{ "name": "Adversary Atlas API", "version": "1.0.0", "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.", "generated": "2026-07-31T01:06:07.226Z", "datasetCurrentAsOf": "2025-09-01", "license": "Data compiled from public primary sources; see /methodology/ for sourcing.", "note": "Keys are normalised: lowercased, non-alphanumerics collapsed to single spaces, trimmed. Normalise your input the same way before lookup.", "count": 558, "aliases": { "110": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "Lab 110 / 3rd Bureau", "kind": "unit", "org": null } ], "26165": [ { "slug": "apt28", "name": "APT28", "matched": "Unit 26165", "kind": "unit", "org": null } ], "61398": [ { "slug": "apt1", "name": "APT1", "matched": "Unit 61398", "kind": "unit", "org": null } ], "74455": [ { "slug": "sandworm", "name": "Sandworm", "matched": "Unit 74455", "kind": "unit", "org": null } ], "apt28": [ { "slug": "apt28", "name": "APT28", "matched": "APT28", "kind": "name", "org": null } ], "g0007": [ { "slug": "apt28", "name": "APT28", "matched": "G0007", "kind": "alias", "org": "mitre" } ], "forest blizzard": [ { "slug": "apt28", "name": "APT28", "matched": "Forest Blizzard", "kind": "alias", "org": "microsoft" } ], "strontium": [ { "slug": "apt28", "name": "APT28", "matched": "STRONTIUM", "kind": "alias", "org": "microsoft" } ], "fancy bear": [ { "slug": "apt28", "name": "APT28", "matched": "Fancy Bear", "kind": "alias", "org": "crowdstrike" } ], "iron twilight": [ { "slug": "apt28", "name": "APT28", "matched": "IRON TWILIGHT", "kind": "alias", "org": "secureworks" } ], "tg 4127": [ { "slug": "apt28", "name": "APT28", "matched": "TG-4127", "kind": "alias", "org": "secureworks" } ], "fighting ursa": [ { "slug": "apt28", "name": "APT28", "matched": "Fighting Ursa", "kind": "alias", "org": "unit42" } ], "bluedelta": [ { "slug": "apt28", "name": "APT28", "matched": "BlueDelta", "kind": "alias", "org": "recordedfuture" } ], "sednit": [ { "slug": "apt28", "name": "APT28", "matched": "Sednit", "kind": "alias", "org": "eset" } ], "sofacy": [ { "slug": "apt28", "name": "APT28", "matched": "Sofacy", "kind": "alias", "org": "kaspersky" } ], "pawn storm": [ { "slug": "apt28", "name": "APT28", "matched": "Pawn Storm", "kind": "alias", "org": "trendmicro" } ], "swallowtail": [ { "slug": "apt28", "name": "APT28", "matched": "Swallowtail", "kind": "alias", "org": "symantec" } ], "graphite": [ { "slug": "apt28", "name": "APT28", "matched": "GRAPHITE", "kind": "alias", "org": "dragos" } ], "gru unit 26165": [ { "slug": "apt28", "name": "APT28", "matched": "GRU Unit 26165", "kind": "alias", "org": "cisa" } ], "grizzly steppe": [ { "slug": "apt28", "name": "APT28", "matched": "GRIZZLY STEPPE", "kind": "alias", "org": "cisa" } ], "x agent chopstick": [ { "slug": "apt28", "name": "APT28", "matched": "X-Agent (CHOPSTICK)", "kind": "tool", "org": null } ], "x tunnel": [ { "slug": "apt28", "name": "APT28", "matched": "X-Tunnel", "kind": "tool", "org": null } ], "lojax": [ { "slug": "apt28", "name": "APT28", "matched": "LoJax", "kind": "tool", "org": null } ], "drovorub": [ { "slug": "apt28", "name": "APT28", "matched": "Drovorub", "kind": "tool", "org": null } ], "zebrocy": [ { "slug": "apt28", "name": "APT28", "matched": "Zebrocy", "kind": "tool", "org": null } ], "gooseegg": [ { "slug": "apt28", "name": "APT28", "matched": "GooseEgg", "kind": "tool", "org": null } ], "headlace": [ { "slug": "apt28", "name": "APT28", "matched": "HeadLace", "kind": "tool", "org": null } ], "masepie": [ { "slug": "apt28", "name": "APT28", "matched": "MASEPIE", "kind": "tool", "org": null } ], "oceanmap": [ { "slug": "apt28", "name": "APT28", "matched": "OCEANMAP", "kind": "tool", "org": null } ], "steelhook": [ { "slug": "apt28", "name": "APT28", "matched": "STEELHOOK", "kind": "tool", "org": null } ], "responder": [ { "slug": "apt28", "name": "APT28", "matched": "Responder", "kind": "tool", "org": null } ], "mimikatz": [ { "slug": "apt28", "name": "APT28", "matched": "Mimikatz", "kind": "tool", "org": null } ], "impacket": [ { "slug": "apt28", "name": "APT28", "matched": "Impacket", "kind": "tool", "org": null }, { "slug": "volt-typhoon", "name": "Volt Typhoon", "matched": "Impacket", "kind": "tool", "org": null } ], "unit 26165": [ { "slug": "apt28", "name": "APT28", "matched": "Unit 26165", "kind": "unit", "org": null } ], "apt29": [ { "slug": "apt29", "name": "APT29", "matched": "APT29", "kind": "name", "org": null } ], "g0016": [ { "slug": "apt29", "name": "APT29", "matched": "G0016", "kind": "alias", "org": "mitre" } ], "midnight blizzard": [ { "slug": "apt29", "name": "APT29", "matched": "Midnight Blizzard", "kind": "alias", "org": "microsoft" } ], "nobelium": [ { "slug": "apt29", "name": "APT29", "matched": "NOBELIUM", "kind": "alias", "org": "microsoft" } ], "cozy bear": [ { "slug": "apt29", "name": "APT29", "matched": "Cozy Bear", "kind": "alias", "org": "crowdstrike" } ], "unc2452": [ { "slug": "apt29", "name": "APT29", "matched": "UNC2452", "kind": "alias", "org": "mandiant" } ], "iron ritual": [ { "slug": "apt29", "name": "APT29", "matched": "IRON RITUAL", "kind": "alias", "org": "secureworks" } ], "iron hemlock": [ { "slug": "apt29", "name": "APT29", "matched": "IRON HEMLOCK", "kind": "alias", "org": "secureworks" } ], "cloaked ursa": [ { "slug": "apt29", "name": "APT29", "matched": "Cloaked Ursa", "kind": "alias", "org": "unit42" } ], "bluebravo": [ { "slug": "apt29", "name": "APT29", "matched": "BlueBravo", "kind": "alias", "org": "recordedfuture" } ], "the dukes": [ { "slug": "apt29", "name": "APT29", "matched": "The Dukes", "kind": "alias", "org": "eset" } ], "cozyduke": [ { "slug": "apt29", "name": "APT29", "matched": "CozyDuke", "kind": "alias", "org": "kaspersky" } ], "earth koshchei": [ { "slug": "apt29", "name": "APT29", "matched": "Earth Koshchei", "kind": "alias", "org": "trendmicro" } ], "svr": [ { "slug": "apt29", "name": "APT29", "matched": "SVR", "kind": "alias", "org": "cisa" } ], "sunburst": [ { "slug": "apt29", "name": "APT29", "matched": "SUNBURST", "kind": "tool", "org": null } ], "teardrop": [ { "slug": "apt29", "name": "APT29", "matched": "TEARDROP", "kind": "tool", "org": null } ], "raindrop": [ { "slug": "apt29", "name": "APT29", "matched": "RAINDROP", "kind": "tool", "org": null } ], "foggyweb": [ { "slug": "apt29", "name": "APT29", "matched": "FoggyWeb", "kind": "tool", "org": null } ], "magicweb": [ { "slug": "apt29", "name": "APT29", "matched": "MagicWeb", "kind": "tool", "org": null } ], "wineloader": [ { "slug": "apt29", "name": "APT29", "matched": "WINELOADER", "kind": "tool", "org": null } ], "envyscout": [ { "slug": "apt29", "name": "APT29", "matched": "EnvyScout", "kind": "tool", "org": null } ], "goldmax": [ { "slug": "apt29", "name": "APT29", "matched": "GoldMax", "kind": "tool", "org": null } ], "wellmess": [ { "slug": "apt29", "name": "APT29", "matched": "WellMess", "kind": "tool", "org": null } ], "golden saml": [ { "slug": "apt29", "name": "APT29", "matched": "Golden SAML", "kind": "tool", "org": null } ], "cobalt strike": [ { "slug": "apt29", "name": "APT29", "matched": "Cobalt Strike", "kind": "tool", "org": null }, { "slug": "apt41", "name": "APT41", "matched": "Cobalt Strike", "kind": "tool", "org": null }, { "slug": "lockbit", "name": "LockBit", "matched": "Cobalt Strike", "kind": "tool", "org": null }, { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "Cobalt Strike", "kind": "tool", "org": null }, { "slug": "apt31", "name": "APT31", "matched": "Cobalt Strike", "kind": "tool", "org": null }, { "slug": "apt32", "name": "APT32", "matched": "Cobalt Strike", "kind": "tool", "org": null } ], "adfind": [ { "slug": "apt29", "name": "APT29", "matched": "AdFind", "kind": "tool", "org": null } ], "sandworm": [ { "slug": "sandworm", "name": "Sandworm", "matched": "Sandworm", "kind": "name", "org": null } ], "g0034": [ { "slug": "sandworm", "name": "Sandworm", "matched": "G0034", "kind": "alias", "org": "mitre" } ], "sandworm team": [ { "slug": "sandworm", "name": "Sandworm", "matched": "Sandworm Team", "kind": "alias", "org": "mitre" } ], "seashell blizzard": [ { "slug": "sandworm", "name": "Sandworm", "matched": "Seashell Blizzard", "kind": "alias", "org": "microsoft" } ], "iridium": [ { "slug": "sandworm", "name": "Sandworm", "matched": "IRIDIUM", "kind": "alias", "org": "microsoft" } ], "voodoo bear": [ { "slug": "sandworm", "name": "Sandworm", "matched": "Voodoo Bear", "kind": "alias", "org": "crowdstrike" } ], "apt44": [ { "slug": "sandworm", "name": "Sandworm", "matched": "APT44", "kind": "alias", "org": "mandiant" } ], "frozenbarents": [ { "slug": "sandworm", "name": "Sandworm", "matched": "FROZENBARENTS", "kind": "alias", "org": "mandiant" } ], "iron viking": [ { "slug": "sandworm", "name": "Sandworm", "matched": "IRON