{"record":{"id":"ATTACK:enterprise:T1588.002","title":"Tool","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1588/002","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--a2fdce72-04b2-409a-ac10-cc1695f4fce0","external_id":"T1588.002","domain":"enterprise","created":"2020-10-01T02:08:33.977Z","modified":"2026-05-12T15:12:00.706Z","version":"1.2","aliases":[],"tactics":["resource-development"],"source_references":[{"source_name":"Sentinel Labs Top Tier Target 2025","url":"https://www.sentinelone.com/labs/top-tier-target-what-it-takes-to-defend-a-cybersecurity-company-from-todays-adversaries/"},{"source_name":"Analyzing CS Dec 2020","url":"https://www.randhome.io/blog/2020/12/20/analyzing-cobalt-strike-for-fun-and-profit/"},{"source_name":"Recorded Future Beacon 2019","url":"https://www.recordedfuture.com/blog/identifying-cobalt-strike-servers"},{"source_name":"Forescout Conti Leaks 2022","url":"https://www.forescout.com/resources/analysis-of-conti-leaks/"}]},"assertions":[{"id":"enterprise:relationship--0937991f-a349-4d87-96b4-856ed2c13f97","subject":"ATTACK:enterprise:C0060","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0937991f-a349-4d87-96b4-856ed2c13f97","modified":"2026-07-31T18:47:26.774Z","references":[{"source_name":"ESET MirrorFace 2025","url":"https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0b3809c3-78a5-4121-9b51-64a9dfa60b11","subject":"ATTACK:enterprise:G0105","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0b3809c3-78a5-4121-9b51-64a9dfa60b11","modified":"2026-07-31T18:48:05.108Z","references":[{"source_name":"Securelist DarkVishnya Dec 2018","url":"https://securelist.com/darkvishnya/89169/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0b512662-8eb8-424d-99c5-4f76d1d70276","subject":"ATTACK:enterprise:G0010","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0b512662-8eb8-424d-99c5-4f76d1d70276","modified":"2026-07-31T18:48:03.543Z","references":[{"source_name":"Symantec Waterbug Jun 2019","url":"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0dbf8a74-0b7d-4bb3-b20d-ab31a40d9163","subject":"ATTACK:enterprise:C0032","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0dbf8a74-0b7d-4bb3-b20d-ab31a40d9163","modified":"2026-07-31T18:47:25.808Z","references":[{"source_name":"FireEye TRITON 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--108b7d74-30a7-40ec-997e-b47c62a5f6e7","subject":"ATTACK:enterprise:G0100","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--108b7d74-30a7-40ec-997e-b47c62a5f6e7","modified":"2026-07-31T18:48:25.014Z","references":[{"source_name":"Kaspersky Cloud Atlas August 2019","url":"https://securelist.com/recent-cloud-atlas-activity/92016/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1134f983-3ad3-4c79-baaa-f604ac9dc642","subject":"ATTACK:enterprise:G0059","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1134f983-3ad3-4c79-baaa-f604ac9dc642","modified":"2026-07-31T18:48:28.140Z","references":[{"source_name":"Check Point Rocket Kitten","url":"https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf"},{"source_name":"Check Point APT35 CharmPower January 2022","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"},{"source_name":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source_name":"FireEye APT35 2018","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"},{"source_name":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--13a41ddf-24f2-4c73-a047-7093f94a2573","subject":"ATTACK:enterprise:C0005","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--13a41ddf-24f2-4c73-a047-7093f94a2573","modified":"2026-07-31T18:47:22.168Z","references":[{"source_name":"ESET Operation Spalax Jan 2021","url":"https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--13b6f054-5771-43ef-84df-b05ec9001f23","subject":"ATTACK:enterprise:G1002","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--13b6f054-5771-43ef-84df-b05ec9001f23","modified":"2026-07-31T20:48:39.497Z","references":[{"source_name":"Forcepoint BITTER Pakistan Oct 2016","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--164bf82a-10bf-4a6d-b43c-70ff11f60229","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--164bf82a-10bf-4a6d-b43c-70ff11f60229","modified":"2026-07-31T20:48:24.502Z","references":[{"source_name":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"Netscout Stolen Pencil Dec 2018","url":"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"},{"source_name":"Mandiant APT43 March 2024","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--17738bdd-24b9-44d0-a897-d1b861fd2636","subject":"ATTACK:enterprise:G0098","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--17738bdd-24b9-44d0-a897-d1b861fd2636","modified":"2026-07-31T18:48:01.574Z","references":[{"source_name":"Symantec Palmerworm Sep 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--17c0d0d3-b57d-434d-9404-1e67414a4da5","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--17c0d0d3-b57d-434d-9404-1e67414a4da5","modified":"2026-07-31T20:48:29.636Z","references":[{"source_name":"ESET_MuddyWater_Dec2025","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"},{"source_name":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"},{"source_name":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"},{"source_name":"group-ib_muddywater_infra","url":"https://www.group-ib.com/blog/muddywater-infrastructure/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1aa34972-7bed-4e2d-bf72-b7352677de60","subject":"ATTACK:enterprise:G1004","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1aa34972-7bed-4e2d-bf72-b7352677de60","modified":"2026-07-31T20:48:49.275Z","references":[{"source_name":"NCC