{"record":{"id":"ATTACK:enterprise:T1574.001","title":"DLL","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1574/001","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34","external_id":"T1574.001","domain":"enterprise","created":"2020-03-13T18:11:08.357Z","modified":"2026-09-11T19:32:27.370Z","version":"3.0","aliases":[],"tactics":["stealth","execution"],"source_references":[{"source_name":"Hijack DLLs CrowdStrike","url":"https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/"},{"source_name":"kroll bpl","url":"https://www.kroll.com/en/insights/publications/cyber/idatloader-distribution"},{"source_name":"Sophos","url":"https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/"},{"source_name":"Hexacorn DLL Hijacking","url":"https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/"},{"source_name":"microsoft remote preloading","url":"https://learn.microsoft.com/en-us/security-updates/securityadvisories/2010/2269637"},{"source_name":"Microsoft - manifests/assembly","url":"https://learn.microsoft.com/en-us/windows/win32/sbscs/manifests?redirectedfrom=MSDN"},{"source_name":"Microsoft redirection","url":"https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection?redirectedfrom=MSDN"},{"source_name":"dll pre load owasp","url":"https://owasp.org/www-community/attacks/Binary_planting"},{"source_name":"Virus Bulletin","url":"https://www.virusbulletin.com/conference/vb2023/abstracts/unveiling-activities-tropic-trooper-2023-deep-analysis-xiangoop-loader-and-entryshell-payload/"},{"source_name":"unit 42","url":"https://unit42.paloaltonetworks.com/dll-hijacking-techniques/"},{"source_name":"Wietze Beukema DLL Hijacking","url":"https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows"}]},"assertions":[{"id":"enterprise:relationship--0390ebec-176f-421a-9823-cce48756aef1","subject":"ATTACK:enterprise:G0114","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0390ebec-176f-421a-9823-cce48756aef1","modified":"2026-07-31T20:48:41.170Z","references":[{"source_name":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0577a90e-88f7-4b33-8dd2-f5e123f63be2","subject":"ATTACK:enterprise:G1021","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0577a90e-88f7-4b33-8dd2-f5e123f63be2","modified":"2026-07-31T18:48:07.663Z","references":[{"source_name":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"},{"source_name":"SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022","url":"https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"},{"source_name":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--05e15ff7-e0b1-47e3-a7bd-7f0e8845bf2c","subject":"ATTACK:enterprise:S1041","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--05e15ff7-e0b1-47e3-a7bd-7f0e8845bf2c","modified":"2026-04-29T14:23:05.911Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0839d954-ce47-4972-bea2-f4d9a76141af","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0839d954-ce47-4972-bea2-f4d9a76141af","modified":"2026-07-31T20:48:29.613Z","references":[{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--112b896f-a3df-4b7c-80cd-332d561bc028","subject":"ATTACK:enterprise:S0384","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--112b896f-a3df-4b7c-80cd-332d561bc028","modified":"2026-04-29T14:23:05.927Z","references":[{"source_name":"Red Canary Dridex Threat Report 2021","url":"https://redcanary.com/threat-detection-report/threats/dridex/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1236d556-1b4a-4d0f-96b2-cf036b30ca17","subject":"ATTACK:enterprise:G1047","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1236d556-1b4a-4d0f-96b2-cf036b30ca17","modified":"2026-07-31T18:48:23.744Z","references":[{"source_name":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--16d95f0d-fc05-4012-a1a0-35d7261b7f27","subject":"ATTACK:enterprise:S0664","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--16d95f0d-fc05-4012-a1a0-35d7261b7f27","modified":"2026-04-29T14:23:05.935Z","references":[{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--16dfd169-264f-410f-97bf-a1cdec20c50e","subject":"ATTACK:enterprise:G0048","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--16dfd169-264f-410f-97bf-a1cdec20c50e","modified":"2026-07-31T18:48:17.302Z","references":[{"source_name":"Group IB RTM August 2019","url":"https://www.group-ib.com/blog/rtm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--16e906b5-011b-476d-a00d-78e514e7354c","subject":"ATTACK:enterprise:G0131","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--16e906b5-011b-476d-a00d-78e514e7354c","modified":"2026-07-31T18:48:18.800Z","references":[{"source_name":"ESET Exchange Mar 2021","url":"https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--174698f8-9349-4e52-9887-18089038195c","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--174698f8-9349-4e52-9887-18089038195c","modified":"2026-07-31T20:48:26.164Z","references":[{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1762fe5a-0810-4179-bfb0-16d965ffe055","subject":"ATTACK:enterprise:S0070","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1762fe5a-0810-4179-bfb0-16d965ffe055","modified":"2026-04-29T14:23:05.936Z","references":[{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source_name":"ZScaler Hacking Team","url":"http://research.zscaler.com/2015/08/chinese-cyber-espionage-apt-group.