VIKING", "kind": "alias", "org": "secureworks" } ], "electrum": [ { "slug": "sandworm", "name": "Sandworm", "matched": "ELECTRUM", "kind": "alias", "org": "dragos" } ], "kamacite": [ { "slug": "sandworm", "name": "Sandworm", "matched": "KAMACITE", "kind": "alias", "org": "dragos" } ], "telebots": [ { "slug": "sandworm", "name": "Sandworm", "matched": "TeleBots", "kind": "alias", "org": "eset" } ], "blackenergy group": [ { "slug": "sandworm", "name": "Sandworm", "matched": "BlackEnergy Group", "kind": "alias", "org": "eset" } ], "hades": [ { "slug": "sandworm", "name": "Sandworm", "matched": "Hades", "kind": "alias", "org": "kaspersky" } ], "gru unit 74455": [ { "slug": "sandworm", "name": "Sandworm", "matched": "GRU Unit 74455", "kind": "alias", "org": "cisa" } ], "uac 0002": [ { "slug": "sandworm", "name": "Sandworm", "matched": "UAC-0002", "kind": "alias", "org": "recordedfuture" } ], "industroyer crashoverride": [ { "slug": "sandworm", "name": "Sandworm", "matched": "Industroyer / CrashOverride", "kind": "tool", "org": null } ], "industroyer2": [ { "slug": "sandworm", "name": "Sandworm", "matched": "Industroyer2", "kind": "tool", "org": null } ], "notpetya": [ { "slug": "sandworm", "name": "Sandworm", "matched": "NotPetya", "kind": "tool", "org": null } ], "blackenergy 3": [ { "slug": "sandworm", "name": "Sandworm", "matched": "BlackEnergy 3", "kind": "tool", "org": null } ], "olympic destroyer": [ { "slug": "sandworm", "name": "Sandworm", "matched": "Olympic Destroyer", "kind": "tool", "org": null } ], "acidrain": [ { "slug": "sandworm", "name": "Sandworm", "matched": "AcidRain", "kind": "tool", "org": null } ], "hermeticwiper": [ { "slug": "sandworm", "name": "Sandworm", "matched": "HermeticWiper", "kind": "tool", "org": null } ], "caddywiper": [ { "slug": "sandworm", "name": "Sandworm", "matched": "CaddyWiper", "kind": "tool", "org": null } ], "vpnfilter": [ { "slug": "sandworm", "name": "Sandworm", "matched": "VPNFilter", "kind": "tool", "org": null } ], "killdisk": [ { "slug": "sandworm", "name": "Sandworm", "matched": "KillDisk", "kind": "tool", "org": null } ], "exaramel": [ { "slug": "sandworm", "name": "Sandworm", "matched": "Exaramel", "kind": "tool", "org": null } ], "unit 74455": [ { "slug": "sandworm", "name": "Sandworm", "matched": "Unit 74455", "kind": "unit", "org": null } ], "lazarus group": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "Lazarus Group", "kind": "name", "org": null } ], "lazarus": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "Lazarus", "kind": "name", "org": null } ], "g0032": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "G0032", "kind": "alias", "org": "mitre" } ], "diamond sleet": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "Diamond Sleet", "kind": "alias", "org": "microsoft" } ], "zinc": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "ZINC", "kind": "alias", "org": "microsoft" } ], "labyrinth chollima": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "Labyrinth Chollima", "kind": "alias", "org": "crowdstrike" } ], "apt38": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "APT38", "kind": "alias", "org": "mandiant" }, { "slug": "apt38", "name": "APT38", "matched": "APT38", "kind": "name", "org": null } ], "temp hermit": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "TEMP.Hermit", "kind": "alias", "org": "mandiant" } ], "nickel academy": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "NICKEL ACADEMY", "kind": "alias", "org": "secureworks" } ], "slow pisces": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "Slow Pisces", "kind": "alias", "org": "unit42" } ], "hidden cobra": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "HIDDEN COBRA", "kind": "alias", "org": "cisa" } ], "appleworm": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "Appleworm", "kind": "alias", "org": "symantec" } ], "tag 71": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "TAG-71", "kind": "alias", "org": "recordedfuture" }, { "slug": "kimsuky", "name": "Kimsuky", "matched": "TAG-71", "kind": "alias", "org": "recordedfuture" } ], "wannacry": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "WannaCry", "kind": "tool", "org": null } ], "applejeus": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "AppleJeus", "kind": "tool", "org": null } ], "operation dream job lures": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "Operation Dream Job lures", "kind": "tool", "org": null } ], "magicrat quiterat": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "MagicRAT / QuiteRAT", "kind": "tool", "org": null } ], "blindingcan": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "BLINDINGCAN", "kind": "tool", "org": null } ], "tradertraitor": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "TraderTraitor", "kind": "tool", "org": null } ], "fudmodule": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "FudModule", "kind": "tool", "org": null } ], "tornado cash mixers": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "Tornado Cash / mixers", "kind": "tool", "org": null } ], "lab 110 3rd bureau": [ { "slug": "lazarus-group", "name": "Lazarus Group", "matched": "Lab 110 / 3rd Bureau", "kind": "unit", "org": null } ], "volt typhoon": [ { "slug": "volt-typhoon", "name": "Volt Typhoon", "matched": "Volt Typhoon", "kind": "name", "org": null } ], "g1017": [ { "slug": "volt-typhoon", "name": "Volt Typhoon", "matched": "G1017", "kind": "alias", "org": "mitre" } ], "vanguard panda": [ { "slug": "volt-typhoon", "name": "Volt Typhoon", "matched": "VANGUARD PANDA", "kind": "alias", "org": "crowdstrike" } ], "unc3236": [ { "slug": "volt-typhoon", "name": "Volt Typhoon", "matched": "UNC3236", "kind": "alias", "org": "mandiant" } ], "bronze silhouette": [ { "slug": "volt-typhoon", "name": "Volt Typhoon", "matched": "BRONZE SILHOUETTE", "kind": "alias", "org": "secureworks" }, { "slug": "silk-typhoon", "name": "Silk Typhoon", "matched": "BRONZE SILHOUETTE", "kind": "alias", "org": "secureworks" } ], "insidious taurus": [ { "slug": "volt-typhoon", "name": "Volt Typhoon", "matched": "Insidious Taurus", "kind": "alias", "org": "unit42" } ], "voltzite": [ { "slug": "volt-typhoon", "name": "Volt Typhoon", "matched": "VOLTZITE", "kind": "alias", "org": "dragos" } ], "wmic": [ { "slug": "volt-typhoon", "name": "Volt Typhoon", "matched": "wmic", "kind": "tool", "org": null } ], "ntdsutil": [ { "slug": "volt-typhoon", "name": "Volt Typhoon", "matched": "ntdsutil", "kind": "tool", "org": null } ], "netsh": [ { "slug": "volt-typhoon", "name": "Volt Typhoon", "matched": "netsh", "kind": "tool", "org": null } ], "kv botnet": [ { "slug": "volt-typhoon", "name": "Volt Typhoon", "matched": "KV Botnet", "kind": "tool", "org": null } ], "fast reverse proxy frp": [ { "slug": "volt-typhoon", "name": "Volt Typhoon", "matched": "Fast Reverse Proxy (frp)", "kind": "tool", "org": null } ], "earthworm awen": [ { "slug": "volt-typhoon", "name": "Volt Typhoon", "matched": "Earthworm / Awen", "kind": "tool", "org": null } ], "salt typhoon": [ { "slug": "salt-typhoon", "name": "Salt Typhoon", "matched": "Salt Typhoon", "kind": "name", "org": null } ], "operator panda": [ { "slug": "salt-typhoon", "name": "Salt Typhoon", "matched": "OPERATOR PANDA", "kind": "alias", "org": "crowdstrike" } ], "earth estries": [ { "slug": "salt-typhoon", "name": "Salt Typhoon", "matched": "Earth Estries", "kind": "alias", "org": "trendmicro" } ], "ghostemperor": [ { "slug": "salt-typhoon", "name": "Salt Typhoon", "matched": "GhostEmperor", "kind": "alias", "org": "kaspersky" } ], "redmike": [ { "slug": "salt-typhoon", "name": "Salt Typhoon", "matched": "RedMike", "kind": "alias", "org": "recordedfuture" } ], "unc5807": [ { "slug": "salt-typhoon", "name": "Salt Typhoon", "matched": "UNC5807", "kind": "alias", "org": "mandiant" } ], "bronze essay": [ { "slug": "salt-typhoon", "name": "Salt Typhoon", "matched": "BRONZE ESSAY", "kind": "alias", "org": "secureworks" } ], "demodex": [ { "slug": "salt-typhoon", "name": "Salt Typhoon", "matched": "Demodex", "kind": "tool", "org": null } ], "ghostspider": [ { "slug": "salt-typhoon", "name": "Salt Typhoon", "matched": "GhostSpider", "kind": "tool", "org": null } ], "snappybee": [ { "slug": "salt-typhoon", "name": "Salt Typhoon", "matched": "SNAPPYBEE", "kind": "tool", "org": null } ], "jumbledpath": [ { "slug": "salt-typhoon", "name": "Salt Typhoon", "matched": "JumbledPath", "kind": "tool", "org": null } ], "cisco ios configuration abuse": [ { "slug": "salt-typhoon", "name": "Salt Typhoon", "matched": "Cisco IOS configuration abuse", "kind": "tool", "org": null } ], "masol rat": [ { "slug": "salt-typhoon", "name": "Salt Typhoon", "matched": "Masol RAT", "kind": "tool", "org": null } ], "apt41": [ { "slug": "apt41", "name": "APT41", "matched": "APT41", "kind": "name", "org": null } ], "g0096": [ { "slug": "apt41", "name": "APT41", "matched": "G0096", "kind": "alias", "org": "mitre" } ], "brass typhoon": [ { "slug": "apt41", "name": "APT41", "matched": "Brass Typhoon", "kind": "alias", "org": "microsoft" } ], "barium": [ { "slug": "apt41", "name": "APT41", "matched": "BARIUM", "kind": "alias", "org": "microsoft" } ], "wicked panda": [ { "slug": "apt41", "name": "APT41", "matched": "Wicked Panda", "kind": "alias", "org": "crowdstrike" } ], "double dragon": [ { "slug": "apt41", "name": "APT41", "matched": "Double Dragon", "kind": "alias", "org": "mandiant" } ], "bronze atlas": [ { "slug": "apt41", "name": "APT41", "matched": "BRONZE ATLAS", "kind": "alias", "org": "secureworks" } ], "grayfly": [ { "slug": "apt41", "name": "APT41", "matched": "Grayfly", "kind": "alias", "org": "symantec" } ], "blackfly": [ { "slug": "apt41", "name": "APT41", "matched": "Blackfly", "kind": "alias", "org": "symantec" } ], "winnti": [ { "slug": "apt41", "name": "APT41", "matched": "Winnti", "kind": "alias", "org": "kaspersky" } ], "earth baku": [ { "slug": "apt41", "name": "APT41", "matched": "Earth Baku", "kind": "alias", "org": "trendmicro" } ], "shadowpad": [ { "slug": "apt41", "name": "APT41", "matched": "ShadowPad", "kind": "tool", "org": null } ], "messagetap": [ { "slug": "apt41", "name": "APT41", "matched": "MESSAGETAP", "kind": "tool", "org": null } ], "dustpan dusttrap": [ { "slug": "apt41", "name": "APT41", "matched": "DUSTPAN / DUSTTRAP", "kind": "tool", "org": null } ], "keyplug": [ { "slug": "apt41", "name": "APT41", "matched": "KEYPLUG", "kind": "tool", "org": null } ], "stolen code signing certificates": [ { "slug": "apt41", "name": "APT41", "matched": "Stolen code-signing certificates", "kind": "tool", "org": null } ], "lowkey": [ { "slug": "apt41", "name": "APT41", "matched": "LOWKEY", "kind": "tool", "org": null } ], "scattered spider": [ { "slug": "scattered-spider", "name": "Scattered Spider", "matched": "Scattered Spider", "kind": "name", "org": null } ], "g1015": [ { "slug": "scattered-spider", "name": "Scattered Spider", "matched": "G1015", "kind": "alias", "org": "mitre" } ], "octo tempest": [ { "slug": "scattered-spider", "name": "Scattered Spider", "matched": "Octo Tempest", "kind": "alias", "org": "microsoft" } ], "unc3944": [ { "slug": "scattered-spider", "name": "Scattered Spider", "matched": "UNC3944", "kind": "alias", "org": "mandiant" } ], "muddled libra": [ { "slug": "scattered-spider", "name": "Scattered Spider", "matched": "Muddled Libra", "kind": "alias", "org": "unit42" } ], "water curupira": [ { "slug": "scattered-spider", "name": "Scattered Spider", "matched": "Water Curupira", "kind": "alias", "org": "trendmicro" } ], "gold harvester": [ { "slug": "scattered-spider", "name": "Scattered Spider", "matched": "GOLD HARVESTER", "kind": "alias", "org": "secureworks" } ], "help desk social engineering": [ { "slug": "scattered-spider", "name": "Scattered Spider", "matched": "Help desk social engineering", "kind": "tool", "org": null } ], "mfa fatigue": [ { "slug": "scattered-spider", "name": "Scattered Spider", "matched": "MFA fatigue", "kind": "tool", "org": null } ], "sim swapping": [ { "slug": "scattered-spider", "name": "Scattered Spider", "matched": "SIM swapping", "kind": "tool", "org": null } ], "evilginx aitm kits": [ { "slug": "scattered-spider", "name": "Scattered Spider", "matched": "Evilginx / AiTM kits", "kind": "tool", "org": null } ], "legitimate rmm tools": [ { "slug": "scattered-spider", "name": "Scattered Spider", "matched": "Legitimate RMM tools", "kind": "tool", "org": null }, { "slug": "lockbit", "name": "LockBit", "matched": "Legitimate RMM tools", "kind": "tool", "org": null } ], "alphv ransomhub dragonforce": [ { "slug": "scattered-spider", "name": "Scattered Spider", "matched": "ALPHV / RansomHub / DragonForce", "kind": "tool", "org": null } ], "vishing and smishing": [ { "slug": "scattered-spider", "name": "Scattered Spider", "matched": "Vishing and smishing", "kind": "tool", "org": null } ], "turla": [ { "slug": "turla", "name": "Turla", "matched": "Turla", "kind": "name", "org": null } ], "g0010": [ { "slug": "turla", "name": "Turla", "matched": "G0010", "kind": "alias", "org": "mitre" } ], "secret blizzard": [ { "slug": "turla", "name": "Turla", "matched": "Secret Blizzard", "kind": "alias", "org": "microsoft" } ], "krypton": [ { "slug": "turla", "name": "Turla", "matched": "KRYPTON", "kind": "alias", "org": "microsoft" } ], "venomous bear": [ { "slug": "turla", "name": "Turla", "matched": "Venomous Bear", "kind": "alias", "org": "crowdstrike" } ], "iron hunter": [ { "slug": "turla", "name": "Turla", "matched": "IRON HUNTER", "kind": "alias", "org": "secureworks" } ], "pensive ursa": [ { "slug": "turla", "name": "Turla", "matched": "Pensive Ursa", "kind": "alias", "org": "unit42" } ], "uroburos": [ { "slug": "turla", "name": "Turla", "matched": "Uroburos", "kind": "alias", "org": "kaspersky" } ], "waterbug": [ { "slug": "turla", "name": "Turla", "matched": "Waterbug", "kind": "alias", "org": "symantec" } ], "snake fsb centre 16": [ { "slug": "turla", "name": "Turla", "matched": "Snake / FSB Centre 16", "kind": "alias", "org": "cisa" } ], "group 88": [ { "slug": "turla", "name": "Turla", "matched": "Group 88", "kind": "alias", "org": "recordedfuture" } ], "snake uroburos": [ { "slug": "turla", "name": "Turla", "matched": "Snake / Uroburos", "kind": "tool", "org": null } ], "comrat": [ { "slug": "turla", "name": "Turla", "matched": "ComRAT", "kind": "tool", "org": null } ], "lightneuron": [ { "slug": "turla", "name": "Turla", "matched": "LightNeuron", "kind": "tool", "org": null } ], "kazuar": [ { "slug": "turla", "name": "Turla", "matched": "Kazuar", "kind": "tool", "org": null } ], "tinyturla tinyturla ng": [ { "slug": "turla", "name": "Turla", "matched": "TinyTurla / TinyTurla-NG", "kind": "tool", "org": null } ], "crutch": [ { "slug": "turla", "name": "Turla", "matched": "Crutch", "kind": "tool", "org": null } ], "carbon": [ { "slug": "turla", "name": "Turla", "matched": "Carbon", "kind": "tool", "org": null } ], "hyperstack": [ { "slug": "turla", "name": "Turla", "matched": "HyperStack", "kind": "tool", "org": null } ], "satellite c2 hijacking": [ { "slug": "turla", "name": "Turla", "matched": "Satellite C2 hijacking", "kind": "tool", "org": null } ], "centre 16": [ { "slug": "turla", "name": "Turla", "matched": "Centre 16", "kind": "unit", "org": null }, { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "Centre 16", "kind": "unit", "org": null } ], "cl0p": [ { "slug": "cl0p", "name": "Cl0p", "matched": "Cl0p", "kind": "name", "org": null } ], "lace tempest": [ { "slug": "cl0p", "name": "Cl0p", "matched": "Lace Tempest", "kind": "alias", "org": "microsoft" } ], "graceful spider": [ { "slug": "cl0p", "name": "Cl0p", "matched": "Graceful Spider", "kind": "alias", "org": "crowdstrike" } ], "fin11": [ { "slug": "cl0p", "name": "Cl0p", "matched": "FIN11", "kind": "alias", "org": "mandiant" } ], "ta505": [ { "slug": "cl0p", "name": "Cl0p", "matched": "TA505", "kind": "alias", "org": "proofpoint" } ], "gold tahoe": [ { "slug": "cl0p", "name": "Cl0p", "matched": "GOLD TAHOE", "kind": "alias", "org": "secureworks" } ], "cl0p ta505": [ { "slug": "cl0p", "name": "Cl0p", "matched": "CL0P / TA505", "kind": "alias", "org": "cisa" } ], "baleful scorpius": [ { "slug": "cl0p", "name": "Cl0p", "matched": "Baleful Scorpius", "kind": "alias", "org": "unit42" } ], "lemurloot": [ { "slug": "cl0p", "name": "Cl0p", "matched": "LEMURLOOT", "kind": "tool", "org": null } ], "dewmode": [ { "slug": "cl0p", "name": "Cl0p", "matched": "DEWMODE", "kind": "tool", "org": null } ], "cl0p ransomware": [ { "slug": "cl0p", "name": "Cl0p", "matched": "Cl0p ransomware", "kind": "tool", "org": null } ], "truebot": [ { "slug": "cl0p", "name": "Cl0p", "matched": "TrueBot", "kind": "tool", "org": null } ], "leak site": [ { "slug": "cl0p", "name": "Cl0p", "matched": "Leak site", "kind": "tool", "org": null } ], "silk typhoon": [ { "slug": "silk-typhoon", "name": "Silk Typhoon", "matched": "Silk Typhoon", "kind": "name", "org": null } ], "hafnium": [ { "slug": "silk-typhoon", "name": "Silk Typhoon", "matched": "HAFNIUM", "kind": "alias", "org": "microsoft" } ], "murky panda": [ { "slug": "silk-typhoon", "name": "Silk Typhoon", "matched": "MURKY PANDA", "kind": "alias", "org": "crowdstrike" } ], "unc5221": [ { "slug": "silk-typhoon", "name": "Silk Typhoon", "matched": "UNC5221", "kind": "alias", "org": "mandiant" } ], "operation exchange marauder": [ { "slug": "silk-typhoon", "name": "Silk Typhoon", "matched": "Operation Exchange Marauder", "kind": "alias", "org": "kaspersky" } ], "china chopper": [ { "slug": "silk-typhoon", "name": "Silk Typhoon", "matched": "China