{"record":{"id":"ATTACK:enterprise:T1680","title":"Local Storage Discovery","type":"Technique","source_url":"https://attack.mitre.org/techniques/T1680","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--f2514ae4-4e9b-4f26-a5ba-c4ae85fe93c3","external_id":"T1680","domain":"enterprise","created":"2025-09-25T21:09:38.677Z","modified":"2026-05-12T15:12:00.724Z","version":"1.0","aliases":[],"tactics":["discovery"],"source_references":[{"source_name":"Volexity","url":"https://www.volexity.com/blog/2023/06/28/charming-kitten-updates-powerstar-with-an-interplanetary-twist/"},{"source_name":"AWS docs describe volumes","url":"https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html"},{"source_name":"azure az disk","url":"https://learn.microsoft.com/en-us/cli/azure/disk?view=azure-cli-latest"},{"source_name":"GCP gcloud compute disks list","url":"https://cloud.google.com/sdk/gcloud/reference/compute/disks/list"},{"source_name":"TrendMicro ESXI Ransomware","url":"https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html"},{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"},{"source_name":"TrendMicro","url":"https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html"}]},"assertions":[{"id":"enterprise:relationship--01183e54-1494-4fad-ab62-60834746cc32","subject":"ATTACK:enterprise:G0139","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--01183e54-1494-4fad-ab62-60834746cc32","modified":"2026-07-31T18:47:48.878Z","references":[{"source_name":"ATT TeamTNT Chimaera September 2020","url":"https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"},{"source_name":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0160f1e4-76bd-4490-af74-bb80072cecae","subject":"ATTACK:enterprise:S0533","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0160f1e4-76bd-4490-af74-bb80072cecae","modified":"2026-04-29T14:23:05.904Z","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--029f82d6-72d9-43ac-a480-ae5169d20135","subject":"ATTACK:enterprise:S1151","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--029f82d6-72d9-43ac-a480-ae5169d20135","modified":"2026-04-29T14:23:05.906Z","references":[{"source_name":"Mandiant ROADSWEEP August 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--02b6b3cc-ec40-410f-90e9-03c534dc1c12","subject":"ATTACK:enterprise:S1049","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--02b6b3cc-ec40-410f-90e9-03c534dc1c12","modified":"2026-04-29T14:23:05.906Z","references":[{"source_name":"Palo Alto MoonWind March 2017","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--059a2b6f-2b77-4f71-acd4-a3c39c4c2da4","subject":"ATTACK:enterprise:S0625","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--059a2b6f-2b77-4f71-acd4-a3c39c4c2da4","modified":"2026-04-29T14:23:05.911Z","references":[{"source_name":"McAfee Cuba April 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--082a573f-d760-4bd8-a830-8c5a57b4ea44","subject":"ATTACK:enterprise:S0253","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--082a573f-d760-4bd8-a830-8c5a57b4ea44","modified":"2026-04-29T14:23:05.914Z","references":[{"source_name":"McAfee Gold Dragon","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0b6312e1-2601-4bb3-ba21-ee1c488b3506","subject":"ATTACK:enterprise:S0678","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0b6312e1-2601-4bb3-ba21-ee1c488b3506","modified":"2026-04-29T14:23:05.919Z","references":[{"source_name":"McAfee Lazarus Nov 2020","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0da384db-9a5b-4256-81b4-19df05a4ceb8","subject":"ATTACK:enterprise:S0248","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0da384db-9a5b-4256-81b4-19df05a4ceb8","modified":"2026-04-29T14:23:05.922Z","references":[{"source_name":"ASERT Donot March 2018","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0f0b7154-b0d2-4aa1-b819-7d4e3dfe3bd1","subject":"ATTACK:enterprise:S1048","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0f0b7154-b0d2-4aa1-b819-7d4e3dfe3bd1","modified":"2026-04-29T14:23:05.924Z","references":[{"source_name":"SentinelLabs reversing run-only applescripts 2021","url":"https://www.sentinelone.com/labs/fade-dead-adventures-in-reversing-malicious-run-only-applescripts/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--118cdbd1-12e5-4ac2-85a3-c574e7cfad91","subject":"ATTACK:enterprise:C0017","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--118cdbd1-12e5-4ac2-85a3-c574e7cfad91","modified":"2026-07-31T21:12:30.880Z","references":[{"source_name":"Mandiant