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--191885b6-1282-4173-a2bd-174c30c8a1dc","subject":"ATTACK:enterprise:S0109","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--191885b6-1282-4173-a2bd-174c30c8a1dc","modified":"2026-04-29T14:23:05.939Z","references":[{"source_name":"Mandiant APT1 Appendix","url":"https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1ad315e2-1693-427a-9a04-a613bd0e2f22","subject":"ATTACK:enterprise:S0009","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1ad315e2-1693-427a-9a04-a613bd0e2f22","modified":"2026-04-29T14:23:05.941Z","references":[{"source_name":"FireEye Hikit Rootkit","url":"https://web.archive.org/web/20190216180458/https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1bbb499c-81c8-4e94-8305-86b199e8298b","subject":"ATTACK:enterprise:S0176","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1bbb499c-81c8-4e94-8305-86b199e8298b","modified":"2026-04-29T14:23:05.942Z","references":[{"source_name":"Microsoft SIR Vol 21","url":"http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf"},{"source_name":"Microsoft Wingbird Nov 2017","url":"https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Wingbird.A!dha"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1cd08976-89bc-4626-987f-a47c9c685f68","subject":"ATTACK:enterprise:S0528","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1cd08976-89bc-4626-987f-a47c9c685f68","modified":"2026-04-29T14:23:05.944Z","references":[{"source_name":"Securelist Brazilian Banking Malware July 2020","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1d5e1f26-2a73-4709-bd56-ddfae14f48b9","subject":"ATTACK:enterprise:S9020","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1d5e1f26-2a73-4709-bd56-ddfae14f48b9","modified":"2026-04-29T14:23:05.945Z","references":[{"source_name":"Kaspersky LODEINFO OCT 2022","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--22ce2c93-ecd6-4627-b3f0-6f7476754c79","subject":"ATTACK:enterprise:M1038","predicate":"mitigates","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--22ce2c93-ecd6-4627-b3f0-6f7476754c79","modified":"2026-04-29T14:23:05.952Z","references":[{"source_name":"Microsoft AppLocker DLL","url":"https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/applocker/dll-rules-in-applocker"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--283e242a-72d4-4b40-8905-888595c34919","subject":"ATTACK:enterprise:S0128","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--283e242a-72d4-4b40-8905-888595c34919","modified":"2026-04-29T14:23:05.960Z","references":[{"source_name":"PaloAlto Patchwork Mar 2018","url":"https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"},{"source_name":"Forcepoint Monsoon","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--29912e12-89f8-4e82-9ebd-2cbb276ed995","subject":"ATTACK:enterprise:S1227","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--29912e12-89f8-4e82-9ebd-2cbb276ed995","modified":"2026-04-29T14:23:05.961Z","references":[{"source_name":"Zscaler","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2b1831a6-22e1-4ddb-8b39-00c1ebeeb6de","subject":"ATTACK:enterprise:S1232","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2b1831a6-22e1-4ddb-8b39-00c1ebeeb6de","modified":"2026-04-29T14:23:05.963Z","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2e2daf37-1d3d-4b24-ab46-dfc894f9ef96","subject":"ATTACK:enterprise:G0107","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2e2daf37-1d3d-4b24-ab46-dfc894f9ef96","modified":"2026-07-31T18:48:14.513Z","references":[{"source_name":"Symantec Whitefly March 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--325c0731-f5a7-42f5-8f2a-56358613895b","subject":"ATTACK:enterprise:C0047","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--325c0731-f5a7-42f5-8f2a-56358613895b","modified":"2026-07-31T18:47:19.273Z","references":[{"source_name":"Recorded Future RedDelta 2025","url":"https://go.recordedfuture.com/hubfs/reports/cta-cn-2025-0109.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--328825fa-a589-4c16-abef-7e3663f1f6ec","subject":"ATTACK:enterprise:S0182","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--328825fa-a589-4c16-abef-7e3663f1f6ec","modified":"2026-04-29T14:23:05.985Z","references":[{"source_name":"Microsoft FinFisher March 2018","url":"https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"},{"source_name":"FinFisher Citation","url":"https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"},{"source_name":"Securelist BlackOasis Oct 2017","url":"https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--38230234-1111-41cf-aa6b-b107577dad61","subject":"ATTACK:enterprise:G0143","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--38230234-1111-41cf-aa6b-b107577dad61","modified":"2026-07-31T18:47:59.224Z","references":[{"source_name":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"},{"source_name":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3b4b4665-530f-4b8c-b090-48ae99eae905","subject":"ATTACK:enterprise:S0398","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3b4b4665-530f-4b8c-b090-48ae99eae905","modified":"2026-04-29T14:23:06.003Z","references":[{"source_name":"Unit42 Emissary Panda May 2019","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"},{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3b523bd9-ffc2-4525-a08c-4500bfcb2fed","subject":"ATTACK:enterprise:G0093","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3b523bd9-ffc2-4525-a08c-4500bfcb2fed","modified":"2026-07-31T18:47:37.120Z","references":[{"source_name":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3c6a57c5-3854-4198-b6f2-ec4e7766b9bb","subject":"ATTACK:enterprise:S1239","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3c6a57c5-3854-4198-b6f2-ec4e7766b9bb","modified":"2026-04-29T14:23:06.006Z","references":[{"source_name":"CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024","url":"https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"},{"source_name":"ATTACKIQ MUSTANG PANDA TONESHELL March 2023","url":"https://www.attackiq.com/2023/03/23/emulating-the-politically-motivated-chinese-apt-mustang-panda/"},{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"},{"source_name":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"Zscaler","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"},{"source_name":"Trend Micro Mustang Panda Earth Preta TONESHELL June 2023","url":"https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3d4524b0-db14-41d1-bcf7-68fce4dca5cc","subject":"ATTACK:enterprise:S0275","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3d4524b0-db14-41d1-bcf7-68fce4dca5cc","modified":"2026-04-29T14:23:06.008Z","references":[{"source_name":"ESET MirrorFace 2025","url":"https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3f8a74a9-55fe-4f9c-bddb-00b715ca3668","subject":"ATTACK:enterprise:S0153","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3f8a74a9-55fe-4f9c-bddb-00b715ca3668","modified":"2026-04-29T14:23:06.011Z","references":[{"source_name":"FireEye