Group LAPSUS Apr 2022","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"},{"source_name":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e7a35d2-4fbf-4e9c-8ad4-c21634540cbb","subject":"ATTACK:enterprise:C0030","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e7a35d2-4fbf-4e9c-8ad4-c21634540cbb","modified":"2026-07-31T20:48:14.124Z","references":[{"source_name":"FireEye TEMP.Veles 2018","url":"https://web.archive.org/web/20190202205824/https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1e902f51-efe0-4848-b47a-7e1a1664b101","subject":"ATTACK:enterprise:G0077","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1e902f51-efe0-4848-b47a-7e1a1664b101","modified":"2026-07-31T18:47:48.986Z","references":[{"source_name":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--20a02fc6-3cce-4ce6-bf76-2f82c2a88232","subject":"ATTACK:enterprise:M1056","predicate":"mitigates","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--20a02fc6-3cce-4ce6-bf76-2f82c2a88232","modified":"2026-04-29T14:23:05.949Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2370fba0-1d66-4aad-ac01-fb63857b7732","subject":"ATTACK:enterprise:G0016","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2370fba0-1d66-4aad-ac01-fb63857b7732","modified":"2026-07-31T18:48:07.455Z","references":[{"source_name":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"},{"source_name":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"},{"source_name":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--23aad43d-0475-407c-ac15-c654ca40273e","subject":"ATTACK:enterprise:G1051","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--23aad43d-0475-407c-ac15-c654ca40273e","modified":"2026-07-31T18:48:10.137Z","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--242de5f8-7944-4fdd-af87-a5da0050e7c3","subject":"ATTACK:enterprise:G0007","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--242de5f8-7944-4fdd-af87-a5da0050e7c3","modified":"2026-07-31T20:48:44.528Z","references":[{"source_name":"Securelist Sofacy Feb 2018","url":"https://securelist.com/a-slice-of-2017-sofacy-activity/83930/"},{"source_name":"Palo Alto Sofacy 06-2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"},{"source_name":"FireEye APT28 Hospitality Aug 2017","url":"https://web.archive.org/web/20171202185937/https://www.fireeye.com/blog/threat-research/2017/08/apt28-targets-hospitality-sector.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--260a6771-1b29-49b6-ad42-6c43e68b11dc","subject":"ATTACK:enterprise:G0102","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--260a6771-1b29-49b6-ad42-6c43e68b11dc","modified":"2026-07-31T20:48:50.064Z","references":[{"source_name":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"},{"source_name":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2cb496c7-81ed-423b-8564-8db1c8a2078f","subject":"ATTACK:enterprise:G1046","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2cb496c7-81ed-423b-8564-8db1c8a2078f","modified":"2026-07-31T18:47:47.816Z","references":[{"source_name":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"},{"source_name":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--312f2cb6-8528-4404-857a-c8c685d7e179","subject":"ATTACK:enterprise:C0062","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--312f2cb6-8528-4404-857a-c8c685d7e179","modified":"2026-07-31T18:47:24.183Z","references":[{"source_name":"Anthropic AI Orchestrated Campaign NOV 2025","url":"https://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--321a0d18-11a6-4504-add5-8ee515a43170","subject":"ATTACK:enterprise:G0060","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--321a0d18-11a6-4504-add5-8ee515a43170","modified":"2026-07-31T18:48:10.325Z","references":[{"source_name":"Symantec Tick Apr 2016","url":"https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--34ff9bfb-0b3a-4b83-af85-60700ed052f4","subject":"ATTACK:enterprise:G0045","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--34ff9bfb-0b3a-4b83-af85-60700ed052f4","modified":"2026-07-31T18:47:43.700Z","references":[{"source_name":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--35f5f7b9-8b86-4390-9f99-1d56aa1ae32a","subject":"ATTACK:enterprise:G0096","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--35f5f7b9-8b86-4390-9f99-1d56aa1ae32a","modified":"2026-07-31T20:48:26.938Z","references":[{"source_name":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--37d9aa25-a250-45a2-913f-14bd906fb130","subject":"ATTACK:enterprise:G1015","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--37d9aa25-a250-45a2-913f-14bd906fb130","modified":"2026-07-31T20:48:34.165Z","references":[{"source_name":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source_name":"Check Point Scattered Spider JUL 