{"type":"bundle","id":"bundle--5027ef95-409c-45b8-8736-e0ea16be4936","spec_version":"2.1","objects":[{"type":"identity","spec_version":"2.1","id":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"CTI.FYI Ransomware Intelligence Platform","description":"Continuous automated threat intelligence monitoring ransomware leak blogs and multi-extortion syndicates.","identity_class":"system","sectors":["technology"],"contact_information":"https://cti.fyi"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--17716f08-b075-5199-ae72-7a44b0fdb007","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"0Apt","description":"Ransomware cartel / extortion group '0apt' monitored by CTI.FYI.","aliases":["0apt"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/0apt.html","description":"CTI.FYI Dossier for 0apt"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--f56040ef-2f45-5634-93b5-e44cb852154d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"0Mega","description":"Ransomware cartel / extortion group '0mega' monitored by CTI.FYI.","aliases":["0mega"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/0mega.html","description":"CTI.FYI Dossier for 0mega"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--406212f4-81a8-51b8-a5ad-947f8bc385f6","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"8Base","description":"Bursting onto the extortion landscape in mid-2023, 8Base conducts high-volume opportunistic extortion campaigns heavily targeting small-to-medium businesses in manufacturing, healthcare, and professional services. The operation deploys customized C/C++ variants closely aligned with Phobos ransomware and SmokeLoader payloads to achieve fast local file encryption. Infiltrating targets through valid credentials, brute-forced RDP ports, and phishing emails, the syndicate practices double extortion framed as moral hacktivism against negligent corporate data security.","aliases":["8base","8 Base"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/8base.html","description":"CTI.FYI Dossier for 8base"}]},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1078: VALID ACCOUNTS","external_references":[{"source_name":"mitre-attack","external_id":"T1078: VALID ACCOUNTS","url":"https://attack.mitre.org/techniques/T1078: VALID ACCOUNTS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--23926343-e23a-55f4-b056-070bd936c49a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--406212f4-81a8-51b8-a5ad-947f8bc385f6","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1021.001: REMOTE DESKTOP PROTOCOL","external_references":[{"source_name":"mitre-attack","external_id":"T1021.001: REMOTE DESKTOP PROTOCOL","url":"https://attack.mitre.org/techniques/T1021.001: REMOTE DESKTOP PROTOCOL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--940035f8-0c0a-5dd2-880e-c60e2cd2df16","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--406212f4-81a8-51b8-a5ad-947f8bc385f6","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--3c56009c-3d1f-5821-8c89-4ca4a0996ee2","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1133: EXTERNAL REMOTE SERVICES","external_references":[{"source_name":"mitre-attack","external_id":"T1133: EXTERNAL REMOTE SERVICES","url":"https://attack.mitre.org/techniques/T1133: EXTERNAL REMOTE SERVICES"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--174870d3-7041-56fb-af36-4e712073a5e2","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--406212f4-81a8-51b8-a5ad-947f8bc385f6","target_ref":"attack-pattern--3c56009c-3d1f-5821-8c89-4ca4a0996ee2"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--c936ce1b-2bbf-59ed-ae9e-2897cc1129e5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1566.001: SPEARPHISHING ATTACHMENT","external_references":[{"source_name":"mitre-attack","external_id":"T1566.001: SPEARPHISHING ATTACHMENT","url":"https://attack.mitre.org/techniques/T1566.001: SPEARPHISHING ATTACHMENT"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--868a3e22-b4ec-5cd3-8694-905220b48d8e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--406212f4-81a8-51b8-a5ad-947f8bc385f6","target_ref":"attack-pattern--c936ce1b-2bbf-59ed-ae9e-2897cc1129e5"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1059.003: WINDOWS COMMAND SHELL","external_references":[{"source_name":"mitre-attack","external_id":"T1059.003: WINDOWS COMMAND SHELL","url":"https://attack.mitre.org/techniques/T1059.003: WINDOWS COMMAND SHELL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--7d9b0d8f-4a6f-5cb9-a1c1-071061db391c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--406212f4-81a8-51b8-a5ad-947f8bc385f6","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--abf9da00-5965-549c-b277-81f9ff9940d1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1047: WINDOWS MANAGEMENT INSTRUMENTATION","external_references":[{"source_name":"mitre-attack","external_id":"T1047: WINDOWS MANAGEMENT INSTRUMENTATION","url":"https://attack.mitre.org/techniques/T1047: WINDOWS MANAGEMENT INSTRUMENTATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--1aad7b68-eaf0-5311-a186-a93bffac2753","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--406212f4-81a8-51b8-a5ad-947f8bc385f6","target_ref":"attack-pattern--abf9da00-5965-549c-b277-81f9ff9940d1"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1562.001: DISABLE OR MODIFY TOOLS","external_references":[{"source_name":"mitre-attack","external_id":"T1562.001: DISABLE OR MODIFY TOOLS","url":"https://attack.mitre.org/techniques/T1562.001: DISABLE OR MODIFY TOOLS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--c5f02e08-6f02-5f08-8c12-06b2624f8cd6","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--406212f4-81a8-51b8-a5ad-947f8bc385f6","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1490: INHIBIT SYSTEM RECOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1490: INHIBIT