APT10 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--401350a5-c1dd-4448-956e-a31009ef43cd","subject":"ATTACK:enterprise:S9029","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--401350a5-c1dd-4448-956e-a31009ef43cd","modified":"2026-04-29T14:23:06.012Z","references":[{"source_name":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--40b904c6-d77d-4ba8-98a5-c03d5c2a3186","subject":"ATTACK:enterprise:G0126","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--40b904c6-d77d-4ba8-98a5-c03d5c2a3186","modified":"2026-07-31T18:47:56.427Z","references":[{"source_name":"PTSecurity Higaisa 2020","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--44533bc7-0368-4269-b465-7e08d3a8beea","subject":"ATTACK:enterprise:S0455","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--44533bc7-0368-4269-b465-7e08d3a8beea","modified":"2026-04-29T14:23:06.018Z","references":[{"source_name":"Medium Metamorfo Apr 2020","url":"https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"},{"source_name":"ESET Casbaneiro Oct 2019","url":"https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"},{"source_name":"FireEye Metamorfo Apr 2018","url":"https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--44bbd0e1-acdf-458c-934c-a64e8a7a371c","subject":"ATTACK:enterprise:S0579","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--44bbd0e1-acdf-458c-934c-a64e8a7a371c","modified":"2026-04-29T14:23:06.019Z","references":[{"source_name":"Trend Micro Waterbear December 2019","url":"https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4a4664c1-47dd-4a4a-ab7b-0f64ec137a67","subject":"ATTACK:enterprise:S0230","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4a4664c1-47dd-4a4a-ab7b-0f64ec137a67","modified":"2026-04-29T14:23:06.027Z","references":[{"source_name":"Proofpoint TA459 April 2017","url":"https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts"},{"source_name":"Proofpoint ZeroT Feb 2017","url":"https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4ac9f066-58e8-4e8d-bfaa-12520294885c","subject":"ATTACK:enterprise:S9031","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4ac9f066-58e8-4e8d-bfaa-12520294885c","modified":"2026-04-29T14:23:06.027Z","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4d6fe46d-b896-4e1e-985c-ce49a7995b74","subject":"ATTACK:enterprise:S1236","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4d6fe46d-b896-4e1e-985c-ce49a7995b74","modified":"2026-04-29T14:23:06.031Z","references":[{"source_name":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4f13e788-b0da-457d-89b1-64196c9627b8","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4f13e788-b0da-457d-89b1-64196c9627b8","modified":"2026-07-31T18:47:44.384Z","references":[{"source_name":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"},{"source_name":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--54c3c155-6347-4dc5-89df-aae2c15d6c7a","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--54c3c155-6347-4dc5-89df-aae2c15d6c7a","modified":"2026-04-29T14:23:06.041Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source_name":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source_name":"Profero APT27 December 2020","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"},{"source_name":"Palo Alto PlugX June 2017","url":"https://researchcenter.paloaltonetworks.com/2017/06/unit42-paranoid-plugx/"},{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source_name":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"FireEye Clandestine Fox Part 2","url":"https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html"},{"source_name":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"},{"source_name":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"},{"source_name":"Stewart 2014","url":"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-dll-sideloading.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--55e67f6b-600a-4196-b497-63019731e66e","subject":"ATTACK:enterprise:S0458","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--55e67f6b-600a-4196-b497-63019731e66e","modified":"2026-04-29T14:23:06.042Z","references":[{"source_name":"Eset Ramsay May 2020","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--570bed8d-56fc-4d63-bad3-87dc08ac9cb1","subject":"ATTACK:enterprise:S9060","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--570bed8d-56fc-4d63-bad3-87dc08ac9cb1","modified":"2026-10-01T15:27:46.141Z","references":[{"source_name":"Mandiant_UNC1549_Feb2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5a63e7cf-1914-4f05-ac85-5aa1690ed3ef","subject":"ATTACK:enterprise:G1046","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5a63e7cf-1914-4f05-ac85-5aa1690ed3ef","modified":"2026-07-31T18:47:47.935Z","references":[{"source_name":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5c34be50-c7be-40c2-80bb-f3bc7db5cdd7","subject":"ATTACK:enterprise:S0074","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5c34be50-c7be-40c2-80bb-f3bc7db5cdd7","modified":"2026-04-29T14:23:06.051Z","references":[{"source_name":"Dell Sakula","url":"http://www.secureworks.com/cyber-threat-intelligence/threats/sakula-malware-family/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5fd27d34-7250-4c1d-81ce-683cdb527b9c","subject":"ATTACK:enterprise:S1213","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5fd27d34-7250-4c1d-81ce-683cdb527b9c","modified":"2026-04-29T14:23:06.055Z","references":[{"source_name":"Cybereason LumaStealer Undated","url":"https://www.cybereason.com/blog/threat-analysis-rise-of-lummastealer"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--65d7883b-03ff-41bf-82e1-4dada6255751","subject":"ATTACK:enterprise:S9061","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--65d7883b-03ff-41bf-82e1-4dada6255751","modified":"2026-09-30T16:23:42.099Z","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--677f32ad-2aa1-4fe3-8dab-73494891aa4a","subject":"ATTACK:enterprise:S0098","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--677f32ad-2aa1-4fe3-8dab-73494891aa4a","modified":"2026-04-29T14:23:06.066Z","references":[{"source_name":"Palo