2025","url":"https://blog.checkpoint.com/research/exposing-scattered-spider-new-indicators-highlight-growing-threat-to-enterprises-and-aviation/"},{"source_name":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"},{"source_name":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3a20f6f1-0e1b-4d8e-8461-eb41e4c6b5da","subject":"ATTACK:enterprise:G0061","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3a20f6f1-0e1b-4d8e-8461-eb41e4c6b5da","modified":"2026-07-31T18:48:29.476Z","references":[{"source_name":"Bitdefender Sardonic Aug 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3e6b6ed9-4c28-4dd0-903a-360f57864de4","subject":"ATTACK:enterprise:G0092","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3e6b6ed9-4c28-4dd0-903a-360f57864de4","modified":"2026-07-31T18:48:05.405Z","references":[{"source_name":"NCC Group TA505","url":"https://research.nccgroup.com/2020/11/18/ta505-a-brief-history-of-their-time/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3e91f49c-5342-49d8-8105-7ab17c5ef9f4","subject":"ATTACK:enterprise:G0087","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3e91f49c-5342-49d8-8105-7ab17c5ef9f4","modified":"2026-07-31T18:47:53.380Z","references":[{"source_name":"IBM ITG07 June 2019","url":"https://securityintelligence.com/posts/observations-of-itg07-cyber-operations/"},{"source_name":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3faaf140-71cd-4cc2-91c9-f0980ca72079","subject":"ATTACK:enterprise:G0093","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3faaf140-71cd-4cc2-91c9-f0980ca72079","modified":"2026-07-31T18:47:37.145Z","references":[{"source_name":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--406e78ba-fc34-4be9-9dcc-323aad40d709","subject":"ATTACK:enterprise:G0003","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--406e78ba-fc34-4be9-9dcc-323aad40d709","modified":"2026-07-31T18:48:08.573Z","references":[{"source_name":"Cylance Cleaver","url":"https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--41e2d922-5014-479d-85ba-da70ad6aa44b","subject":"ATTACK:enterprise:G0135","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--41e2d922-5014-479d-85ba-da70ad6aa44b","modified":"2026-07-31T18:48:11.208Z","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--508c012e-c578-472d-8225-51bc8c0dff87","subject":"ATTACK:enterprise:G1021","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--508c012e-c578-472d-8225-51bc8c0dff87","modified":"2026-07-31T18:48:07.789Z","references":[{"source_name":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"},{"source_name":"SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022","url":"https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--526837ff-672d-4afa-899e-3634b19bab14","subject":"ATTACK:enterprise:G0049","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--526837ff-672d-4afa-899e-3634b19bab14","modified":"2026-07-31T20:48:35.463Z","references":[{"source_name":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"},{"source_name":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--54aae76b-14fe-47e9-86c8-bd39317429c3","subject":"ATTACK:enterprise:G1018","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--54aae76b-14fe-47e9-86c8-bd39317429c3","modified":"2026-07-31T18:47:55.262Z","references":[{"source_name":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5614b582-eeed-4a52-a2e0-2f756f03e26c","subject":"ATTACK:enterprise:G0037","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5614b582-eeed-4a52-a2e0-2f756f03e26c","modified":"2026-07-31T20:48:30.868Z","references":[{"source_name":"Security Intelligence More Eggs Aug 2019","url":"https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"},{"source_name":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--59116a0e-f23b-43ec-8b25-fbad5043344a","subject":"ATTACK:enterprise:G0034","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--59116a0e-f23b-43ec-8b25-fbad5043344a","modified":"2026-07-31T20:48:32.918Z","references":[{"source_name":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"},{"source_name":"mandiant_apt44_unearthing_sandworm","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"},{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5eba2b01-da0d-4340-816b-16a4f3cc8ba6","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5eba2b01-da0d-4340-816b-16a4f3cc8ba6","modified":"2026-07-31T20:48:26.301Z","references":[{"source_name":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5f0b2cd5-125e-4473-8623-5f5a7dc09caf","subject":"ATTACK:enterprise:G0046","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5f0b2cd5-125e-4473-8623-5f5a7dc09caf","modified":"2026-07-31T20:48:31.930Z","references":[{"source_name":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5f3f6350-5e69-4b50-a0c7-c1f04ae85976","subject":"ATTACK:enterprise:C0012","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5f3f6350-5e69-4b50-a0c7-c1f04ae85976","modified":"2026-07-31T18:47:28.266Z","references":[{"source_name":"Cybereason OperationCuckooBees May 