APT41","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--11917102-46c9-4c12-964c-065ad6b2a14f","subject":"ATTACK:enterprise:S0564","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--11917102-46c9-4c12-964c-065ad6b2a14f","modified":"2026-04-29T14:23:05.928Z","references":[{"source_name":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--14de629c-9b49-4841-901a-85fab61f693b","subject":"ATTACK:enterprise:S0472","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--14de629c-9b49-4841-901a-85fab61f693b","modified":"2026-04-29T14:23:05.932Z","references":[{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--19dccc7d-03eb-45a4-88c1-1ed4ddcee7a3","subject":"ATTACK:enterprise:S0663","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--19dccc7d-03eb-45a4-88c1-1ed4ddcee7a3","modified":"2026-04-29T14:23:05.940Z","references":[{"source_name":"Lunghi Iron Tiger Linux","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"},{"source_name":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--22a699a2-ad75-470e-87c9-9ec8f9763e8e","subject":"ATTACK:enterprise:S0630","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--22a699a2-ad75-470e-87c9-9ec8f9763e8e","modified":"2026-04-29T14:23:05.952Z","references":[{"source_name":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--22b9eb17-686a-4cfe-b9a1-cffe22c7755f","subject":"ATTACK:enterprise:S0607","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--22b9eb17-686a-4cfe-b9a1-cffe22c7755f","modified":"2026-04-29T14:23:05.952Z","references":[{"source_name":"Trend Micro KillDisk 1","url":"https://www.trendmicro.com/en_us/research/18/f/new-killdisk-variant-hits-latin-american-financial-organizations-again.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2b1b3740-cbf5-47cb-8a91-1b2c9a683342","subject":"ATTACK:enterprise:S1168","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2b1b3740-cbf5-47cb-8a91-1b2c9a683342","modified":"2026-04-29T14:23:05.963Z","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--2f59d9ec-a48d-4565-a8da-1377e06dfb3f","subject":"ATTACK:enterprise:S0351","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--2f59d9ec-a48d-4565-a8da-1377e06dfb3f","modified":"2026-04-29T14:23:05.971Z","references":[{"source_name":"Unit42 Cannon Nov 2018","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"},{"source_name":"Unit42 Sofacy Dec 2018","url":"https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--30437ed1-5cad-4656-9ae8-c4a06122b613","subject":"ATTACK:enterprise:S0013","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--30437ed1-5cad-4656-9ae8-c4a06122b613","modified":"2026-04-29T14:23:05.976Z","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--350b8d90-f1ab-4bdf-a47e-8413751ed56c","subject":"ATTACK:enterprise:S1111","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--350b8d90-f1ab-4bdf-a47e-8413751ed56c","modified":"2026-04-29T14:23:05.990Z","references":[{"source_name":"Ensilo Darkgate 2018","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3511b2ef-7012-4a7f-8b38-d6b7ba508b59","subject":"ATTACK:enterprise:S0267","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3511b2ef-7012-4a7f-8b38-d6b7ba508b59","modified":"2026-04-29T14:23:05.990Z","references":[{"source_name":"ESET GreyEnergy Oct 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"},{"source_name":"FireEye FELIXROOT July 2018","url":"https://web.archive.org/web/20200607025424/https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--39ef8d48-fb74-412a-8c6d-b889e3fca644","subject":"ATTACK:enterprise:S1202","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--39ef8d48-fb74-412a-8c6d-b889e3fca644","modified":"2026-04-29T14:23:05.999Z","references":[{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3a8eb909-108e-4d4c-b893-d76b585caa9b","subject":"ATTACK:enterprise:S1026","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3a8eb909-108e-4d4c-b893-d76b585caa9b","modified":"2026-04-29T14:23:06.001Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3c8805ff-7345-4763-9757-6a30acfe652c","subject":"ATTACK:enterprise:S1065","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3c8805ff-7345-4763-9757-6a30acfe652c","modified":"2026-04-29T14:23:06.007Z","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--43ab17df-742f-4bc5-815a-7da2feed73f0","subject":"ATTACK:enterprise:S1087","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--43ab17df-742f-4bc5-815a-7da2feed73f0","modified":"2026-04-29T14:23:06.017Z","references":[{"source_name":"Telefonica Snip3 December 2021","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--44150544-030d-430c-bec8-6fb4373d484e","subject":"ATTACK:enterprise:S0137","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--44150544-030d-430c-bec8-6fb4373d484e","modified":"2026-04-29T14:23:06.018Z","references":[{"source_name":"FireEye