Alto T9000 Feb 2016","url":"http://researchcenter.paloaltonetworks.com/2016/02/t9000-advanced-modular-backdoor-uses-complex-anti-analysis-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--67f7ebd0-effb-4169-a184-7d45c614a6ee","subject":"ATTACK:enterprise:G0120","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--67f7ebd0-effb-4169-a184-7d45c614a6ee","modified":"2026-07-31T18:47:42.451Z","references":[{"source_name":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6874b50a-10e8-4036-bb2d-aabab35ec75b","subject":"ATTACK:enterprise:S0032","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6874b50a-10e8-4036-bb2d-aabab35ec75b","modified":"2026-04-29T14:23:06.067Z","references":[{"source_name":"Arbor Musical Chairs Feb 2018","url":"https://www.arbornetworks.com/blog/asert/musical-chairs-playing-tetris/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6b19a5ae-3f6a-4950-94da-22d94477d5d2","subject":"ATTACK:enterprise:S0127","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6b19a5ae-3f6a-4950-94da-22d94477d5d2","modified":"2026-04-29T14:23:06.071Z","references":[{"source_name":"Palo Alto Networks BBSRAT","url":"http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6c4292e7-a284-4524-8efc-1d8e205f6eed","subject":"ATTACK:enterprise:S1228","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6c4292e7-a284-4524-8efc-1d8e205f6eed","modified":"2026-04-29T14:23:06.072Z","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024","url":"https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"},{"source_name":"Lab52 MUSTANG PANDA PUBLOAD MAY 2023","url":"https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"},{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"Palo Alto Networks, Unit 42","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"},{"source_name":"PaloAlto MUSTANG PANDA PUBLOAD MARCH 2024","url":"https://unit42.paloaltonetworks.com/chinese-apts-target-asean-entities/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6cbe59bb-e66e-456e-b230-5880ae6fd5ac","subject":"ATTACK:enterprise:S1100","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6cbe59bb-e66e-456e-b230-5880ae6fd5ac","modified":"2026-04-29T14:23:06.073Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6cd345e0-3571-4596-a817-dace4dd7080b","subject":"ATTACK:enterprise:S1229","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6cd345e0-3571-4596-a817-dace4dd7080b","modified":"2026-04-29T14:23:06.073Z","references":[{"source_name":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ce3735c-bfae-4eec-ab6b-bbf08cb7d60f","subject":"ATTACK:enterprise:S0113","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ce3735c-bfae-4eec-ab6b-bbf08cb7d60f","modified":"2026-04-29T14:23:06.073Z","references":[{"source_name":"ESET Operation Groundbait","url":"http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--70b2e51a-c5c4-48af-8f9c-112a4854e18d","subject":"ATTACK:enterprise:S0373","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--70b2e51a-c5c4-48af-8f9c-112a4854e18d","modified":"2026-04-29T14:23:06.079Z","references":[{"source_name":"Securelist Brazilian Banking Malware July 2020","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--71c6ee18-1261-434e-aa95-e3eaad64c3e9","subject":"ATTACK:enterprise:S9059","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--71c6ee18-1261-434e-aa95-e3eaad64c3e9","modified":"2026-09-28T18:43:10.155Z","references":[{"source_name":"Mandiant_UNC1549_Feb2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--73ee6e9e-560a-42d1-8578-d5e59899dcf7","subject":"ATTACK:enterprise:S0650","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--73ee6e9e-560a-42d1-8578-d5e59899dcf7","modified":"2026-04-29T14:23:06.084Z","references":[{"source_name":"Deep Instinct Black Basta August 2022","url":"https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--74b6a6bc-5cd9-4699-aaff-a8984552e18b","subject":"ATTACK:enterprise:S1130","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--74b6a6bc-5cd9-4699-aaff-a8984552e18b","modified":"2026-04-29T14:23:06.085Z","references":[{"source_name":"HP RaspberryRobin 2024","url":"https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--76dcc038-7eee-4ab1-a776-af7ee7015d6b","subject":"ATTACK:enterprise:S1235","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--76dcc038-7eee-4ab1-a776-af7ee7015d6b","modified":"2026-04-29T14:23:06.088Z","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--77dbc1ae-556e-43cd-b776-c7670ab5c915","subject":"ATTACK:enterprise:G0081","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--77dbc1ae-556e-43cd-b776-c7670ab5c915","modified":"2026-07-31T18:47:57.246Z","references":[{"source_name":"CitizenLab KeyBoy Nov 2016","url":"https://citizenlab.ca/2016/11/parliament-keyboy/"},{"source_name":"Anomali Pirate Panda April 2020","url":"https://www.anomali.com/blog/anomali-suspects-that-china-backed-apt-pirate-panda-may-be-seeking-access-to-vietnam-government-data-center#When:15:00:00Z"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7807639f-cc9f-4b0a-9f01-8161cbb1fd53","subject":"ATTACK:enterprise:G1006","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7807639f-cc9f-4b0a-9f01-8161cbb1fd53","modified":"2026-07-31T20:48:48.260Z","references":[{"source_name":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--79460858-f878-417f-bc10-b4c962128df4","subject":"ATTACK:enterprise:S0585","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--79460858-f878-417f-bc10-b4c962128df4","modified":"2026-04-29T14:23:06.091Z","references":[{"source_name":"Unit 42 KerrDown February 