2022","url":"https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5ff56332-1e9e-4853-baae-5918e41882ac","subject":"ATTACK:enterprise:G1014","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5ff56332-1e9e-4853-baae-5918e41882ac","modified":"2026-07-31T18:48:14.804Z","references":[{"source_name":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--612d9ccc-07ab-44fd-b970-869e9a730b02","subject":"ATTACK:enterprise:G1041","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--612d9ccc-07ab-44fd-b970-869e9a730b02","modified":"2026-07-31T18:47:57.605Z","references":[{"source_name":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--61ede1a5-e9e1-402b-8a64-11e9a3136675","subject":"ATTACK:enterprise:G1054","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--61ede1a5-e9e1-402b-8a64-11e9a3136675","modified":"2026-07-31T18:48:08.639Z","references":[{"source_name":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source_name":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--643bfb16-2424-4ea6-b571-bac78c913c9a","subject":"ATTACK:enterprise:G1059","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--643bfb16-2424-4ea6-b571-bac78c913c9a","modified":"2026-10-01T20:58:47.605Z","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--644bfb9b-0555-45e9-a967-c6bedcc05e88","subject":"ATTACK:enterprise:C0002","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--644bfb9b-0555-45e9-a967-c6bedcc05e88","modified":"2026-07-31T18:47:30.911Z","references":[{"source_name":"McAfee Night Dragon","url":"https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6c89f28c-963b-44ef-8dda-5916aa17b7e9","subject":"ATTACK:enterprise:G0099","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6c89f28c-963b-44ef-8dda-5916aa17b7e9","modified":"2026-07-31T18:48:18.542Z","references":[{"source_name":"Check Point Blind Eagle MAR 2025","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"},{"source_name":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6e20b61f-bf7e-40a3-b7b9-98d79e5a3ecd","subject":"ATTACK:enterprise:G0090","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6e20b61f-bf7e-40a3-b7b9-98d79e5a3ecd","modified":"2026-07-31T20:48:52.459Z","references":[{"source_name":"Lab52 WIRTE Apr 2019","url":"https://lab52.io/blog/wirte-group-attacking-the-middle-east/"},{"source_name":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6ef45519-7ca1-44a4-8421-152af4e85d68","subject":"ATTACK:enterprise:G1057","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6ef45519-7ca1-44a4-8421-152af4e85d68","modified":"2026-07-31T18:47:58.839Z","references":[{"source_name":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"},{"source_name":"Unit42KelleyVaya_BlingLibra_Aug2024","url":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"},{"source_name":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--714e1860-5ce1-4d5a-b611-89fbcdb7fbb2","subject":"ATTACK:enterprise:G1052","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--714e1860-5ce1-4d5a-b611-89fbcdb7fbb2","modified":"2026-07-31T18:47:54.642Z","references":[{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"SecurityScorecard Contagious Interview October 2024","url":"https://securityscorecard.com/blog/inside-a-north-korean-phishing-operation-targeting-devops-employees/"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source_name":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--72b81f9e-8760-4d46-9ed3-4b91b12f6299","subject":"ATTACK:enterprise:G1016","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--72b81f9e-8760-4d46-9ed3-4b91b12f6299","modified":"2026-07-31T18:48:31.116Z","references":[{"source_name":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--72faebbd-f228-478b-a9aa-21e006acfc9c","subject":"ATTACK:enterprise:G0129","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--72faebbd-f228-478b-a9aa-21e006acfc9c","modified":"2026-07-31T18:47:52.627Z","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7363ed1a-6f75-4ded-9179-2fdba17f6cf1","subject":"ATTACK:enterprise:G0080","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7363ed1a-6f75-4ded-9179-2fdba17f6cf1","modified":"2026-07-31T18:48:23.045Z","references":[{"source_name":"PTSecurity Cobalt Dec 2016","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--747f1dcd-7af4-4a38-983b-e2d6108af677","subject":"ATTACK:enterprise:C0021","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--747f1dcd-7af4-4a38-983b-e2d6108af677","modified":"2026-07-31T18:47:24.425Z","references":[{"source_name":"FireEye APT29 Nov 2018","url":"https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html"},{"source_name":"Microsoft Unidentified Dec 2018","url":"https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--757be841-a218-4d0e-bbe3-a138eea7692e","subject":"ATTACK:enterprise:T1588.002","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1588","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--757be841-a218-4d0e-bbe3-a138eea7692e","modified":"2026-04-29T14:23:06.086Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--77f919ce-1a18-4ee5-9979-1c9b818ca973","subject":"ATTACK:enterprise:G0004","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--77f919ce-1a18-4ee5-9979-1c9b818ca973","modified":"2026-07-31T18:48:01.203Z","references":[{"source_name":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7b050e9f-ab8e-4860-aae9-4a37e18efbe2","subject":"ATTACK:enterprise:G0027","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7b050e9f-ab8e-4860-aae9-4a37e18efbe2","modified":"2026-07-31T18:48:29.212Z","references":[{"source_name":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source_name":"Unit42 Emissary Panda May 