Chopper", "kind": "tool", "org": null } ], "covenant": [ { "slug": "silk-typhoon", "name": "Silk Typhoon", "matched": "Covenant", "kind": "tool", "org": null } ], "nishang": [ { "slug": "silk-typhoon", "name": "Silk Typhoon", "matched": "Nishang", "kind": "tool", "org": null } ], "powercat": [ { "slug": "silk-typhoon", "name": "Silk Typhoon", "matched": "PowerCat", "kind": "tool", "org": null } ], "stolen api keys": [ { "slug": "silk-typhoon", "name": "Silk Typhoon", "matched": "Stolen API keys", "kind": "tool", "org": null } ], "opera cobalt strike loader": [ { "slug": "silk-typhoon", "name": "Silk Typhoon", "matched": "Opera Cobalt Strike loader", "kind": "tool", "org": null } ], "lockbit": [ { "slug": "lockbit", "name": "LockBit", "matched": "LockBit", "kind": "name", "org": null } ], "storm 0506": [ { "slug": "lockbit", "name": "LockBit", "matched": "Storm-0506", "kind": "alias", "org": "microsoft" } ], "bitwise spider": [ { "slug": "lockbit", "name": "LockBit", "matched": "Bitwise Spider", "kind": "alias", "org": "crowdstrike" } ], "unc2165": [ { "slug": "lockbit", "name": "LockBit", "matched": "UNC2165", "kind": "alias", "org": "mandiant" } ], "gold mystic": [ { "slug": "lockbit", "name": "LockBit", "matched": "GOLD MYSTIC", "kind": "alias", "org": "secureworks" } ], "ambitious scorpius": [ { "slug": "lockbit", "name": "LockBit", "matched": "Ambitious Scorpius", "kind": "alias", "org": "unit42" } ], "water selkie": [ { "slug": "lockbit", "name": "LockBit", "matched": "Water Selkie", "kind": "alias", "org": "trendmicro" } ], "lockbit 2 0 3 0 green": [ { "slug": "lockbit", "name": "LockBit", "matched": "LockBit 2.0 / 3.0 / Green", "kind": "tool", "org": null } ], "stealbit": [ { "slug": "lockbit", "name": "LockBit", "matched": "StealBit", "kind": "tool", "org": null } ], "affiliate control panel": [ { "slug": "lockbit", "name": "LockBit", "matched": "Affiliate control panel", "kind": "tool", "org": null } ], "apt35": [ { "slug": "apt35", "name": "APT35", "matched": "APT35", "kind": "name", "org": null } ], "g0059": [ { "slug": "apt35", "name": "APT35", "matched": "G0059", "kind": "alias", "org": "mitre" } ], "magic hound": [ { "slug": "apt35", "name": "APT35", "matched": "Magic Hound", "kind": "alias", "org": "mitre" } ], "mint sandstorm": [ { "slug": "apt35", "name": "APT35", "matched": "Mint Sandstorm", "kind": "alias", "org": "microsoft" } ], "phosphorus": [ { "slug": "apt35", "name": "APT35", "matched": "PHOSPHORUS", "kind": "alias", "org": "microsoft" } ], "charming kitten": [ { "slug": "apt35", "name": "APT35", "matched": "Charming Kitten", "kind": "alias", "org": "crowdstrike" } ], "cobalt illusion": [ { "slug": "apt35", "name": "APT35", "matched": "COBALT ILLUSION", "kind": "alias", "org": "secureworks" } ], "ta453": [ { "slug": "apt35", "name": "APT35", "matched": "TA453", "kind": "alias", "org": "proofpoint" } ], "charming serpens": [ { "slug": "apt35", "name": "APT35", "matched": "Charming Serpens", "kind": "alias", "org": "unit42" } ], "itg18": [ { "slug": "apt35", "name": "APT35", "matched": "ITG18", "kind": "alias", "org": "recordedfuture" } ], "earth vetala": [ { "slug": "apt35", "name": "APT35", "matched": "Earth Vetala", "kind": "alias", "org": "trendmicro" }, { "slug": "muddywater", "name": "MuddyWater", "matched": "Earth Vetala", "kind": "alias", "org": "trendmicro" } ], "powerstar gorjolecho": [ { "slug": "apt35", "name": "APT35", "matched": "POWERSTAR / GorjolEcho", "kind": "tool", "org": null } ], "hyperscrape": [ { "slug": "apt35", "name": "APT35", "matched": "HYPERSCRAPE", "kind": "tool", "org": null }, { "slug": "star-blizzard", "name": "Star Blizzard", "matched": "HYPERSCRAPE", "kind": "tool", "org": null } ], "evilginx style aitm proxies": [ { "slug": "apt35", "name": "APT35", "matched": "Evilginx-style AiTM proxies", "kind": "tool", "org": null } ], "bellaciao": [ { "slug": "apt35", "name": "APT35", "matched": "BellaCiao", "kind": "tool", "org": null } ], "fake video conferencing": [ { "slug": "apt35", "name": "APT35", "matched": "Fake video conferencing", "kind": "tool", "org": null } ], "powerless": [ { "slug": "apt35", "name": "APT35", "matched": "PowerLess", "kind": "tool", "org": null } ], "irgc affiliated contractors including emennet pasargad and mahak rayan afraz": [ { "slug": "apt35", "name": "APT35", "matched": "IRGC-affiliated contractors, including Emennet Pasargad and Mahak Rayan Afraz", "kind": "unit", "org": null } ], "apt10": [ { "slug": "apt10", "name": "APT10", "matched": "APT10", "kind": "name", "org": null } ], "g0045": [ { "slug": "apt10", "name": "APT10", "matched": "G0045", "kind": "alias", "org": "mitre" } ], "menupass": [ { "slug": "apt10", "name": "APT10", "matched": "menuPass", "kind": "alias", "org": "mitre" } ], "stone panda": [ { "slug": "apt10", "name": "APT10", "matched": "Stone Panda", "kind": "alias", "org": "crowdstrike" } ], "bronze riverside": [ { "slug": "apt10", "name": "APT10", "matched": "BRONZE RIVERSIDE", "kind": "alias", "org": "secureworks" } ], "cicada": [ { "slug": "apt10", "name": "APT10", "matched": "Cicada", "kind": "alias", "org": "symantec" } ], "chessmaster": [ { "slug": "apt10", "name": "APT10", "matched": "Chessmaster", "kind": "alias", "org": "trendmicro" } ], "redapollo": [ { "slug": "apt10", "name": "APT10", "matched": "RedApollo", "kind": "alias", "org": "recordedfuture" } ], "apt10 tianjin state security bureau": [ { "slug": "apt10", "name": "APT10", "matched": "APT10 / Tianjin State Security Bureau", "kind": "alias", "org": "cisa" } ], "cvnx": [ { "slug": "apt10", "name": "APT10", "matched": "CVNX", "kind": "alias", "org": "kaspersky" } ], "ta429": [ { "slug": "apt10", "name": "APT10", "matched": "TA429", "kind": "alias", "org": "proofpoint" } ], "plugx": [ { "slug": "apt10", "name": "APT10", "matched": "PlugX", "kind": "tool", "org": null }, { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "PlugX", "kind": "tool", "org": null } ], "quasarrat": [ { "slug": "apt10", "name": "APT10", "matched": "QuasarRAT", "kind": "tool", "org": null } ], "redleaves": [ { "slug": "apt10", "name": "APT10", "matched": "RedLeaves", "kind": "tool", "org": null } ], "chches": [ { "slug": "apt10", "name": "APT10", "matched": "ChChes", "kind": "tool", "org": null } ], "uppercut anel": [ { "slug": "apt10", "name": "APT10", "matched": "UPPERCUT / ANEL", "kind": "tool", "org": null } ], "lodeinfo": [ { "slug": "apt10", "name": "APT10", "matched": "LODEINFO", "kind": "tool", "org": null } ], "huaying haitai science and technology development co front company": [ { "slug": "apt10", "name": "APT10", "matched": "Huaying Haitai Science and Technology Development Co. (front company)", "kind": "unit", "org": null } ], "apt40": [ { "slug": "apt40", "name": "APT40", "matched": "APT40", "kind": "name", "org": null } ], "g0065": [ { "slug": "apt40", "name": "APT40", "matched": "G0065", "kind": "alias", "org": "mitre" } ], "gingham typhoon": [ { "slug": "apt40", "name": "APT40", "matched": "Gingham Typhoon", "kind": "alias", "org": "microsoft" } ], "gadolinium": [ { "slug": "apt40", "name": "APT40", "matched": "GADOLINIUM", "kind": "alias", "org": "microsoft" } ], "kryptonite panda": [ { "slug": "apt40", "name": "APT40", "matched": "Kryptonite Panda", "kind": "alias", "org": "crowdstrike" } ], "temp periscope": [ { "slug": "apt40", "name": "APT40", "matched": "TEMP.Periscope", "kind": "alias", "org": "mandiant" } ], "temp jumper": [ { "slug": "apt40", "name": "APT40", "matched": "TEMP.Jumper", "kind": "alias", "org": "mandiant" } ], "leviathan": [ { "slug": "apt40", "name": "APT40", "matched": "Leviathan", "kind": "alias", "org": "proofpoint" } ], "bronze mohawk": [ { "slug": "apt40", "name": "APT40", "matched": "BRONZE MOHAWK", "kind": "alias", "org": "secureworks" } ], "apt40 hainan state security department": [ { "slug": "apt40", "name": "APT40", "matched": "APT40 / Hainan State Security Department", "kind": "alias", "org": "cisa" } ], "islanddreams": [ { "slug": "apt40", "name": "APT40", "matched": "ISLANDDREAMS", "kind": "alias", "org": "recordedfuture" } ], "mudcarp": [ { "slug": "apt40", "name": "APT40", "matched": "MUDCARP", "kind": "alias", "org": "kaspersky" } ], "derusbi": [ { "slug": "apt40", "name": "APT40", "matched": "Derusbi", "kind": "tool", "org": null } ], "murkytop": [ { "slug": "apt40", "name": "APT40", "matched": "MURKYTOP", "kind": "tool", "org": null } ], "badflick": [ { "slug": "apt40", "name": "APT40", "matched": "BADFLICK", "kind": "tool", "org": null } ], "photo derusbi variants": [ { "slug": "apt40", "name": "APT40", "matched": "PHOTO / Derusbi variants", "kind": "tool", "org": null } ], "compromised soho routers": [ { "slug": "apt40", "name": "APT40", "matched": "Compromised SOHO routers", "kind": "tool", "org": null } ], "web shells": [ { "slug": "apt40", "name": "APT40", "matched": "Web shells", "kind": "tool", "org": null } ], "hainan xiandun technology development co front company": [ { "slug": "apt40", "name": "APT40", "matched": "Hainan Xiandun Technology Development Co. (front company)", "kind": "unit", "org": null } ], "g0082": [ { "slug": "apt38", "name": "APT38", "matched": "G0082", "kind": "alias", "org": "mitre" } ], "sapphire sleet": [ { "slug": "apt38", "name": "APT38", "matched": "Sapphire Sleet", "kind": "alias", "org": "microsoft" } ], "stardust chollima": [ { "slug": "apt38", "name": "APT38", "matched": "Stardust Chollima", "kind": "alias", "org": "crowdstrike" } ], "bluenoroff": [ { "slug": "apt38", "name": "APT38", "matched": "BlueNoroff", "kind": "alias", "org": "kaspersky" } ], "nickel gladstone": [ { "slug": "apt38", "name": "APT38", "matched": "NICKEL GLADSTONE", "kind": "alias", "org": "secureworks" } ], "sparkling pisces": [ { "slug": "apt38", "name": "APT38", "matched": "Sparkling Pisces", "kind": "alias", "org": "unit42" }, { "slug": "kimsuky", "name": "Kimsuky", "matched": "Sparkling Pisces", "kind": "alias", "org": "unit42" } ], "beagleboyz": [ { "slug": "apt38", "name": "APT38", "matched": "BeagleBoyz", "kind": "alias", "org": "cisa" } ], "fastcash": [ { "slug": "apt38", "name": "APT38", "matched": "FASTCash", "kind": "tool", "org": null } ], "dyepack": [ { "slug": "apt38", "name": "APT38", "matched": "DYEPACK", "kind": "tool", "org": null } ], "mata framework": [ { "slug": "apt38", "name": "APT38", "matched": "MATA framework", "kind": "tool", "org": null } ], "snatchcrypto lures": [ { "slug": "apt38", "name": "APT38", "matched": "SnatchCrypto lures", "kind": "tool", "org": null } ], "custom wipers": [ { "slug": "apt38", "name": "APT38", "matched": "Custom wipers", "kind": "tool", "org": null } ], "rustbucket": [ { "slug": "apt38", "name": "APT38", "matched": "RustBucket", "kind": "tool", "org": null } ], "bluenoroff financial operations element": [ { "slug": "apt38", "name": "APT38", "matched": "Bluenoroff / financial operations element", "kind": "unit", "org": null } ], "mustang panda": [ { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "Mustang Panda", "kind": "name", "org": null } ], "g0129": [ { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "G0129", "kind": "alias", "org": "mitre" } ], "twill typhoon": [ { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "Twill Typhoon", "kind": "alias", "org": "microsoft" } ], "tantalum": [ { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "TANTALUM", "kind": "alias", "org": "microsoft" } ], "bronze president": [ { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "BRONZE PRESIDENT", "kind": "alias", "org": "secureworks" } ], "stately taurus": [ { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "Stately Taurus", "kind": "alias", "org": "unit42" } ], "earth preta": [ { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "Earth Preta", "kind": "alias", "org": "trendmicro" } ], "reddelta": [ { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "RedDelta", "kind": "alias", "org": "recordedfuture" } ], "ta416": [ { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "TA416", "kind": "alias", "org": "proofpoint" } ], "honeymyte": [ { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "HoneyMyte", "kind": "alias", "org": "kaspersky" } ], "camaro dragon": [ { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "Camaro Dragon", "kind": "alias", "org": "mandiant" } ], "pubload": [ { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "PUBLOAD", "kind": "tool", "org": null } ], "toneshell": [ { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "TONESHELL", "kind": "tool", "org": null } ], "hiupan mistcloak": [ { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "HIUPAN / MISTCLOAK", "kind": "tool", "org": null } ], "rtf template injection": [ { "slug": "mustang-panda", "name": "Mustang Panda", "matched": "RTF template injection", "kind": "tool", "org": null } ], "apt34": [ { "slug": "apt34", "name": "APT34", "matched": "APT34", "kind": "name", "org": null } ], "g0049": [ { "slug": "apt34", "name": "APT34", "matched": "G0049", "kind": "alias", "org": "mitre" } ], "oilrig": [ { "slug": "apt34", "name": "APT34", "matched": "OilRig", "kind": "alias", "org": "mitre" } ], "hazel sandstorm": [ { "slug": "apt34", "name": "APT34", "matched": "Hazel Sandstorm", "kind": "alias", "org": "microsoft" } ], "europium": [ { "slug": "apt34", "name": "APT34", "matched": "EUROPIUM", "kind": "alias", "org": "microsoft" } ], "helix kitten": [ { "slug": "apt34", "name": "APT34", "matched": "Helix Kitten", "kind": "alias", "org": "crowdstrike" } ], "cobalt gypsy": [ { "slug": "apt34", "name": "APT34", "matched": "COBALT GYPSY", "kind": "alias", "org": "secureworks" } ], "evasive serpens": [ { "slug": "apt34", "name": "APT34", "matched": "Evasive Serpens", "kind": "alias", "org": "unit42" } ], "earth simnavaz": [ { "slug": "apt34", "name": "APT34", "matched": "Earth Simnavaz", "kind": "alias", "org": "trendmicro" } ], "chrysene": [ { "slug": "apt34", "name": "APT34", "matched": "Chrysene", "kind": "alias", "org": "kaspersky" } ], "dnsexfiltrator dns tunnelling implants": [ { "slug": "apt34", "name": "APT34", "matched": "DNSExfiltrator / DNS tunnelling implants", "kind": "tool", "org": null } ], "powruner bondupdater": [ { "slug": "apt34", "name": "APT34", "matched": "POWRUNER / BONDUPDATER", "kind": "tool", "org": null } ], "karkoff": [ { "slug": "apt34", "name": "APT34", "matched": "Karkoff", "kind": "tool", "org": null } ], "sidetwist": [ { "slug": "apt34", "name": "APT34", "matched": "SideTwist", "kind": "tool", "org": null } ], "exchange as c2": [ { "slug": "apt34", "name": "APT34", "matched": "Exchange as C2", "kind": "tool", "org": null } ], "web shells rgdoor": [ { "slug": "apt34", "name": "APT34", "matched": "Web shells (RGDoor)", "kind": "tool", "org": null } ], "mimikatz variants": [ { "slug": "apt34", "name": "APT34", "matched": "Mimikatz variants", "kind": "tool", "org": null } ], "kimsuky": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "Kimsuky", "kind": "name", "org": null } ], "g0094": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "G0094", "kind": "alias", "org": "mitre" } ], "emerald sleet": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "Emerald Sleet", "kind": "alias", "org": "microsoft" } ], "thallium": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "THALLIUM", "kind": "alias", "org": "microsoft" } ], "velvet chollima": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "Velvet Chollima", "kind": "alias", "org": "crowdstrike" }, { "slug": "apt37", "name": "APT37", "matched": "Velvet Chollima", "kind": "alias", "org": "unit42" } ], "apt43": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "APT43", "kind": "alias", "org": "mandiant" } ], "nickel kimball": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "NICKEL KIMBALL", "kind": "alias", "org": "secureworks" } ], "ta427": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "TA427", "kind": "alias", "org": "proofpoint" } ], "kimsuky hidden cobra": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "Kimsuky / HIDDEN COBRA", "kind": "alias", "org": "cisa" } ], "babyshark": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "BabyShark", "kind": "tool", "org": null } ], "appleseed": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "AppleSeed", "kind": "tool", "org": null } ], "sharpext": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "SHARPEXT", "kind": "tool", "org": null } ], "reconshark": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "ReconShark", "kind": "tool", "org": null } ], "fake interview requests": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "Fake interview requests", "kind": "tool", "org": null } ], "chrome remote debugging": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "Chrome remote debugging", "kind": "tool", "org": null } ], "assessed within the rgb structure": [ { "slug": "kimsuky", "name": "Kimsuky", "matched": "Assessed within the RGB structure", "kind": "unit", "org": null } ], "muddywater": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "MuddyWater", "kind": "name", "org": null } ], "g0069": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "G0069", "kind": "alias", "org": "mitre" } ], "mango sandstorm": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "Mango Sandstorm", "kind": "alias", "org": "microsoft" } ], "mercury": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "MERCURY", "kind": "alias", "org": "microsoft" } ], "static kitten": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "Static Kitten", "kind": "alias", "org": "crowdstrike" } ], "temp zagros": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "TEMP.Zagros", "kind": "alias", "org": "mandiant" } ], "cobalt