2019","url":"https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7d08dd0e-97fd-4395-90cd-14070e68a247","subject":"ATTACK:enterprise:S9065","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7d08dd0e-97fd-4395-90cd-14070e68a247","modified":"2026-10-01T21:21:00.845Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7f8b1475-9e41-41d7-84f5-6c4041c4071a","subject":"ATTACK:enterprise:G1014","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7f8b1475-9e41-41d7-84f5-6c4041c4071a","modified":"2026-07-31T18:48:14.866Z","references":[{"source_name":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source_name":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--80d10b7f-e1eb-4ad0-821c-b35d177418f4","subject":"ATTACK:enterprise:S1226","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--80d10b7f-e1eb-4ad0-821c-b35d177418f4","modified":"2026-04-29T14:23:06.101Z","references":[{"source_name":"Broadcom","url":"https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia"},{"source_name":"Unit42 Bookworm Nov2015","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"},{"source_name":"Palo Alto Networks, Unit 42","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--819fa85e-041c-48a8-9d0c-2db2cd07047b","subject":"ATTACK:enterprise:S9027","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--819fa85e-041c-48a8-9d0c-2db2cd07047b","modified":"2026-04-29T14:23:06.103Z","references":[{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--838b2a37-10a1-42fe-bf71-f298ce28f81f","subject":"ATTACK:enterprise:S0530","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--838b2a37-10a1-42fe-bf71-f298ce28f81f","modified":"2026-04-29T14:23:06.105Z","references":[{"source_name":"Securelist Brazilian Banking Malware July 2020","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--861da25e-ea48-469d-8171-d63ad8194208","subject":"ATTACK:enterprise:C0057","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--861da25e-ea48-469d-8171-d63ad8194208","modified":"2026-07-31T18:47:22.575Z","references":[{"source_name":"Mandiant 3cx UNC4736 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise/"},{"source_name":"Unit42 3cx supply chain 2023","url":"https://unit42.paloaltonetworks.com/3cxdesktopapp-supply-chain-attack/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86ecb96d-516e-43eb-b22d-d7c5a9dc14d8","subject":"ATTACK:enterprise:S1101","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86ecb96d-516e-43eb-b22d-d7c5a9dc14d8","modified":"2026-04-29T14:23:06.109Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--881b3ad2-38dd-45b0-b75b-49acf6f7c6a3","subject":"ATTACK:enterprise:G0060","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--881b3ad2-38dd-45b0-b75b-49acf6f7c6a3","modified":"2026-07-31T18:48:10.659Z","references":[{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--883762ff-5cb3-49af-87a2-6a128a1ce939","subject":"ATTACK:enterprise:S0280","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--883762ff-5cb3-49af-87a2-6a128a1ce939","modified":"2026-04-29T14:23:06.111Z","references":[{"source_name":"APT15 Intezer June 2018","url":"https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8aab4a0e-fc42-4e5b-aed7-9288e5f456c3","subject":"ATTACK:enterprise:G0090","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8aab4a0e-fc42-4e5b-aed7-9288e5f456c3","modified":"2026-07-31T20:48:52.502Z","references":[{"source_name":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--92764952-45ad-4cfc-a426-c6baefc9974c","subject":"ATTACK:enterprise:M1044","predicate":"mitigates","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--92764952-45ad-4cfc-a426-c6baefc9974c","modified":"2026-04-29T14:23:06.125Z","references":[{"source_name":"Microsoft More information about DLL","url":"https://msrc-blog.microsoft.com/2010/08/23/more-information-about-the-dll-preloading-remote-attack-vector/"},{"source_name":"Microsoft Dynamic Link Library Search Order","url":"https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-search-order?redirectedfrom=MSDN"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--94ec8332-4115-4c83-900e-a72598a8680b","subject":"ATTACK:enterprise:S1183","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--94ec8332-4115-4c83-900e-a72598a8680b","modified":"2026-04-29T14:23:06.128Z","references":[{"source_name":"DCSO StrelaStealer 2022","url":"https://medium.com/@DCSO_CyTec/shortandmalicious-strelastealer-aims-for-mail-credentials-a4c3e78c8abc"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--99c0cda4-91b1-4845-9891-9a4b89c128f9","subject":"ATTACK:enterprise:G0022","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--99c0cda4-91b1-4845-9891-9a4b89c128f9","modified":"2026-07-31T18:47:38.077Z","references":[{"source_name":"FireEye Clandestine Fox","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"},{"source_name":"FireEye Clandestine Fox Part 2","url":"https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9bdcaf47-0df8-44a5-ac10-3f0a806a36f3","subject":"ATTACK:enterprise:S0194","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9bdcaf47-0df8-44a5-ac10-3f0a806a36f3","modified":"2026-04-29T14:23:06.137Z","references":[{"source_name":"GitHub PowerSploit May 2012","url":"https://github.com/PowerShellMafia/PowerSploit"},{"source_name":"PowerSploit Documentation","url":"http://powersploit.readthedocs.io"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9d2dfa0b-8370-4873-9b8f-4366e61be715","subject":"ATTACK:enterprise:G0098","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9d2dfa0b-8370-4873-9b8f-4366e61be715","modified":"2026-07-31T18:48:01.768Z","references":[{"source_name":"Trend Micro Waterbear December 2019","url":"https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9d7577f9-2003-4cbc-b7cb-58f2dc20714c","subject":"ATTACK:enterprise:S0661","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9d7577f9-2003-4cbc-b7cb-58f2dc20714c","modified":"2026-04-29T14:23:06.140Z","references":[{"source_name":"MSTIC FoggyWeb September 2021","url":"https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9eaf89d5-01aa-4758-a2a9-abac83d2a17e","subject":"ATTACK:enterprise:S0554","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9eaf89d5-01aa-4758-a2a9-abac83d2a17e","modified":"2026-04-29T14:23:06.141Z","references":[{"source_name":"Cyble Egregor Oct 