2019","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7b2e912e-4561-4edc-87fe-11f9e259a5a9","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7b2e912e-4561-4edc-87fe-11f9e259a5a9","modified":"2026-07-31T20:48:46.872Z","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7c240038-5599-418a-83e4-6d9962eee0bd","subject":"ATTACK:enterprise:G0053","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7c240038-5599-418a-83e4-6d9962eee0bd","modified":"2026-07-31T20:48:40.291Z","references":[{"source_name":"Mandiant FIN5 GrrCON Oct 2016","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7e2a54af-5e8f-4431-810d-7fcaa4c1eca0","subject":"ATTACK:enterprise:C0045","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7e2a54af-5e8f-4431-810d-7fcaa4c1eca0","modified":"2026-07-31T18:47:23.472Z","references":[{"source_name":"Oligo ShadowRay Campaign MAR 2024","url":"https://www.oligo.security/blog/shadowray-attack-ai-workloads-actively-exploited-in-the-wild"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7eecb510-7937-40d2-b491-7d9165b5afc1","subject":"ATTACK:enterprise:G0076","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7eecb510-7937-40d2-b491-7d9165b5afc1","modified":"2026-07-31T18:48:22.119Z","references":[{"source_name":"Symantec Thrip June 2018","url":"https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8019fbd7-b72e-42aa-8685-60e8138db932","subject":"ATTACK:enterprise:G1009","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8019fbd7-b72e-42aa-8685-60e8138db932","modified":"2026-07-31T18:47:55.595Z","references":[{"source_name":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8127487a-15fd-4802-8537-ddb2f72e72fd","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8127487a-15fd-4802-8537-ddb2f72e72fd","modified":"2026-07-31T18:47:31.709Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83b4190b-31aa-4f90-a397-624b89fb2f6f","subject":"ATTACK:enterprise:C0004","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83b4190b-31aa-4f90-a397-624b89fb2f6f","modified":"2026-07-31T18:47:34.405Z","references":[{"source_name":"BlackBerry CostaRicto November 2020","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--84a7d204-857f-43dd-8876-215b7a946ed1","subject":"ATTACK:enterprise:G1005","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--84a7d204-857f-43dd-8876-215b7a946ed1","modified":"2026-07-31T18:47:58.745Z","references":[{"source_name":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86169d65-b154-402d-918c-4b4602d71cd0","subject":"ATTACK:enterprise:G0011","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86169d65-b154-402d-918c-4b4602d71cd0","modified":"2026-07-31T20:48:53.803Z","references":[{"source_name":"Bizeul 2014","url":"https://web.archive.org/web/20200921155301/https://airbus-cyber-security.com/the-eye-of-the-tiger/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86a7e0a4-4fbd-4355-9428-f0b79249d225","subject":"ATTACK:enterprise:G1001","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86a7e0a4-4fbd-4355-9428-f0b79249d225","modified":"2026-07-31T20:48:51.822Z","references":[{"source_name":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"},{"source_name":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"},{"source_name":"Zscaler Lyceum DnsSystem June 2022","url":"https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--887df999-b039-4056-b0cc-d89cb09deeb5","subject":"ATTACK:enterprise:C0048","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--887df999-b039-4056-b0cc-d89cb09deeb5","modified":"2026-07-31T18:47:20.960Z","references":[{"source_name":"Volexity UPSTYLE 2024","url":"https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8b65bc11-9b56-4eca-9fa2-efb7ffcbb94b","subject":"ATTACK:enterprise:G0107","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8b65bc11-9b56-4eca-9fa2-efb7ffcbb94b","modified":"2026-07-31T18:48:14.571Z","references":[{"source_name":"Symantec Whitefly March 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8ff5abd9-8bbe-4fab-8001-23b2973c0764","subject":"ATTACK:enterprise:G0030","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8ff5abd9-8bbe-4fab-8001-23b2973c0764","modified":"2026-07-31T18:48:07.062Z","references":[{"source_name":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9292d1e2-562f-4cda-a5f4-4ed6406e8b78","subject":"ATTACK:enterprise:G0051","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9292d1e2-562f-4cda-a5f4-4ed6406e8b78","modified":"2026-07-31T18:48:28.815Z","references":[{"source_name":"FireEye FIN10 June 2017","url":"https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--93cd8b4b-1d7a-4eeb-8ade-b5b9aaf936ec","subject":"ATTACK:enterprise:C0059","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--93cd8b4b-1d7a-4eeb-8ade-b5b9aaf936ec","modified":"2026-07-31T20:48:18.298Z","references":[{"source_name":"FBI Salesforce Data Theft SEP 2025","url":"https://www.ic3.gov/CSA/2025/250912.pdf"},{"source_name":"Google Salesforce JUN 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9ab8569f-3b5a-455b-880f-10d29cbae970","subject":"ATTACK:enterprise:G1032","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9ab8569f-3b5a-455b-880f-10d29cbae970","modified":"2026-07-31T20:48:47.714Z","references":[{"source_name":"Huntress INC Ransomware May 2024","url":"https://www.huntress.com/blog/lolbin-to-inc-ransomware"},{"source_name":"Cybereason INC Ransomware November 