APT28","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4c06f698-1d15-4758-a38f-d3476ac65fa8","subject":"ATTACK:enterprise:S1147","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4c06f698-1d15-4758-a38f-d3476ac65fa8","modified":"2026-04-29T14:23:06.029Z","references":[{"source_name":"ESET EvasivePanda 2024","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4dfa38d4-a6e6-4fab-bff8-23cab8ffa9cd","subject":"ATTACK:enterprise:S1239","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4dfa38d4-a6e6-4fab-bff8-23cab8ffa9cd","modified":"2026-04-29T14:23:06.031Z","references":[{"source_name":"ATTACKIQ MUSTANG PANDA TONESHELL March 2023","url":"https://www.attackiq.com/2023/03/23/emulating-the-politically-motivated-chinese-apt-mustang-panda/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4e204be0-a2f2-47e8-9b43-84cc2736784a","subject":"ATTACK:enterprise:S0667","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4e204be0-a2f2-47e8-9b43-84cc2736784a","modified":"2026-04-29T14:23:06.031Z","references":[{"source_name":"ESET Gelsemium June 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--501b58a3-5315-4415-8e4a-b2ee65db5013","subject":"ATTACK:enterprise:S9038","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--501b58a3-5315-4415-8e4a-b2ee65db5013","modified":"2026-04-29T14:23:06.035Z","references":[{"source_name":"CERT Polska","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--514a384a-2b09-4b4f-9def-8e4007b49734","subject":"ATTACK:enterprise:G1017","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--514a384a-2b09-4b4f-9def-8e4007b49734","modified":"2026-07-31T18:47:40.277Z","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source_name":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source_name":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"},{"source_name":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5bdc87b7-a975-4fd8-a4e3-131f769600f3","subject":"ATTACK:enterprise:S0208","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5bdc87b7-a975-4fd8-a4e3-131f769600f3","modified":"2026-04-29T14:23:06.051Z","references":[{"source_name":"Symantec Pasam May 2012","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-050412-4128-99"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--68be315f-f84b-4790-892b-e284089658a8","subject":"ATTACK:enterprise:S1244","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--68be315f-f84b-4790-892b-e284089658a8","modified":"2026-04-29T14:23:06.067Z","references":[{"source_name":"Security Scorecard Medusa Ransomware January 2024","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--68f0f623-b5f2-47a8-8206-eabfb472d7aa","subject":"ATTACK:enterprise:S1139","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--68f0f623-b5f2-47a8-8206-eabfb472d7aa","modified":"2026-06-12T19:52:54.217Z","references":[{"source_name":"Cybereason INC Ransomware November 2023","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--69262212-bb89-43fc-8a80-ba492766e372","subject":"ATTACK:enterprise:S1027","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--69262212-bb89-43fc-8a80-ba492766e372","modified":"2026-04-29T14:23:06.068Z","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7224a7bb-225c-484a-9481-d3a0cb328b32","subject":"ATTACK:enterprise:S0238","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7224a7bb-225c-484a-9481-d3a0cb328b32","modified":"2026-04-29T14:23:06.081Z","references":[{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--77534dcc-4183-41b5-adbd-cc7e8ccaa3ec","subject":"ATTACK:enterprise:S0587","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--77534dcc-4183-41b5-adbd-cc7e8ccaa3ec","modified":"2026-04-29T14:23:06.088Z","references":[{"source_name":"Leonardo Turla Penquin May 2020","url":"https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7b30e00a-71c6-4ad8-b2a8-39f000156930","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7b30e00a-71c6-4ad8-b2a8-39f000156930","modified":"2026-04-29T14:23:06.094Z","references":[{"source_name":"Medium KONNI Jan 2020","url":"https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b"},{"source_name":"Talos Konni May 2017","url":"https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"},{"source_name":"Malwarebytes Konni Aug 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--800060e1-5bd0-475a-93d0-e0abc36e10d7","subject":"ATTACK:enterprise:S1068","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--800060e1-5bd0-475a-93d0-e0abc36e10d7","modified":"2026-04-29T14:23:06.101Z","references":[{"source_name":"Microsoft BlackCat Jun 