2020","url":"https://cybleinc.com/2020/10/31/egregor-ransomware-a-deep-dive-into-its-activities-and-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a9830f35-1ffa-46a3-b061-07148dd09753","subject":"ATTACK:enterprise:G1016","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a9830f35-1ffa-46a3-b061-07148dd09753","modified":"2026-07-31T18:48:31.423Z","references":[{"source_name":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aa22a791-85e9-40f7-9b92-31846ac0b483","subject":"ATTACK:enterprise:S9067","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aa22a791-85e9-40f7-9b92-31846ac0b483","modified":"2026-10-01T21:54:42.657Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ac77f5ac-4a6e-4c58-a596-5e9aa6f00ff7","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ac77f5ac-4a6e-4c58-a596-5e9aa6f00ff7","modified":"2026-07-31T18:47:53.055Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"},{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"Broadcom","url":"https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia"},{"source_name":"CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024","url":"https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"},{"source_name":"Lab52 MUSTANG PANDA PUBLOAD MAY 2023","url":"https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"},{"source_name":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source_name":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"Recorded Future REDDELTA July 2020","url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"},{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"},{"source_name":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"},{"source_name":"Proofpoint TA416 November 2020","url":"https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader"},{"source_name":"Unit42 Bookworm Nov2015","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"},{"source_name":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"},{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"},{"source_name":"Zscaler","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ae48c7b6-5d12-4526-bf78-79fdf14544dc","subject":"ATTACK:enterprise:S0612","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ae48c7b6-5d12-4526-bf78-79fdf14544dc","modified":"2026-04-29T14:23:06.162Z","references":[{"source_name":"NCC Group WastedLocker June 2020","url":"https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ae75aace-822c-484e-b25c-7d5f6792928c","subject":"ATTACK:enterprise:S0538","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ae75aace-822c-484e-b25c-7d5f6792928c","modified":"2026-04-29T14:23:06.162Z","references":[{"source_name":"ESET Crutch December 2020","url":"https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--af8dcb52-7530-439a-b04d-856025f1209f","subject":"ATTACK:enterprise:S0630","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--af8dcb52-7530-439a-b04d-856025f1209f","modified":"2026-04-29T14:23:06.164Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b277ffdd-55fc-42fc-96c0-3bf395f04831","subject":"ATTACK:enterprise:G1008","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b277ffdd-55fc-42fc-96c0-3bf395f04831","modified":"2026-07-31T18:47:36.897Z","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b2ca0a15-a121-47c0-8123-b3092fe7d8d1","subject":"ATTACK:enterprise:S0631","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b2ca0a15-a121-47c0-8123-b3092fe7d8d1","modified":"2026-04-29T14:23:06.169Z","references":[{"source_name":"Cybereason Chaes Nov 2020","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b3b21563-6835-4478-a882-64ce66d5591b","subject":"ATTACK:enterprise:S1046","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b3b21563-6835-4478-a882-64ce66d5591b","modified":"2026-04-29T14:23:06.171Z","references":[{"source_name":"CYBERCOM Iranian Intel Cyber January 2022","url":"https://www.cybercom.mil/Media/News/Article/2897570/iranian-intel-cyber-suite-of-malware-uses-open-source-tools/"},{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b4ccff5c-2e5d-451d-9b32-09832aa6007c","subject":"ATTACK:enterprise:M1051","predicate":"mitigates","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b4ccff5c-2e5d-451d-9b32-09832aa6007c","modified":"2026-04-29T14:23:06.172Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b5dfef8a-32b2-481f-a55d-0bbfbebfc872","subject":"ATTACK:enterprise:S1059","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b5dfef8a-32b2-481f-a55d-0bbfbebfc872","modified":"2026-04-29T14:23:06.174Z","references":[{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b673ba9b-3eb4-42fd-976d-62fc8d121cc3","subject":"ATTACK:enterprise:M1047","predicate":"mitigates","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b673ba9b-3eb4-42fd-976d-62fc8d121cc3","modified":"2026-04-29T14:23:06.174Z","references":[{"source_name":"Microsoft Sxstrace","url":"https://docs.microsoft.com/windows-server/administration/windows-commands/sxstrace"},{"source_name":"Powersploit","url":"https://github.com/mattifestation/PowerSploit"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bc10ac94-d350-465e-871d-ba7c974dadf5","subject":"ATTACK:enterprise:S1111","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bc10ac94-d350-465e-871d-ba7c974dadf5","modified":"2026-04-29T14:23:06.182Z","references":[{"source_name":"Trellix Darkgate 2023","url":"https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bd60f2fb-ed88-424b-a394-6a23e1d8d8a9","subject":"ATTACK:enterprise:C0040","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bd60f2fb-ed88-424b-a394-6a23e1d8d8a9","modified":"2026-07-31T18:47:30.609Z","references":[{"source_name":"Google Cloud APT41 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c0042652-9caf-4723-b6e7-e9e567333005","subject":"ATTACK:enterprise:S9066","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c0042652-9caf-4723-b6e7-e9e567333005","modified":"2026-10-01T21:34:16.716Z","references":[{"source_name":"Mandiant_UNC1549_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c1296428-d36e-4ee0-9afc-5761d64cf1e7","subject":"ATTACK:enterprise:G1034","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c1296428-d36e-4ee0-9afc-5761d64cf1e7","modified":"2026-07-31T18:48:27.175Z","references":[{"source_name":"ESET EvasivePanda 