2023","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"},{"source_name":"SentinelOne INC Ransomware","url":"https://www.sentinelone.com/anthology/inc-ransom/"},{"source_name":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"},{"source_name":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9b363538-86e1-446a-a4f8-b3045a7e8f68","subject":"ATTACK:enterprise:G0035","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9b363538-86e1-446a-a4f8-b3045a7e8f68","modified":"2026-07-31T20:48:28.540Z","references":[{"source_name":"Secureworks IRON LIBERTY July 2019","url":"https://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9bab41c7-1581-4c51-9119-6a5e29445979","subject":"ATTACK:enterprise:G0136","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9bab41c7-1581-4c51-9119-6a5e29445979","modified":"2026-07-31T18:48:24.356Z","references":[{"source_name":"Checkpoint IndigoZebra July 2021","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"},{"source_name":"Securelist APT Trends Q2 2017","url":"https://securelist.com/apt-trends-report-q2-2017/79332/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9e2b7623-69e9-4c03-a4da-df281e99f663","subject":"ATTACK:enterprise:G0143","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9e2b7623-69e9-4c03-a4da-df281e99f663","modified":"2026-07-31T18:47:59.459Z","references":[{"source_name":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a499a9d0-7508-4b1c-83cd-748d21c34682","subject":"ATTACK:enterprise:G1058","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a499a9d0-7508-4b1c-83cd-748d21c34682","modified":"2026-09-22T18:52:49.841Z","references":[{"source_name":"BradyUnit42_TheGentlemen_July2026","url":"https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/"},{"source_name":"Intel471_TheGentlemen_Aug2026","url":"https://www.intel471.com/blog/threat-hunting-case-study-the-gentlemen"},{"source_name":"TrendAI_TheGentlemen_Sept2025","url":"https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware"},{"source_name":"Sophos_TheGentlemen_Sept2026","url":"https://www.sophos.com/en-gb/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation"},{"source_name":"SoučekESET_Gentlemen_Jun2026","url":"https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a6ff725c-1c60-44dd-8f78-22f1b009bbb5","subject":"ATTACK:enterprise:G1007","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a6ff725c-1c60-44dd-8f78-22f1b009bbb5","modified":"2026-07-31T18:47:59.556Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a7213656-7166-4b88-8d32-f388a2ef1671","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a7213656-7166-4b88-8d32-f388a2ef1671","modified":"2026-07-31T20:48:23.326Z","references":[{"source_name":"ESET Lazarus KillDisk April 2018","url":"https://www.welivesecurity.com/2018/04/03/lazarus-killdisk-central-american-casino/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a8fef3c0-796a-4995-81fe-c47336c3ddbd","subject":"ATTACK:enterprise:G1006","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a8fef3c0-796a-4995-81fe-c47336c3ddbd","modified":"2026-07-31T20:48:48.333Z","references":[{"source_name":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--aa82f131-3eeb-4d1a-9f2e-bb2efcc7470b","subject":"ATTACK:enterprise:G0064","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--aa82f131-3eeb-4d1a-9f2e-bb2efcc7470b","modified":"2026-07-31T20:48:53.206Z","references":[{"source_name":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"},{"source_name":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b1a5dcb8-85f6-4788-a9c5-6f3525615891","subject":"ATTACK:enterprise:G1055","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b1a5dcb8-85f6-4788-a9c5-6f3525615891","modified":"2026-07-31T18:48:25.860Z","references":[{"source_name":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b6f6b1e0-8e37-4f0a-b506-66537d3f0ff0","subject":"ATTACK:enterprise:C0022","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b6f6b1e0-8e37-4f0a-b506-66537d3f0ff0","modified":"2026-07-31T21:14:22.820Z","references":[{"source_name":"ESET Lazarus Jun 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_Operation_Interception.pdf"},{"source_name":"ClearSky Lazarus Aug 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ba29bbf3-4947-4676-98c4-13bf6fb79ce0","subject":"ATTACK:enterprise:G0137","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ba29bbf3-4947-4676-98c4-13bf6fb79ce0","modified":"2026-07-31T18:47:59.598Z","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bfa11036-022f-49b3-a6bd-7cf2083a264e","subject":"ATTACK:enterprise:G0050","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bfa11036-022f-49b3-a6bd-7cf2083a264e","modified":"2026-07-31T18:47:45.316Z","references":[{"source_name":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"},{"source_name":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c0c1a394-23db-44cf-a922-89e10ba13ec6","subject":"ATTACK:enterprise:C0018","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c0c1a394-23db-44cf-a922-89e10ba13ec6","modified":"2026-07-31T18:47:23.251Z","references":[{"source_name":"Costa AvosLocker May 2022","url":"https://www.linkedin.com/pulse/raas-avoslocker-incident-response-analysis-fl%C3%A1vio-costa?trk=articles_directory"},{"source_name":"Cisco Talos Avos Jun 