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8135fc16-4dda-4afb-bc35-d24c370b0c53","subject":"ATTACK:enterprise:G0142","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8135fc16-4dda-4afb-bc35-d24c370b0c53","modified":"2026-07-31T20:48:37.585Z","references":[{"source_name":"TrendMicro Confucius APT Aug 2021","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--81a857bb-4c36-4875-a62e-30e7b12eae12","subject":"ATTACK:enterprise:S0458","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--81a857bb-4c36-4875-a62e-30e7b12eae12","modified":"2026-04-29T14:23:06.103Z","references":[{"source_name":"Antiy CERT Ramsay April 2020","url":"https://www.programmersought.com/article/62493896999/"},{"source_name":"Eset Ramsay May 2020","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--83b9dc24-fc85-40dd-ad6e-f8eeededc53f","subject":"ATTACK:enterprise:S1199","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--83b9dc24-fc85-40dd-ad6e-f8eeededc53f","modified":"2026-04-29T14:23:06.105Z","references":[{"source_name":"Palo Alto Lockbit 2.0 JUN 2022","url":"https://unit42.paloaltonetworks.com/lockbit-2-ransomware/"},{"source_name":"FBI Lockbit 2.0 FEB 2022","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--85e94a33-82be-46f4-b6e5-766f5f5e5a56","subject":"ATTACK:enterprise:S1242","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--85e94a33-82be-46f4-b6e5-766f5f5e5a56","modified":"2026-04-29T14:23:06.108Z","references":[{"source_name":"Halcyon Qilin.B OCT 2024","url":"https://www.halcyon.ai/blog/new-qilin-b-ransomware-variant-boasts-enhanced-encryption-and-defense-evasion"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--88ae2900-c8c5-4943-8baa-7a8ba96dcef5","subject":"ATTACK:enterprise:S1100","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--88ae2900-c8c5-4943-8baa-7a8ba96dcef5","modified":"2026-04-29T14:23:06.112Z","references":[{"source_name":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"},{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8cef7b12-80af-4bb1-bf72-8eccd835d423","subject":"ATTACK:enterprise:S1070","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8cef7b12-80af-4bb1-bf72-8eccd835d423","modified":"2026-04-29T14:23:06.117Z","references":[{"source_name":"Cyble Black Basta May 2022","url":"https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/"},{"source_name":"Minerva Labs Black Basta May 2022","url":"https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--912fc001-4c47-42fb-a2c0-7abed4e620b1","subject":"ATTACK:enterprise:S0251","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--912fc001-4c47-42fb-a2c0-7abed4e620b1","modified":"2026-04-29T14:23:06.123Z","references":[{"source_name":"Accenture SNAKEMACKEREL Nov 2018","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"},{"source_name":"CISA Zebrocy Oct 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b"},{"source_name":"ESET Zebrocy May 2019","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"},{"source_name":"ESET Zebrocy Nov 2018","url":"https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"},{"source_name":"Unit42 Cannon Nov 2018","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"},{"source_name":"Unit42 Sofacy Dec 2018","url":"https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"},{"source_name":"Palo Alto Sofacy 06-2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--937b70c1-3024-4a39-95b0-5f76b8671a66","subject":"ATTACK:enterprise:S1085","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--937b70c1-3024-4a39-95b0-5f76b8671a66","modified":"2026-04-29T14:23:06.126Z","references":[{"source_name":"Bitdefender Sardonic Aug 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--937f8691-2941-4365-9a82-889d3b67a641","subject":"ATTACK:enterprise:S0376","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--937f8691-2941-4365-9a82-889d3b67a641","modified":"2026-04-29T14:23:06.126Z","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--937febf9-bb30-4fcf-a208-e599693d4588","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--937febf9-bb30-4fcf-a208-e599693d4588","modified":"2026-04-29T14:23:06.126Z","references":[{"source_name":"ESET InvisiMole June 2018","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--98c69e3a-1fc1-4da2-adc5-a33723ab1be4","subject":"ATTACK:enterprise:S0617","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--98c69e3a-1fc1-4da2-adc5-a33723ab1be4","modified":"2026-04-29T14:23:06.133Z","references":[{"source_name":"FireEye FiveHands April 2021","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9cf32fea-16cd-41cf-93f3-a47c1388abbc","subject":"ATTACK:enterprise:S0446","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9cf32fea-16cd-41cf-93f3-a47c1388abbc","modified":"2026-04-29T14:23:06.139Z","references":[{"source_name":"CrowdStrike