2024","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"},{"source_name":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c424814f-ac8b-4e4d-9fd5-d57d193e59a8","subject":"ATTACK:enterprise:S1097","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c424814f-ac8b-4e4d-9fd5-d57d193e59a8","modified":"2026-04-29T14:23:06.193Z","references":[{"source_name":"SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022","url":"https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c8434ee2-f60f-48c4-a2d5-2576257a8387","subject":"ATTACK:enterprise:S0663","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c8434ee2-f60f-48c4-a2d5-2576257a8387","modified":"2026-04-29T14:23:06.199Z","references":[{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c8918b3d-8f45-4b43-b0c4-af8aa094d20f","subject":"ATTACK:enterprise:G1059","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c8918b3d-8f45-4b43-b0c4-af8aa094d20f","modified":"2026-10-01T21:12:16.309Z","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"},{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"},{"source_name":"Mandiant_UNC1549_Feb2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ca096580-4153-4d47-ae46-2de54a033396","subject":"ATTACK:enterprise:G1054","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ca096580-4153-4d47-ae46-2de54a033396","modified":"2026-07-31T18:48:08.986Z","references":[{"source_name":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"Kaspersky LODEINFO OCT 2022","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"},{"source_name":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"},{"source_name":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cbf9284f-2f47-4d1f-b708-861b0e1e85b5","subject":"ATTACK:enterprise:S0477","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cbf9284f-2f47-4d1f-b708-861b0e1e85b5","modified":"2026-04-29T14:23:06.204Z","references":[{"source_name":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ccdff6e8-75ea-4386-ab0f-435ac35ccc61","subject":"ATTACK:enterprise:T1574.001","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1574","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ccdff6e8-75ea-4386-ab0f-435ac35ccc61","modified":"2026-09-02T18:05:13.253Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d186a22f-f42e-43f4-b161-36f2d1714f04","subject":"ATTACK:enterprise:S0624","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d186a22f-f42e-43f4-b161-36f2d1714f04","modified":"2026-04-29T14:23:06.212Z","references":[{"source_name":"Securelist APT10 March 2021","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d289c197-78e6-4262-9163-201ef17b6f41","subject":"ATTACK:enterprise:S1102","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d289c197-78e6-4262-9163-201ef17b6f41","modified":"2026-04-29T14:23:06.213Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d3b541d4-e179-4595-ba6b-d643ee6398f2","subject":"ATTACK:enterprise:S1237","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d3b541d4-e179-4595-ba6b-d643ee6398f2","modified":"2026-04-29T14:23:06.215Z","references":[{"source_name":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d4657411-8fa6-4bbc-9ed0-474eafd14375","subject":"ATTACK:enterprise:G0019","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d4657411-8fa6-4bbc-9ed0-474eafd14375","modified":"2026-07-31T18:47:46.417Z","references":[{"source_name":"CheckPoint Naikon May 2020","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d4812772-93e3-4148-9a5f-b62c02cfa8cb","subject":"ATTACK:enterprise:S9025","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d4812772-93e3-4148-9a5f-b62c02cfa8cb","modified":"2026-04-29T14:23:06.216Z","references":[{"source_name":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source_name":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d6361b85-f248-462c-a0d4-409c04dadeb5","subject":"ATTACK:enterprise:S1230","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d6361b85-f248-462c-a0d4-409c04dadeb5","modified":"2026-04-29T14:23:06.218Z","references":[{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--daf75556-254a-41af-960d-5b1012c739e3","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--daf75556-254a-41af-960d-5b1012c739e3","modified":"2026-07-31T20:48:47.221Z","references":[{"source_name":"ASEC Lazarus 2022","url":"https://asec.ahnlab.com/en/39828/"},{"source_name":"ESET Twitter Ida Pro Nov 2021","url":"https://x.com/ESETresearch/status/1458438155149922312"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--db13473b-3541-4be6-a5ad-042e83b37e3e","subject":"ATTACK:enterprise:C0012","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--db13473b-3541-4be6-a5ad-042e83b37e3e","modified":"2026-07-31T18:47:28.659Z","references":[{"source_name":"Cybereason OperationCuckooBees May 2022","url":"https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dc0cf30b-ec44-4b5a-8c45-f93e48974a05","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dc0cf30b-ec44-4b5a-8c45-f93e48974a05","modified":"2026-04-29T14:23:06.226Z","references":[{"source_name":"ESET InvisiMole June 2018","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ded88ab1-321a-475c-9539-16e3bb292379","subject":"ATTACK:enterprise:S9026","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ded88ab1-321a-475c-9539-16e3bb292379","modified":"2026-04-29T14:23:06.229Z","references":[{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"},{"source_name":"Trend Micro Earth Kasha Updates APR 2025","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e2b750e7-ad43-4e27-96a1-9bdb0e886a72","subject":"ATTACK:enterprise:S0354","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e2b750e7-ad43-4e27-96a1-9bdb0e886a72","modified":"2026-04-29T14:23:06.234Z","references":[{"source_name":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e3674f09-f242-4821-bab6-c9c322646735","subject":"ATTACK:enterprise:S1233","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e3674f09-f242-4821-bab6-c9c322646735","modified":"2026-04-29T14:23:06.235Z","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e4e2d35b-83fb-4515-b531-576acb02e1a5","subject":"ATTACK:enterprise:G0027","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e4e2d35b-83fb-4515-b531-576acb02e1a5","modified":"2026-07-31T18:48:29.849Z","references":[{"source_name":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"},{"source_name":"Lunghi