2022","url":"https://blog.talosintelligence.com/avoslocker-new-arsenal/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c1340ca5-8aa5-442b-8715-b2c9a525d14f","subject":"ATTACK:enterprise:G1033","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c1340ca5-8aa5-442b-8715-b2c9a525d14f","modified":"2026-07-31T20:48:42.715Z","references":[{"source_name":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"},{"source_name":"StarBlizzard","url":"https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c298538c-bab6-4982-9b83-17f752358932","subject":"ATTACK:enterprise:G0078","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c298538c-bab6-4982-9b83-17f752358932","modified":"2026-07-31T18:47:42.845Z","references":[{"source_name":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c3a35bf1-acfc-4e70-8be8-db843110a142","subject":"ATTACK:enterprise:G0091","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c3a35bf1-acfc-4e70-8be8-db843110a142","modified":"2026-07-31T18:48:21.439Z","references":[{"source_name":"Group IB Silence Aug 2019","url":"https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf"},{"source_name":"SecureList Silence Nov 2017","url":"https://securelist.com/the-silence/83009/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4cced3e-4a44-48e0-a299-63a03c63b598","subject":"ATTACK:enterprise:G0047","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4cced3e-4a44-48e0-a299-63a03c63b598","modified":"2026-07-31T18:47:47.968Z","references":[{"source_name":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source_name":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cb909b8f-59ba-4edd-ac04-7d9fafdcfe89","subject":"ATTACK:enterprise:G0114","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cb909b8f-59ba-4edd-ac04-7d9fafdcfe89","modified":"2026-07-31T20:48:41.575Z","references":[{"source_name":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"},{"source_name":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cdb53adc-21a7-4786-8835-b0ef1ff3a95a","subject":"ATTACK:enterprise:C0061","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cdb53adc-21a7-4786-8835-b0ef1ff3a95a","modified":"2026-07-31T18:47:24.826Z","references":[{"source_name":"sentinelone operationDigitalEye Dec 2024","url":"https://www.sentinelone.com/labs/operation-digital-eye-chinese-apt-compromises-critical-digital-infrastructure-via-visual-studio-code-tunnels/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d13e6112-7edc-4355-b7a7-a29c04016168","subject":"ATTACK:enterprise:G1013","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d13e6112-7edc-4355-b7a7-a29c04016168","modified":"2026-07-31T18:48:16.061Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d2a28088-7488-40ce-9f65-a01834721a8c","subject":"ATTACK:enterprise:S0681","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d2a28088-7488-40ce-9f65-a01834721a8c","modified":"2026-04-29T14:23:06.213Z","references":[{"source_name":"BiZone Lizar May 2021","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d35934e8-c16e-4820-a0ad-88e0eff27554","subject":"ATTACK:enterprise:G0052","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d35934e8-c16e-4820-a0ad-88e0eff27554","modified":"2026-07-31T18:48:23.065Z","references":[{"source_name":"ClearSky and Trend Micro Operation Wilted Tulip July 2017","url":"https://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf"},{"source_name":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d3bc0783-3912-40b4-a995-4241ef218977","subject":"ATTACK:enterprise:C0058","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d3bc0783-3912-40b4-a995-4241ef218977","modified":"2026-07-31T18:47:19.095Z","references":[{"source_name":"Microsoft SharePoint Exploit JUL 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/#storm-2603"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d970ba14-4c96-4f98-a1e1-4417f52b76f3","subject":"ATTACK:enterprise:G0122","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d970ba14-4c96-4f98-a1e1-4417f52b76f3","modified":"2026-07-31T18:48:09.320Z","references":[{"source_name":"Proofpoint TA407 September 2019","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian"},{"source_name":"Secureworks COBALT DICKENS September 2019","url":"https://www.secureworks.com/blog/cobalt-dickens-goes-back-to-school-again"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dbcd9d76-b527-472f-8d3f-944cee432479","subject":"ATTACK:enterprise:C0027","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dbcd9d76-b527-472f-8d3f-944cee432479","modified":"2026-07-31T18:47:33.657Z","references":[{"source_name":"Crowdstrike TELCO BPO Campaign December 2022","url":"https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--de2ef201-d74b-4963-877b-93d669ea7f3b","subject":"ATTACK:enterprise:G1040","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--de2ef201-d74b-4963-877b-93d669ea7f3b","modified":"2026-07-31T18:48:26.040Z","references":[{"source_name":"CISA Play Ransomware Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--df940d86-6586-429f-ae57-fe99da9e8edb","subject":"ATTACK:enterprise:C0010","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--df940d86-6586-429f-ae57-fe99da9e8edb","modified":"2026-07-31T18:47:29.927Z","references":[{"source_name":"Mandiant UNC3890 Aug 