Ryuk January 2019","url":"https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--9e3f33db-5076-403b-b71e-71d898389e0b","subject":"ATTACK:enterprise:S0271","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--9e3f33db-5076-403b-b71e-71d898389e0b","modified":"2026-04-29T14:23:06.141Z","references":[{"source_name":"US-CERT KEYMARBLE Aug 2018","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-221A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a1cb6aec-0f1c-491e-9648-b668014e3aee","subject":"ATTACK:enterprise:G0081","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a1cb6aec-0f1c-491e-9648-b668014e3aee","modified":"2026-07-31T18:47:57.409Z","references":[{"source_name":"TrendMicro TropicTrooper 2015","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"},{"source_name":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a220cf94-7165-44ed-85da-014bc684e680","subject":"ATTACK:enterprise:S0516","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a220cf94-7165-44ed-85da-014bc684e680","modified":"2026-04-29T14:23:06.146Z","references":[{"source_name":"CISA SoreFang July 2016","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a2fbefb3-bbb7-4c98-8ef1-8440f4ee3bd6","subject":"ATTACK:enterprise:S1150","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a2fbefb3-bbb7-4c98-8ef1-8440f4ee3bd6","modified":"2026-04-29T14:23:06.147Z","references":[{"source_name":"Mandiant ROADSWEEP August 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"},{"source_name":"Microsoft Albanian Government Attacks September 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a38cfd4a-0ba2-49ae-98e9-df6c1f954148","subject":"ATTACK:enterprise:S1228","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a38cfd4a-0ba2-49ae-98e9-df6c1f954148","modified":"2026-04-29T14:23:06.147Z","references":[{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a38fd59c-489b-4d3a-b3be-54fe89244c71","subject":"ATTACK:enterprise:S1060","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a38fd59c-489b-4d3a-b3be-54fe89244c71","modified":"2026-04-29T14:23:06.147Z","references":[{"source_name":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a5f8752d-2df3-45b2-ab03-9e9261971bc6","subject":"ATTACK:enterprise:S9052","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a5f8752d-2df3-45b2-ab03-9e9261971bc6","modified":"2026-09-24T18:53:10.100Z","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a6b41bba-0b47-400d-9aa4-134b4f47994f","subject":"ATTACK:enterprise:S0491","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a6b41bba-0b47-400d-9aa4-134b4f47994f","modified":"2026-09-03T14:50:24.045Z","references":[{"source_name":"Talos Promethium June 2020","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a6c20b07-57ea-46dd-aa71-93849b6b66ca","subject":"ATTACK:enterprise:S0471","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a6c20b07-57ea-46dd-aa71-93849b6b66ca","modified":"2026-04-29T14:23:06.152Z","references":[{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a77ba502-576a-47cc-8718-c3f3dcc41b1e","subject":"ATTACK:enterprise:S0697","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a77ba502-576a-47cc-8718-c3f3dcc41b1e","modified":"2026-04-29T14:23:06.153Z","references":[{"source_name":"Qualys Hermetic Wiper March 2022","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware"},{"source_name":"ESET Hermetic Wizard March 2022","url":"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"},{"source_name":"SentinelOne Hermetic Wiper February 2022","url":"https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack"},{"source_name":"Crowdstrike DriveSlayer February 2022","url":"https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--afa8a693-6e2f-40e8-a78d-2710e9683e4e","subject":"ATTACK:enterprise:G0032","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--afa8a693-6e2f-40e8-a78d-2710e9683e4e","modified":"2026-07-31T20:48:47.052Z","references":[{"source_name":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b16660dc-0675-462a-85fc-1902a751639e","subject":"ATTACK:enterprise:C0024","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b16660dc-0675-462a-85fc-1902a751639e","modified":"2026-07-31T18:47:27.263Z","references":[{"source_name":"Microsoft Deep Dive Solorigate January 2021","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b3bc70ea-4f9e-4933-81e7-eb8b19f89a3b","subject":"ATTACK:enterprise:S1075","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b3bc70ea-4f9e-4933-81e7-eb8b19f89a3b","modified":"2026-04-29T14:23:06.171Z","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b42354ae-384d-4885-96a0-1594ed6dd427","subject":"ATTACK:enterprise:S0234","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b42354ae-384d-4885-96a0-1594ed6dd427","modified":"2026-04-29T14:23:06.171Z","references":[{"source_name":"CheckPoint