27d6-5391-467d-a25d-e4172daa963d","modified":"2026-09-02T20:07:47.999Z","references":[{"source_name":"RotaJakiro 2021 netlab360 analysis","url":"https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f874b527-e973-40f2-89cb-2c7feab5b6b4","subject":"ATTACK:enterprise:S0472","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f874b527-e973-40f2-89cb-2c7feab5b6b4","modified":"2026-09-02T20:07:48.012Z","references":[{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa035513-59b6-4f54-8b85-13ec08849453","subject":"ATTACK:enterprise:S0171","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa035513-59b6-4f54-8b85-13ec08849453","modified":"2026-09-02T20:07:48.023Z","references":[{"source_name":"Forcepoint Felismus Mar 2017","url":"https://blogs.forcepoint.com/security-labs/playing-cat-mouse-introducing-felismus-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa426e9e-7e77-4c1b-b03c-00a4ae45ac6c","subject":"ATTACK:enterprise:C0001","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa426e9e-7e77-4c1b-b03c-00a4ae45ac6c","modified":"2026-09-02T20:07:48.034Z","references":[{"source_name":"Talos Frankenstein June 2019","url":"https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa44e12d-d936-47ba-8fb4-1c9775c08658","subject":"ATTACK:enterprise:S0630","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa44e12d-d936-47ba-8fb4-1c9775c08658","modified":"2026-09-02T20:07:48.045Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa50bbff-2f2f-47a8-b295-588e61b76a77","subject":"ATTACK:enterprise:S1065","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa50bbff-2f2f-47a8-b295-588e61b76a77","modified":"2026-09-02T20:07:48.055Z","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fbae4191-679a-45b2-8ebb-8adb5348f4d0","subject":"ATTACK:enterprise:S0050","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fbae4191-679a-45b2-8ebb-8adb5348f4d0","modified":"2026-09-02T20:07:48.066Z","references":[{"source_name":"F-Secure Cosmicduke","url":"https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ffe85478-e3ed-4856-b4ae-03a7b693e381","subject":"ATTACK:enterprise:S1031","predicate":"uses","object":"ATTACK:enterprise:T1573.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ffe85478-e3ed-4856-b4ae-03a7b693e381","modified":"2026-09-02T20:07:48.080Z","references":[{"source_name":"Unit 42 PingPull Jun 2022","url":"https://unit42.paloaltonetworks.com/pingpull-gallium/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}