Iron Tiger Linux","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"},{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source_name":"Unit42 Emissary Panda May 2019","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"},{"source_name":"Securelist LuckyMouse June 2018","url":"https://securelist.com/luckymouse-hits-national-data-center/86083/"},{"source_name":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e4fe7d70-a0c9-4d2b-ba4a-0d6bc2e08f0e","subject":"ATTACK:enterprise:G0135","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e4fe7d70-a0c9-4d2b-ba4a-0d6bc2e08f0e","modified":"2026-07-31T18:48:11.430Z","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e575c5f9-c9ff-4b84-920a-c483d9442c3a","subject":"ATTACK:enterprise:M1013","predicate":"mitigates","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e575c5f9-c9ff-4b84-920a-c483d9442c3a","modified":"2026-04-29T14:23:06.237Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eb6ffb36-38cf-44d9-aaba-7c551b099d65","subject":"ATTACK:enterprise:S0629","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eb6ffb36-38cf-44d9-aaba-7c551b099d65","modified":"2026-04-29T14:23:06.246Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ee1f163e-7d9b-449a-ba71-0d0091abfb8a","subject":"ATTACK:enterprise:S0415","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ee1f163e-7d9b-449a-ba71-0d0091abfb8a","modified":"2026-04-29T14:23:06.249Z","references":[{"source_name":"FireEye FIN7 Oct 2019","url":"https://www.fireeye.com/blog/threat-research/2019/10/mahalo-fin7-responding-to-new-tools-and-techniques.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f044fed9-e7d4-4cb2-938b-d89fd8b0c06c","subject":"ATTACK:enterprise:S0660","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f044fed9-e7d4-4cb2-938b-d89fd8b0c06c","modified":"2026-04-29T14:23:06.252Z","references":[{"source_name":"Talent-Jump Clambling February 2020","url":"https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/"},{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f0e2c414-9356-4eb6-89d5-fe1afb62780f","subject":"ATTACK:enterprise:S0662","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f0e2c414-9356-4eb6-89d5-fe1afb62780f","modified":"2026-04-29T14:23:06.253Z","references":[{"source_name":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source_name":"Profero APT27 December 2020","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"},{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f2b3374e-d2b4-489a-9c8a-92630ce9b428","subject":"ATTACK:enterprise:S0363","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f2b3374e-d2b4-489a-9c8a-92630ce9b428","modified":"2026-04-29T14:23:06.255Z","references":[{"source_name":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f318a490-68df-41ee-864e-8611be36c442","subject":"ATTACK:enterprise:S1063","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f318a490-68df-41ee-864e-8611be36c442","modified":"2026-04-29T14:23:06.255Z","references":[{"source_name":"Palo Alto Brute Ratel July 2022","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f35a3ca7-b916-4bc2-a493-613196b5d41e","subject":"ATTACK:enterprise:G0073","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f35a3ca7-b916-4bc2-a493-613196b5d41e","modified":"2026-07-31T18:48:31.217Z","references":[{"source_name":"Unit 42 C0d0so0 Jan 2016","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f4f5b6a4-26d5-4352-a25d-001a51a0a121","subject":"ATTACK:enterprise:S0134","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f4f5b6a4-26d5-4352-a25d-001a51a0a121","modified":"2026-04-29T14:23:06.258Z","references":[{"source_name":"ESET Sednit Part 3","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fd517b0b-fd57-4d9a-a4e1-47cd7d4f0d11","subject":"ATTACK:enterprise:S9050","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fd517b0b-fd57-4d9a-a4e1-47cd7d4f0d11","modified":"2026-09-25T16:56:21.719Z","references":[{"source_name":"Intrinsec_Vidar_April2026","url":"https://www.intrinsec.com/wp-content/uploads/2026/04/TLP_CLEAR-20260424-New_Vidar.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fdbb45a4-1151-4c21-909c-1c653c883544","subject":"ATTACK:enterprise:S0582","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fdbb45a4-1151-4c21-909c-1c653c883544","modified":"2026-04-29T14:23:06.270Z","references":[{"source_name":"Proofpoint LookBack Malware Aug 2019","url":"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fe9d5dc8-d96e-40a2-a715-8331c56322d7","subject":"ATTACK:enterprise:G0099","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fe9d5dc8-d96e-40a2-a715-8331c56322d7","modified":"2026-07-31T18:48:18.940Z","references":[{"source_name":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ff49e4df-4693-4df5-adf8-15e765963155","subject":"ATTACK:enterprise:G0121","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ff49e4df-4693-4df5-adf8-15e765963155","modified":"2026-07-31T18:47:52.241Z","references":[{"source_name":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ffacfdd1-702e-4bb9-b60c-8e5c4cdf2a06","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ffacfdd1-702e-4bb9-b60c-8e5c4cdf2a06","modified":"2026-07-31T20:48:27.712Z","references":[{"source_name":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source_name":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ffee4cd1-f193-4dbc-9f47-6fe47e1523eb","subject":"ATTACK:enterprise:G0045","predicate":"uses","object":"ATTACK:enterprise:T1574.001","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ffee4cd1-f193-4dbc-9f47-6fe47e1523eb","modified":"2026-07-31T18:47:44.929Z","references":[{"source_name":"FireEye APT10 Sept 2018","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"},{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source_name":"PWC Cloud Hopper April 2017","url":"https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"},{"source_name":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}