Bandook Nov 2020","url":"https://research.checkpoint.com/2020/bandook-signed-delivered/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b4d35a40-e89f-453f-aeab-5e44dacbc1f8","subject":"ATTACK:enterprise:S0496","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b4d35a40-e89f-453f-aeab-5e44dacbc1f8","modified":"2026-04-29T14:23:06.172Z","references":[{"source_name":"Secureworks REvil September 2019","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"},{"source_name":"Cylance Sodinokibi July 2019","url":"https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"},{"source_name":"Group IB Ransomware May 2020","url":"https://www.group-ib.com/whitepapers/ransomware-uncovered.html"},{"source_name":"Intel 471 REvil March 2020","url":"https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"},{"source_name":"Kaspersky Sodin July 2019","url":"https://securelist.com/sodin-ransomware/91473/"},{"source_name":"McAfee Sodinokibi October 2019","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"},{"source_name":"Secureworks GandCrab and REvil September 2019","url":"https://www.secureworks.com/blog/revil-the-gandcrab-connection"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b5a1d3dd-89ea-442a-8695-1aea2cbccafa","subject":"ATTACK:enterprise:S0689","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b5a1d3dd-89ea-442a-8695-1aea2cbccafa","modified":"2026-04-29T14:23:06.173Z","references":[{"source_name":"Cisco Ukraine Wipers January 2022","url":"https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b64b605f-2677-47c3-ae4b-0b3db3573eae","subject":"ATTACK:enterprise:G0126","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b64b605f-2677-47c3-ae4b-0b3db3573eae","modified":"2026-07-31T18:47:56.812Z","references":[{"source_name":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source_name":"PTSecurity Higaisa 2020","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bdbd15f2-3c02-4f3a-b824-60f7f815c9c3","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bdbd15f2-3c02-4f3a-b824-60f7f815c9c3","modified":"2026-07-31T20:48:26.417Z","references":[{"source_name":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source_name":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--be4909b2-ff92-4dca-b835-09df2b10adb2","subject":"ATTACK:enterprise:S0672","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--be4909b2-ff92-4dca-b835-09df2b10adb2","modified":"2026-04-29T14:23:06.185Z","references":[{"source_name":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--bea2bee1-a80c-40a0-9552-e9f49d4fe33b","subject":"ATTACK:enterprise:S0353","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--bea2bee1-a80c-40a0-9552-e9f49d4fe33b","modified":"2026-04-29T14:23:06.186Z","references":[{"source_name":"Unit 42 NOKKI Sept 2018","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c08ad736-dcd5-465c-92b6-54213ab69614","subject":"ATTACK:enterprise:S0692","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c08ad736-dcd5-465c-92b6-54213ab69614","modified":"2026-04-29T14:23:06.189Z","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c1004711-9899-4757-8338-428fe33c3411","subject":"ATTACK:enterprise:S1089","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c1004711-9899-4757-8338-428fe33c3411","modified":"2026-04-29T14:23:06.189Z","references":[{"source_name":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c3556085-d0ed-41dc-9ed4-a0a0c65ee104","subject":"ATTACK:enterprise:G0114","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c3556085-d0ed-41dc-9ed4-a0a0c65ee104","modified":"2026-07-31T20:48:41.554Z","references":[{"source_name":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c42d1cc1-3685-4bd7-96ba-84a66cc6a287","subject":"ATTACK:enterprise:S0488","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c42d1cc1-3685-4bd7-96ba-84a66cc6a287","modified":"2026-04-29T14:23:06.193Z","references":[{"source_name":"CME Github September 2018","url":"https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4dd3873-c9e7-4453-9acb-aeb868eef874","subject":"ATTACK:enterprise:S0259","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4dd3873-c9e7-4453-9acb-aeb868eef874","modified":"2026-04-29T14:23:06.194Z","references":[{"source_name":"ASERT InnaputRAT April 