ulster": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "COBALT ULSTER", "kind": "alias", "org": "secureworks" } ], "boggy serpens": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "Boggy Serpens", "kind": "alias", "org": "unit42" } ], "muddywater mois": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "MuddyWater / MOIS", "kind": "alias", "org": "cisa" } ], "seedworm": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "Seedworm", "kind": "alias", "org": "kaspersky" } ], "atera agent": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "Atera Agent", "kind": "tool", "org": null } ], "screenconnect simplehelp": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "ScreenConnect / SimpleHelp", "kind": "tool", "org": null } ], "powgoop": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "PowGoop", "kind": "tool", "org": null } ], "smallsieve": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "SmallSieve", "kind": "tool", "org": null } ], "muddyc2go": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "MuddyC2Go", "kind": "tool", "org": null } ], "ligolo": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "Ligolo", "kind": "tool", "org": null } ], "chisel": [ { "slug": "muddywater", "name": "MuddyWater", "matched": "chisel", "kind": "tool", "org": null } ], "gamaredon": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "Gamaredon", "kind": "name", "org": null } ], "g0047": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "G0047", "kind": "alias", "org": "mitre" } ], "gamaredon group": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "Gamaredon Group", "kind": "alias", "org": "mitre" } ], "aqua blizzard": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "Aqua Blizzard", "kind": "alias", "org": "microsoft" } ], "actinium": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "ACTINIUM", "kind": "alias", "org": "microsoft" } ], "primitive bear": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "Primitive Bear", "kind": "alias", "org": "crowdstrike" } ], "trident ursa": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "Trident Ursa", "kind": "alias", "org": "unit42" } ], "iron tilden": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "IRON TILDEN", "kind": "alias", "org": "secureworks" } ], "bluealpha": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "BlueAlpha", "kind": "alias", "org": "recordedfuture" } ], "shuckworm": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "Shuckworm", "kind": "alias", "org": "symantec" } ], "armageddon": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "Armageddon", "kind": "alias", "org": "cisa" } ], "unc530": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "UNC530", "kind": "alias", "org": "mandiant" } ], "pterodo pteranodon": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "Pterodo / Pteranodon", "kind": "tool", "org": null } ], "gammaload": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "GammaLoad", "kind": "tool", "org": null } ], "gammasteel": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "GammaSteel", "kind": "tool", "org": null } ], "litterdrifter": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "LitterDrifter", "kind": "tool", "org": null } ], "powerpunch": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "PowerPunch", "kind": "tool", "org": null } ], "remote template injection": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "Remote template injection", "kind": "tool", "org": null }, { "slug": "sidewinder", "name": "SideWinder", "matched": "Remote template injection", "kind": "tool", "org": null } ], "18th centre crimean directorate": [ { "slug": "gamaredon", "name": "Gamaredon", "matched": "18th Centre / Crimean directorate", "kind": "unit", "org": null } ], "fin7": [ { "slug": "fin7", "name": "FIN7", "matched": "FIN7", "kind": "name", "org": null } ], "g0046": [ { "slug": "fin7", "name": "FIN7", "matched": "G0046", "kind": "alias", "org": "mitre" } ], "sangria tempest": [ { "slug": "fin7", "name": "FIN7", "matched": "Sangria Tempest", "kind": "alias", "org": "microsoft" } ], "carbon spider": [ { "slug": "fin7", "name": "FIN7", "matched": "Carbon Spider", "kind": "alias", "org": "crowdstrike" } ], "gold niagara": [ { "slug": "fin7", "name": "FIN7", "matched": "GOLD NIAGARA", "kind": "alias", "org": "secureworks" } ], "carbanak": [ { "slug": "fin7", "name": "FIN7", "matched": "Carbanak", "kind": "alias", "org": "symantec" } ], "griffon boostwrite": [ { "slug": "fin7", "name": "FIN7", "matched": "GRIFFON / BOOSTWRITE", "kind": "tool", "org": null } ], "badusb packages": [ { "slug": "fin7", "name": "FIN7", "matched": "BadUSB packages", "kind": "tool", "org": null } ], "point of sale malware": [ { "slug": "fin7", "name": "FIN7", "matched": "Point-of-sale malware", "kind": "tool", "org": null } ], "aukill edr killers": [ { "slug": "fin7", "name": "FIN7", "matched": "AuKill / EDR killers", "kind": "tool", "org": null } ], "ransomware affiliations": [ { "slug": "fin7", "name": "FIN7", "matched": "Ransomware affiliations", "kind": "tool", "org": null } ], "apt31": [ { "slug": "apt31", "name": "APT31", "matched": "APT31", "kind": "name", "org": null } ], "g0128": [ { "slug": "apt31", "name": "APT31", "matched": "G0128", "kind": "alias", "org": "mitre" } ], "violet typhoon": [ { "slug": "apt31", "name": "APT31", "matched": "Violet Typhoon", "kind": "alias", "org": "microsoft" } ], "zirconium": [ { "slug": "apt31", "name": "APT31", "matched": "ZIRCONIUM", "kind": "alias", "org": "microsoft" } ], "judgment panda": [ { "slug": "apt31", "name": "APT31", "matched": "Judgment Panda", "kind": "alias", "org": "crowdstrike" } ], "bronze vinewood": [ { "slug": "apt31", "name": "APT31", "matched": "BRONZE VINEWOOD", "kind": "alias", "org": "secureworks" } ], "ta412": [ { "slug": "apt31", "name": "APT31", "matched": "TA412", "kind": "alias", "org": "proofpoint" } ], "apt31 hubei state security department": [ { "slug": "apt31", "name": "APT31", "matched": "APT31 / Hubei State Security Department", "kind": "alias", "org": "cisa" } ], "redbravo": [ { "slug": "apt31", "name": "APT31", "matched": "RedBravo", "kind": "alias", "org": "recordedfuture" } ], "tracking pixels": [ { "slug": "apt31", "name": "APT31", "matched": "Tracking pixels", "kind": "tool", "org": null } ], "rawdoor": [ { "slug": "apt31", "name": "APT31", "matched": "RAWDOOR", "kind": "tool", "org": null } ], "trochilus": [ { "slug": "apt31", "name": "APT31", "matched": "Trochilus", "kind": "tool", "org": null } ], "dropboxaes": [ { "slug": "apt31", "name": "APT31", "matched": "DropboxAES", "kind": "tool", "org": null } ], "compromised routers": [ { "slug": "apt31", "name": "APT31", "matched": "Compromised routers", "kind": "tool", "org": null } ], "wuhan xiaoruizhi science and technology company front company": [ { "slug": "apt31", "name": "APT31", "matched": "Wuhan Xiaoruizhi Science and Technology Company (front company)", "kind": "unit", "org": null } ], "berserk bear": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "Berserk Bear", "kind": "name", "org": null } ], "g0074": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "G0074", "kind": "alias", "org": "mitre" } ], "dragonfly": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "Dragonfly", "kind": "alias", "org": "mitre" } ], "energetic bear": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "Energetic Bear", "kind": "alias", "org": "crowdstrike" } ], "ghost blizzard": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "Ghost Blizzard", "kind": "alias", "org": "microsoft" } ], "dragonfly 2 0": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "Dragonfly 2.0", "kind": "alias", "org": "symantec" } ], "crouching yeti": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "Crouching Yeti", "kind": "alias", "org": "kaspersky" } ], "dymalloy": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "DYMALLOY", "kind": "alias", "org": "dragos" } ], "allanite": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "ALLANITE", "kind": "alias", "org": "dragos" } ], "iron liberty": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "IRON LIBERTY", "kind": "alias", "org": "secureworks" } ], "temp isotope": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "TEMP.Isotope", "kind": "alias", "org": "mandiant" } ], "fsb centre 16": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "FSB Centre 16", "kind": "alias", "org": "cisa" } ], "havex": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "Havex", "kind": "tool", "org": null } ], "karagany": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "Karagany", "kind": "tool", "org": null } ], "heriplor": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "Heriplor", "kind": "tool", "org": null } ], "goodor": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "Goodor", "kind": "tool", "org": null } ], "smb forced authentication": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "SMB forced authentication", "kind": "tool", "org": null } ], "psexec": [ { "slug": "berserk-bear", "name": "Berserk Bear", "matched": "PsExec", "kind": "tool", "org": null } ], "apt33": [ { "slug": "apt33", "name": "APT33", "matched": "APT33", "kind": "name", "org": null } ], "g0064": [ { "slug": "apt33", "name": "APT33", "matched": "G0064", "kind": "alias", "org": "mitre" } ], "peach sandstorm": [ { "slug": "apt33", "name": "APT33", "matched": "Peach Sandstorm", "kind": "alias", "org": "microsoft" } ], "holmium": [ { "slug": "apt33", "name": "APT33", "matched": "HOLMIUM", "kind": "alias", "org": "microsoft" } ], "refined kitten": [ { "slug": "apt33", "name": "APT33", "matched": "Refined Kitten", "kind": "alias", "org": "crowdstrike" } ], "cobalt trinity": [ { "slug": "apt33", "name": "APT33", "matched": "COBALT TRINITY", "kind": "alias", "org": "secureworks" } ], "curious serpens": [ { "slug": "apt33", "name": "APT33", "matched": "Curious Serpens", "kind": "alias", "org": "unit42" } ], "elfin": [ { "slug": "apt33", "name": "APT33", "matched": "Elfin", "kind": "alias", "org": "symantec" } ], "magnallium": [ { "slug": "apt33", "name": "APT33", "matched": "MAGNALLIUM", "kind": "alias", "org": "dragos" } ], "shamoon disttrack": [ { "slug": "apt33", "name": "APT33", "matched": "Shamoon / Disttrack", "kind": "tool", "org": null } ], "turnedup": [ { "slug": "apt33", "name": "APT33", "matched": "TURNEDUP", "kind": "tool", "org": null } ], "dropshot stonedrill": [ { "slug": "apt33", "name": "APT33", "matched": "DROPSHOT / StoneDrill", "kind": "tool", "org": null } ], "nanocore netwire": [ { "slug": "apt33", "name": "APT33", "matched": "NANOCORE / NETWIRE", "kind": "tool", "org": null } ], "falsefont": [ { "slug": "apt33", "name": "APT33", "matched": "FalseFont", "kind": "tool", "org": null } ], "autoit droppers": [ { "slug": "apt33", "name": "APT33", "matched": "AutoIt droppers", "kind": "tool", "org": null } ], "apt1": [ { "slug": "apt1", "name": "APT1", "matched": "APT1", "kind": "name", "org": null } ], "g0006": [ { "slug": "apt1", "name": "APT1", "matched": "G0006", "kind": "alias", "org": "mitre" } ], "comment panda": [ { "slug": "apt1", "name": "APT1", "matched": "Comment Panda", "kind": "alias", "org": "crowdstrike" } ], "comment crew": [ { "slug": "apt1", "name": "APT1", "matched": "Comment Crew", "kind": "alias", "org": "symantec" } ], "tg 8223": [ { "slug": "apt1", "name": "APT1", "matched": "TG-8223", "kind": "alias", "org": "secureworks" } ], "pla unit 61398": [ { "slug": "apt1", "name": "APT1", "matched": "PLA Unit 61398", "kind": "alias", "org": "cisa" } ], "comment group": [ { "slug": "apt1", "name": "APT1", "matched": "Comment Group", "kind": "alias", "org": "kaspersky" } ], "byzantine candor": [ { "slug": "apt1", "name": "APT1", "matched": "Byzantine Candor", "kind": "alias", "org": "recordedfuture" } ], "webc2": [ { "slug": "apt1", "name": "APT1", "matched": "WEBC2", "kind": "tool", "org": null } ], "glooxmail": [ { "slug": "apt1", "name": "APT1", "matched": "GLOOXMAIL", "kind": "tool", "org": null } ], "htran": [ { "slug": "apt1", "name": "APT1", "matched": "HTRAN", "kind": "tool", "org": null } ], "poison ivy": [ { "slug": "apt1", "name": "APT1", "matched": "Poison Ivy", "kind": "tool", "org": null } ], "mimikatz cachedump": [ { "slug": "apt1", "name": "APT1", "matched": "Mimikatz / cachedump", "kind": "tool", "org": null } ], "custom ftp exfiltration": [ { "slug": "apt1", "name": "APT1", "matched": "Custom FTP exfiltration", "kind": "tool", "org": null } ], "unit 61398": [ { "slug": "apt1", "name": "APT1", "matched": "Unit 61398", "kind": "unit", "org": null } ], "star blizzard": [ { "slug": "star-blizzard", "name": "Star Blizzard", "matched": "Star Blizzard", "kind": "name", "org": null } ], "g1033": [ { "slug": "star-blizzard", "name": "Star Blizzard", "matched": "G1033", "kind": "alias", "org": "mitre" } ], "seaborgium": [ { "slug": "star-blizzard", "name": "Star Blizzard", "matched": "SEABORGIUM", "kind": "alias", "org": "microsoft" } ], "gossamer bear": [ { "slug": "star-blizzard", "name": "Star Blizzard", "matched": "Gossamer Bear", "kind": "alias", "org": "crowdstrike" } ], "unc4057": [ { "slug": "star-blizzard", "name": "Star Blizzard", "matched": "UNC4057", "kind": "alias", "org": "mandiant" } ], "coldriver": [ { "slug": "star-blizzard", "name": "Star Blizzard", "matched": "COLDRIVER", "kind": "alias", "org": "mandiant" } ], "bluecharlie": [ { "slug": "star-blizzard", "name": "Star Blizzard", "matched": "BlueCharlie", "kind": "alias", "org": "recordedfuture" } ], "tag 53": [ { "slug": "star-blizzard", "name": "Star Blizzard", "matched": "TAG-53", "kind": "alias", "org": "recordedfuture" } ], "ta446": [ { "slug": "star-blizzard", "name": "Star Blizzard", "matched": "TA446", "kind": "alias", "org": "proofpoint" } ], "callisto group": [ { "slug": "star-blizzard", "name": "Star Blizzard", "matched": "Callisto Group", "kind": "alias", "org": "cisa" } ], "evilginx": [ { "slug": "star-blizzard", "name": "Star Blizzard", "matched": "Evilginx", "kind": "tool", "org": null } ], "spica": [ { "slug": "star-blizzard", "name": "Star Blizzard", "matched": "SPICA", "kind": "tool", "org": null } ], "lostkeys": [ { "slug": "star-blizzard", "name": "Star Blizzard", "matched": "LOSTKEYS", "kind": "tool", "org": null } ], "centre 18": [ { "slug": "star-blizzard", "name": "Star Blizzard", "matched": "Centre 18", "kind": "unit", "org": null } ], "apt37": [ { "slug": "apt37", "name": "APT37", "matched": "APT37", "kind": "name", "org": null } ], "g0067": [ { "slug": "apt37", "name": "APT37", "matched": "G0067", "kind": "alias", "org": "mitre" } ], "ruby sleet": [ { "slug": "apt37", "name": "APT37", "matched": "Ruby Sleet", "kind": "alias", "org": "microsoft" } ], "ricochet chollima": [ { "slug": "apt37", "name": "APT37", "matched": "Ricochet Chollima", "kind": "alias", "org": "crowdstrike" } ], "reaper": [ { "slug": "apt37", "name": "APT37", "matched": "Reaper", "kind": "alias", "org": "mandiant" } ], "scarcruft": [ { "slug": "apt37", "name": "APT37", "matched": "ScarCruft", "kind": "alias", "org": "kaspersky" } ], "nickel foxcroft": [ { "slug": "apt37", "name": "APT37", "matched": "NICKEL FOXCROFT", "kind": "alias", "org": "secureworks" } ], "group123": [ { "slug": "apt37", "name": "APT37", "matched": "Group123", "kind": "alias", "org": "cisa" } ], "ta redant": [ { "slug": "apt37", "name": "APT37", "matched": "TA-RedAnt", "kind": "alias", "org": "proofpoint" } ], "rokrat": [ { "slug": "apt37", "name": "APT37", "matched": "ROKRAT", "kind": "tool", "org": null } ], "goldbackdoor": [ { "slug": "apt37", "name": "APT37", "matched": "GOLDBACKDOOR", "kind": "tool", "org": null } ], "chinotto": [ { "slug": "apt37", "name": "APT37", "matched": "Chinotto", "kind": "tool", "org": null } ], "dogcall karae": [ { "slug": "apt37", "name": "APT37", "matched": "DOGCALL / KARAE", "kind": "tool", "org": null } ], "bluetooth harvester": [ { "slug": "apt37", "name": "APT37", "matched": "Bluetooth harvester", "kind": "tool", "org": null } ], "rokrat android variants": [ { "slug": "apt37", "name": "APT37", "matched": "RokRAT Android variants", "kind": "tool", "org": null } ], "andariel": [ { "slug": "andariel", "name": "Andariel", "matched": "Andariel", "kind": "name", "org": null } ], "g0138": [ { "slug": "andariel", "name": "Andariel", "matched": "G0138", "kind": "alias", "org": "mitre" } ], "onyx sleet": [ { "slug": "andariel", "name": "Andariel", "matched": "Onyx Sleet", "kind": "alias", "org": "microsoft" } ], "plutonium": [ { "slug": "andariel", "name": "Andariel", "matched": "PLUTONIUM", "kind": "alias", "org": "microsoft" } ], "silent chollima": [ { "slug": "andariel", "name": "Andariel", "matched": "Silent Chollima", "kind": "alias", "org": "crowdstrike" } ], "apt45": [ { "slug": "andariel", "name": "Andariel", "matched": "APT45", "kind": "alias", "org": "mandiant" } ], "nickel hyatt": [ { "slug": "andariel", "name": "Andariel", "matched": "NICKEL HYATT", "kind": "alias", "org": "secureworks" } ], "andariel stonefly": [ { "slug": "andariel", "name": "Andariel", "matched": "Andariel / Stonefly", "kind": "alias", "org": "cisa" } ], "stonefly": [ { "slug": "andariel", "name": "Andariel", "matched": "Stonefly", "kind": "alias", "org": "symantec" } ], "jumpy pisces": [ { "slug": "andariel", "name": "Andariel", "matched": "Jumpy Pisces", "kind": "alias", "org": "unit42" } ], "maui ransomware": [ { "slug": "andariel", "name": "Andariel", "matched": "Maui ransomware", "kind": "tool", "org": null } ], "shatteredglass dtrack": [ { "slug": "andariel", "name": "Andariel", "matched": "SHATTEREDGLASS / Dtrack", "kind": "tool", "org": null } ], "tigerrat": [ { "slug": "andariel", "name": "Andariel", "matched": "TigerRAT", "kind": "tool", "org": null } ], "preft dora rat": [ { "slug": "andariel", "name": "Andariel", "matched": "Preft / Dora RAT", "kind": "tool", "org": null } ], "living off the land utilities": [ { "slug": "andariel", "name": "Andariel", "matched": "Living-off-the-land utilities", "kind": "tool", "org": null } ], "nukesped": [ { "slug": "andariel", "name": "Andariel", "matched": "Nukesped", "kind": "tool", "org": null } ], "3rd bureau andariel onyx sleet": [ { "slug": "andariel", "name": "Andariel", "matched": "3rd Bureau (Andariel / Onyx Sleet)", "kind": "unit", "org": null } ], "cyberav3ngers": [ { "slug": "cyberav3ngers", "name": "CyberAv3ngers", "matched": "CyberAv3ngers", "kind": "name", "org": null } ], "cyberav3ngers irgc cec": [ { "slug": "cyberav3ngers", "name": "CyberAv3ngers", "matched": "CyberAv3ngers / IRGC-CEC", "kind": "alias", "org": "cisa" } ], "bauxite": [ { "slug": "cyberav3ngers", "name": "CyberAv3ngers", "matched": "BAUXITE", "kind": "alias", "org": "dragos" } ], "default credentials": [ { "slug": "cyberav3ngers", "name": "CyberAv3ngers", "matched": "Default credentials", "kind": "tool", "org": null } ], "iocontrol": [ { "slug": "cyberav3ngers", "name": "CyberAv3ngers", "matched": "IOCONTROL", "kind": "tool", "org": null } ], "shodan internet scanning": [ { "slug": "cyberav3ngers", "name": "CyberAv3ngers", "matched": "Shodan / internet scanning", "kind": "tool", "org": null } ], "hmi defacement": [ { "slug": "cyberav3ngers", "name": "CyberAv3ngers", "matched": "HMI defacement", "kind": "tool", "org": null } ], "irgc cec": [ { "slug": "cyberav3ngers", "name": "CyberAv3ngers", "matched": "IRGC-CEC", "kind": "unit", "org": null } ], "apt32": [ { "slug": "apt32", "name": "APT32", "matched": "APT32", "kind": "name", "org": null } ], "g0050": [ { "slug": "apt32", "name": "APT32", "matched": "G0050", "kind": "alias", "org": "mitre" } ], "canvas cyclone": [ { "slug": "apt32", "name": "APT32", "matched": "Canvas Cyclone", "kind": "alias", "org": "microsoft" } ], "bismuth": [ { "slug": "apt32", "name": "APT32", "matched": "BISMUTH", "kind": "alias", "org": "microsoft" } ], "ocean buffalo": [ { "slug": "apt32", "name": "APT32", "matched": "Ocean Buffalo", "kind": "alias", "org": "crowdstrike" } ], "tin woodlawn": [ { "slug": "apt32", "name": "APT32", "matched": "TIN WOODLAWN", "kind": "alias", "org": "secureworks" } ], "oceanlotus": [ { "slug": "apt32", "name": "APT32", "matched": "OceanLotus", "kind": "alias", "org": "eset" } ], "apt32 oceanlotus": [ { "slug": "apt32", "name": "APT32", "matched": "APT32 / OceanLotus", "kind": "alias", "org": "cisa" } ], "sea lotus": [ { "slug": "apt32", "name": "APT32", "matched": "Sea Lotus", "kind": "alias", "org": "unit42" } ], "kerrdown": [ { "slug": "apt32", "name": "APT32", "matched": "KerrDown", "kind": "tool", "org": null } ], "ratsnif": [ { "slug": "apt32", "name": "APT32", "matched": "Ratsnif", "kind": "tool", "org": null } ], "denis salgorea": [ { "slug": "apt32", "name": "APT32", "matched": "Denis / Salgorea", "kind": "tool", "org": null } ], "macos osx oceanlotus": [ { "slug": "apt32", "name": "APT32", "matched": "macOS OSX.OceanLotus", "kind": "tool", "org": null } ], "fake news websites": [ { "slug": "apt32", "name": "APT32", "matched": "Fake news websites", "kind": "tool", "org": null } ], "predatory sparrow": [ { "slug": "predatory-sparrow", "name": "Predatory Sparrow", "matched": "Predatory Sparrow", "kind": "name", "org": null } ], "gonjeshke darande": [ { "slug": "predatory-sparrow", "name": "Predatory Sparrow", "matched": "Gonjeshke Darande", "kind": "alias", "org": "cisa" } ], "not tracked as a named ics group": [ { "slug": "predatory-sparrow", "name": "Predatory Sparrow", "matched": "Not tracked as a named ICS group", "kind": "alias", "org": "dragos" } ], "meteor stardust comet": [ { "slug": "predatory-sparrow", "name": "Predatory Sparrow", "matched": "Meteor / Stardust / Comet", "kind": "tool", "org": null } ], "ics manipulation": [ { "slug": "predatory-sparrow", "name": "Predatory Sparrow", "matched": "ICS manipulation", "kind": "tool", "org": null } ], "payment system disruption": [ { "slug": "predatory-sparrow", "name": "Predatory Sparrow", "matched": "Payment system disruption", "kind": "tool", "org": null } ], "provable burn addresses": [ { "slug": "predatory-sparrow", "name": "Predatory Sparrow", "matched": "Provable burn addresses", "kind": "tool", "org": null } ], "ghostwriter": [ { "slug": "ghostwriter", "name": "Ghostwriter", "matched": "Ghostwriter", "kind": "name", "org": null } ], "g1049": [ { "slug": "ghostwriter", "name": "Ghostwriter", "matched": "G1049", "kind": "alias", "org": "mitre" } ], "unc1151": [ { "slug": "ghostwriter", "name": "Ghostwriter", "matched": "UNC1151", "kind": "alias", "org": "mitre" } ], "storm 0257": [ { "slug": "ghostwriter", "name": "Ghostwriter", "matched": "Storm-0257", "kind": "alias", "org": "microsoft" } ], "ta445": [ { "slug": "ghostwriter", "name": "Ghostwriter", "matched": "TA445", "kind": "alias", "org": "recordedfuture" } ], "credential phishing kits": [ { "slug": "ghostwriter", "name": "Ghostwriter", "matched": "Credential phishing kits", "kind": "tool", "org": null } ], "agenttesla njrat": [ { "slug": "ghostwriter", "name": "Ghostwriter", "matched": "AgentTesla / njRAT", "kind": "tool", "org": null } ], "cms compromise": [ { "slug": "ghostwriter", "name": "Ghostwriter", "matched": "CMS compromise", "kind": "tool", "org": null } ], "picassoloader": [ { "slug": "ghostwriter", "name": "Ghostwriter", "matched": "PicassoLoader", "kind": "tool", "org": null } ], "microbackdoor": [ { "slug": "ghostwriter", "name": "Ghostwriter", "matched": "MicroBackdoor", "kind": "tool", "org": null } ], "apt36": [ { "slug": "apt36", "name": "APT36", "matched": "APT36", "kind": "name", "org": null } ], "g0134": [ { "slug": "apt36", "name": "APT36", "matched": "G0134", "kind": "alias", "org": "mitre" } ], "transparent tribe": [ { "slug": "apt36", "name": "APT36", "matched": "Transparent Tribe", "kind": "alias", "org": "mitre" } ], "mythic leopard": [ { "slug": "apt36", "name": "APT36", "matched": "Mythic Leopard", "kind": "alias", "org": "crowdstrike" } ], "operation c major": [ { "slug": "apt36", "name": "APT36", "matched": "Operation C-Major", "kind": "alias", "org": "proofpoint" } ], "aluminum saratoga": [ { "slug": "apt36", "name": "APT36", "matched": "ALUMINUM SARATOGA", "kind": "alias", "org": "secureworks" } ], "earth karkaddan": [ { "slug": "apt36", "name": "APT36", "matched": "Earth Karkaddan", "kind": "alias", "org": "trendmicro" } ], "storm 0156": [ { "slug": "apt36", "name": "APT36", "matched": "Storm-0156", "kind": "alias", "org": "microsoft" } ], "crimson rat": [ { "slug": "apt36", "name": "APT36", "matched": "Crimson RAT", "kind": "tool", "org": null } ], "caprarat": [ { "slug": "apt36", "name": "APT36", "matched": "CapraRAT", "kind": "tool", "org": null } ], "obliquerat": [ { "slug": "apt36", "name": "APT36", "matched": "ObliqueRAT", "kind": "tool", "org": null } ], "poseidon": [ { "slug": "apt36", "name": "APT36", "matched": "Poseidon", "kind": "tool", "org": null } ], "fake app stores": [ { "slug": "apt36", "name": "APT36", "matched": "Fake app stores", "kind": "tool", "org": null } ], "sidewinder": [ { "slug": "sidewinder", "name": "SideWinder", "matched": "SideWinder", "kind": "name", "org": null } ], "g0121": [ { "slug": "sidewinder", "name": "SideWinder", "matched": "G0121", "kind": "alias", "org": "mitre" } ], "rattlesnake": [ { "slug": "sidewinder", "name": "SideWinder", "matched": "Rattlesnake", "kind": "alias", "org": "trendmicro" } ], "tin barometer": [ { "slug": "sidewinder", "name": "SideWinder", "matched": "TIN BAROMETER", "kind": "alias", "org": "secureworks" } ], "razor tiger": [ { "slug": "sidewinder", "name": "SideWinder", "matched": "Razor Tiger", "kind": "alias", "org": "crowdstrike" } ], "storm 0343": [ { "slug": "sidewinder", "name": "SideWinder", "matched": "Storm-0343", "kind": "alias", "org": "microsoft" } ], "apt c 17": [ { "slug": "sidewinder", "name": "SideWinder", "matched": "APT-C-17", "kind": "alias", "org": "recordedfuture" } ], "stealerbot": [ { "slug": "sidewinder", "name": "SideWinder", "matched": "StealerBot", "kind": "tool", "org": null } ], "sidewinder net loaders": [ { "slug": "sidewinder", "name": "SideWinder", "matched": "SideWinder .NET loaders", "kind": "tool", "org": null } ], "android implants": [ { "slug": "sidewinder", "name": "SideWinder", "matched": "Android implants", "kind": "tool", "org": null } ], "mass domain infrastructure": [ { "slug": "sidewinder", "name": "SideWinder", "matched": "Mass domain infrastructure", "kind": "tool", "org": null } ] } }