2022","url":"https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e1a5fbaf-0615-4662-947b-563be5a2a075","subject":"ATTACK:enterprise:G1045","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e1a5fbaf-0615-4662-947b-563be5a2a075","modified":"2026-09-22T22:00:27.748Z","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"},{"source_name":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e2ced722-52bf-40ae-9627-99b5bf72b680","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e2ced722-52bf-40ae-9627-99b5bf72b680","modified":"2026-07-31T18:47:41.449Z","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source_name":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e36c6a15-c917-4817-93c3-7c78ceb1a702","subject":"ATTACK:enterprise:C0052","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e36c6a15-c917-4817-93c3-7c78ceb1a702","modified":"2026-07-31T18:47:26.794Z","references":[{"source_name":"ORB Mandiant","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e5757ac1-2887-4492-9f9e-3c5e2c9994ff","subject":"ATTACK:enterprise:C0001","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e5757ac1-2887-4492-9f9e-3c5e2c9994ff","modified":"2026-07-31T18:47:19.530Z","references":[{"source_name":"Talos Frankenstein June 2019","url":"https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e6b509c8-0e00-48ac-b76d-f42d18a0ae51","subject":"ATTACK:enterprise:G0073","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e6b509c8-0e00-48ac-b76d-f42d18a0ae51","modified":"2026-07-31T18:48:31.199Z","references":[{"source_name":"NCSC Joint Report Public Tools","url":"https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools"},{"source_name":"FireEye APT19","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e98b3b9a-c152-4515-bd01-273788561548","subject":"ATTACK:enterprise:G1044","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e98b3b9a-c152-4515-bd01-273788561548","modified":"2026-07-31T18:48:16.511Z","references":[{"source_name":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e9ff50dd-6367-43b1-9f75-1dee4028df84","subject":"ATTACK:enterprise:C0015","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e9ff50dd-6367-43b1-9f75-1dee4028df84","modified":"2026-07-31T18:47:25.807Z","references":[{"source_name":"DFIR Conti Bazar Nov 2021","url":"https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--eb6f9345-0600-4afb-99db-cdfbc0d6bc18","subject":"ATTACK:enterprise:C0017","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--eb6f9345-0600-4afb-99db-cdfbc0d6bc18","modified":"2026-07-31T21:12:36.233Z","references":[{"source_name":"Mandiant APT41","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ec8858d9-0379-4995-8873-76c8f2a2c07d","subject":"ATTACK:enterprise:C0007","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ec8858d9-0379-4995-8873-76c8f2a2c07d","modified":"2026-07-31T18:47:27.591Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ed07a5d3-757c-4665-969b-c0a1bb9ec881","subject":"ATTACK:enterprise:C0038","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ed07a5d3-757c-4665-969b-c0a1bb9ec881","modified":"2026-07-31T21:13:11.243Z","references":[{"source_name":"CISA Iran Albanian Attacks September 2022","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a"},{"source_name":"Microsoft Albanian Government Attacks September 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f06ee9db-1a29-412f-9584-5175eff85f28","subject":"ATTACK:enterprise:G0108","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f06ee9db-1a29-412f-9584-5175eff85f28","modified":"2026-07-31T18:48:02.984Z","references":[{"source_name":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f2f3bc50-78d0-490f-a91a-c0df35f68891","subject":"ATTACK:enterprise:C0029","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f2f3bc50-78d0-490f-a91a-c0df35f68891","modified":"2026-07-31T18:47:23.541Z","references":[{"source_name":"Mandiant Cutting Edge Part 3 February 2024","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"},{"source_name":"Mandiant Cutting Edge January 2024","url":"https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f55814a0-9e57-4bf3-bc40-21e7d3fca230","subject":"ATTACK:enterprise:G0006","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f55814a0-9e57-4bf3-bc40-21e7d3fca230","modified":"2026-07-31T18:48:01.656Z","references":[{"source_name":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f9b07e52-aff8-4fad-af72-ff646495d25f","subject":"ATTACK:enterprise:G0008","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f9b07e52-aff8-4fad-af72-ff646495d25f","modified":"2026-07-31T18:47:56.720Z","references":[{"source_name":"Kaspersky Carbanak","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fc916f01-4737-418d-8eee-1c5a553108d0","subject":"ATTACK:enterprise:C0064","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fc916f01-4737-418d-8eee-1c5a553108d0","modified":"2026-09-25T13:22:18.263Z","references":[{"source_name":"AI-Mexico-Govt-Breach","url":"https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fd49b386-9455-4a23-b5eb-b673e58b9d3a","subject":"ATTACK:enterprise:G0079","predicate":"uses","object":"ATTACK:enterprise:T1588.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fd49b386-9455-4a23-b5eb-b673e58b9d3a","modified":"2026-07-31T20:48:37.233Z","references":[{"source_name":"Unit 42 DarkHydrus July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}