2018","url":"https://asert.arbornetworks.com/innaput-actors-utilize-remote-access-trojan-since-2016-presumably-targeting-victim-files/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c80db47b-f1d6-4f62-aea0-d87edb778f5e","subject":"ATTACK:enterprise:S0520","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c80db47b-f1d6-4f62-aea0-d87edb778f5e","modified":"2026-04-29T14:23:06.199Z","references":[{"source_name":"US-CERT BLINDINGCAN Aug 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c8a336f0-300c-4c9a-a501-5d679f583048","subject":"ATTACK:enterprise:S0340","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c8a336f0-300c-4c9a-a501-5d679f583048","modified":"2026-04-29T14:23:06.199Z","references":[{"source_name":"Securelist Octopus Oct 2018","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cac0eda3-7d8c-42e2-b397-8923cd05f0b8","subject":"ATTACK:enterprise:S1016","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cac0eda3-7d8c-42e2-b397-8923cd05f0b8","modified":"2026-04-29T14:23:06.202Z","references":[{"source_name":"ESET DazzleSpy Jan 2022","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cca29cfc-4753-4d3e-a1c7-848a66f0a593","subject":"ATTACK:enterprise:S0181","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cca29cfc-4753-4d3e-a1c7-848a66f0a593","modified":"2026-04-29T14:23:06.205Z","references":[{"source_name":"US-CERT FALLCHILL Nov 2017","url":"https://www.us-cert.gov/ncas/alerts/TA17-318A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cf3ec188-0f5d-4f7b-837b-1bdb79508aa6","subject":"ATTACK:enterprise:S0172","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cf3ec188-0f5d-4f7b-837b-1bdb79508aa6","modified":"2026-04-29T14:23:06.209Z","references":[{"source_name":"Palo Alto Reaver Nov 2017","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--cfdffe47-f77b-46bb-8d7d-1753f5d74ff6","subject":"ATTACK:enterprise:S0265","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--cfdffe47-f77b-46bb-8d7d-1753f5d74ff6","modified":"2026-04-29T14:23:06.210Z","references":[{"source_name":"Unit 42 Kazuar May 2017","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d0e4c9af-070a-43bd-82e6-c047f7ebf491","subject":"ATTACK:enterprise:S0263","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d0e4c9af-070a-43bd-82e6-c047f7ebf491","modified":"2026-04-29T14:23:06.211Z","references":[{"source_name":"US-CERT TYPEFRAME June 2018","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d36642ab-c972-4b23-b528-b25ea835031c","subject":"ATTACK:enterprise:S9051","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d36642ab-c972-4b23-b528-b25ea835031c","modified":"2026-09-30T20:25:15.527Z","references":[{"source_name":"CheckPointResearch_TheGentlemen_April2026","url":"https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d63bf9b2-d13c-4a16-b952-700594fc9f50","subject":"ATTACK:enterprise:S0596","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d63bf9b2-d13c-4a16-b952-700594fc9f50","modified":"2026-04-29T14:23:06.218Z","references":[{"source_name":"Kaspersky ShadowPad Aug 2017","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d760ae68-4127-4fec-814b-020a40f7b4e5","subject":"ATTACK:enterprise:S0239","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d760ae68-4127-4fec-814b-020a40f7b4e5","modified":"2026-04-29T14:23:06.219Z","references":[{"source_name":"McAfee Bankshot","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"},{"source_name":"US-CERT Bankshot Dec 2017","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--dd67596a-64c6-4dfb-b498-e7d5c1886090","subject":"ATTACK:enterprise:S0526","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--dd67596a-64c6-4dfb-b498-e7d5c1886090","modified":"2026-04-29T14:23:06.227Z","references":[{"source_name":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--de99649c-2d3a-4cbc-be0c-003e399e3963","subject":"ATTACK:enterprise:S0091","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--de99649c-2d3a-4cbc-be0c-003e399e3963","modified":"2026-04-29T14:23:06.229Z","references":[{"source_name":"Kaspersky Turla Aug 2014","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08080105/KL_Epic_Turla_Technical_Appendix_20140806.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e0140710-f03a-4e43-9e87-45926636b377","subject":"ATTACK:enterprise:S0638","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e0140710-f03a-4e43-9e87-45926636b377","modified":"2026-04-29T14:23:06.231Z","references":[{"source_name":"McAfee Babuk February 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e0245348-fa82-4cc7-baa6-e17d1e58706a","subject":"ATTACK:enterprise:S0473","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e0245348-fa82-4cc7-baa6-e17d1e58706a","modified":"2026-04-29T14:23:06.231Z","references":[{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e11d4f32-842a-4684-8974-f368e52b8632","subject":"ATTACK:enterprise:S0044","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e11d4f32-842a-4684-8974-f368e52b8632","modified":"2026-04-29T14:23:06.232Z","references":[{"source_name":"ESET Sednit Part 1","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf"},{"source_name":"Unit 42 Sofacy Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e1da5aff-cead-46b6-a45c-ab7f4e650e05","subject":"ATTACK:enterprise:S1073","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e1da5aff-cead-46b6-a45c-ab7f4e650e05","modified":"2026-04-29T14:23:06.233Z","references":[{"source_name":"Cybereason Royal December 2022","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"},{"source_name":"Trend Micro Royal Linux ESXi February 2023","url":"https://www.trendmicro.com/en_us/research/23/b/royal-ransomware-expands-attacks-by-targeting-linux-esxi-servers.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e1eebea8-ad12-4c3f-bbdc-10f26bbccda8","subject":"ATTACK:enterprise:S0586","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e1eebea8-ad12-4c3f-bbdc-10f26bbccda8","modified":"2026-04-29T14:23:06.233Z","references":[{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--e69dfb2f-c89b-4167-9165-4f3026b32ad7","subject":"ATTACK:enterprise:S0616","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--e69dfb2f-c89b-4167-9165-4f3026b32ad7","modified":"2026-04-29T14:23:06.239Z","references":[{"source_name":"FireEye FiveHands April 2021","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ed758a74-c91c-413d-a7a9-f09f697f4574","subject":"ATTACK:enterprise:C0014","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ed758a74-c91c-413d-a7a9-f09f697f4574","modified":"2026-07-31T18:47:31.959Z","references":[{"source_name":"FoxIT Wocao December 2019","url":"https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--efab47f3-cd77-41a5-bb8d-34ee3911d07d","subject":"ATTACK:enterprise:G1022","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--efab47f3-cd77-41a5-bb8d-34ee3911d07d","modified":"2026-07-31T18:48:14.462Z","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f13b18fe-1596-453f-8dba-43cfa848a5e7","subject":"ATTACK:enterprise:S1044","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f13b18fe-1596-453f-8dba-43cfa848a5e7","modified":"2026-04-29T14:23:06.253Z","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f1c35f20-cd82-4ecb-b958-c6abc86d9dc4","subject":"ATTACK:enterprise:S9031","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f1c35f20-cd82-4ecb-b958-c6abc86d9dc4","modified":"2026-04-29T14:23:06.254Z","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f2bc3b89-dcf9-4954-b9da-20e753c47abc","subject":"ATTACK:enterprise:S0680","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f2bc3b89-dcf9-4954-b9da-20e753c47abc","modified":"2026-04-29T14:23:06.255Z","references":[{"source_name":"Kaspersky WIRTE November 2021","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f87c6571-5031-4abb-8eaf-3416eec79928","subject":"ATTACK:enterprise:S0448","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f87c6571-5031-4abb-8eaf-3416eec79928","modified":"2026-04-29T14:23:06.263Z","references":[{"source_name":"McAfee Sharpshooter December 2018","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f8bf7fa5-3af6-4770-ae87-022154a9378e","subject":"ATTACK:enterprise:S0456","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f8bf7fa5-3af6-4770-ae87-022154a9378e","modified":"2026-04-29T14:23:06.263Z","references":[{"source_name":"CheckPoint Naikon May 2020","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fa4c9d50-529f-4166-a65d-3c4f28496fb7","subject":"ATTACK:enterprise:G0094","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fa4c9d50-529f-4166-a65d-3c4f28496fb7","modified":"2026-07-31T20:48:25.669Z","references":[{"source_name":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"},{"source_name":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--faccd8d5-0e21-4e57-aef9-1ccf72150294","subject":"ATTACK:enterprise:S0438","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--faccd8d5-0e21-4e57-aef9-1ccf72150294","modified":"2026-04-29T14:23:06.265Z","references":[{"source_name":"ESET Attor Oct 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fccaf542-b2ae-4814-a366-2fe6ab4c809a","subject":"ATTACK:enterprise:S0115","predicate":"uses","object":"ATTACK:enterprise:T1680","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fccaf542-b2ae-4814-a366-2fe6ab4c809a","modified":"2026-04-29T14:23:06.268Z","references":[{"source_name":"Kaspersky Transparent Tribe August 2020","url":"https://securelist.com/transparent-tribe-part-1/98127/"},{"source_name":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}