SYSTEM RECOVERY","url":"https://attack.mitre.org/techniques/T1490: INHIBIT SYSTEM RECOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--62c228d6-053c-5b8a-89d2-c041c8931844","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--406212f4-81a8-51b8-a5ad-947f8bc385f6","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1486: DATA ENCRYPTED FOR IMPACT","external_references":[{"source_name":"mitre-attack","external_id":"T1486: DATA ENCRYPTED FOR IMPACT","url":"https://attack.mitre.org/techniques/T1486: DATA ENCRYPTED FOR IMPACT"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--c55e88d1-e2fa-51eb-b733-de161b3db9ac","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--406212f4-81a8-51b8-a5ad-947f8bc385f6","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1567.002: EXFILTRATION TO CLOUD STORAGE","external_references":[{"source_name":"mitre-attack","external_id":"T1567.002: EXFILTRATION TO CLOUD STORAGE","url":"https://attack.mitre.org/techniques/T1567.002: EXFILTRATION TO CLOUD STORAGE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--1de25d6a-08a3-59a2-b93a-ccb99c5a9c60","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--406212f4-81a8-51b8-a5ad-947f8bc385f6","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--a6a64962-8398-55ca-bb28-5f145bb06b43","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Abrahams_Ax","description":"Ransomware cartel / extortion group 'Abrahams_Ax' monitored by CTI.FYI.","aliases":["Abrahams_Ax"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/abrahams_ax.html","description":"CTI.FYI Dossier for Abrahams_Ax"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--8a1e7911-f1cc-5bac-adfa-0b1f77c00b02","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Abyss","description":"Ransomware cartel / extortion group 'abyss' monitored by CTI.FYI.","aliases":["abyss"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/abyss.html","description":"CTI.FYI Dossier for abyss"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3b084548-f0e2-548e-8f00-bdbfa8cde2dc","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Adminlocker","description":"Ransomware cartel / extortion group 'adminlocker' monitored by CTI.FYI.","aliases":["adminlocker"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/adminlocker.html","description":"CTI.FYI Dossier for adminlocker"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d6314405-8c6a-577e-b935-ca7fe5b058ca","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Againstthewest","description":"Ransomware cartel / extortion group 'againstthewest' monitored by CTI.FYI.","aliases":["againstthewest"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/againstthewest.html","description":"CTI.FYI Dossier for againstthewest"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--857afa59-f330-55a8-a4ce-1f8918ee4682","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Agl0Bgvycg","description":"Ransomware cartel / extortion group 'aGl0bGVyCg' monitored by CTI.FYI.","aliases":["aGl0bGVyCg"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/agl0bgvycg.html","description":"CTI.FYI Dossier for aGl0bGVyCg"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--487f2e86-f1ef-5e86-9aec-dc3f527e42d4","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ailock","description":"AiLock is a Ransomware-as-a-Service (RaaS) group first identified in March 2025. It employs a double-extortion approach—encrypting files and threatening to report breaches to regulators or share stolen data with competitors if the ransom isn’t paid. Victims have just 72 hours to respond and up to five days to pay; failure to pay results in data leaks and destruction of recovery tools. The ransomware appends the extension .AiLock to encrypted files, changes file icons to a green padlock with the “AiLock” name, and replaces the desktop wallpaper with a distinctive robot-skull logo. It employs a hybrid encryption scheme, combining ChaCha20 for file encryption with NTRUEncrypt for securing metadata, and uses a multi-threaded design (path-traversal and encryption threads with IOCP) for efficiency. While active campaigns and leak sites are confirmed, specific sectors, regions, and intrusion methods remain undisclosed in public sources.","aliases":["AiLock"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ailock.html","description":"CTI.FYI Dossier for AiLock"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Akira","description":"Emerging in March 2023 and suspected to be operated by former members of the Conti syndicate, Akira is a prominent double-extortion ransomware gang targeting enterprise networks across North America, Europe, and Australia. The group deploys C++ encryptors (targeting Windows and Linux/VMware ESXi architectures) utilizing ChaCha20/RSA encryption algorithms and .akira extensions. Akira predominantly gains initial access by exploiting vulnerabilities in edge firewalls and VPNs (notably Cisco ASA/FTD CVE-2023-20269) or abusing compromised credentials lacking multi-factor authentication, subsequently exfiltrating sensitive data to pressure victims via a retro-styled dark web leak site.","aliases":["akira","Megazord","Akira Ransomware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/akira.html","description":"CTI.FYI Dossier for akira"}]},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--3f913a3b-afd2-5a49-af9a-cf7e9f5e7f74","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1088: BYPASS USER ACCOUNT CONTROL","external_references":[{"source_name":"mitre-attack","external_id":"T1088: BYPASS USER ACCOUNT CONTROL","url":"https://attack.mitre.org/techniques/T1088: BYPASS USER ACCOUNT CONTROL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--74502b1f-bdaf-5883-b1fe-4ee0e75d80fe","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--3f913a3b-afd2-5a49-af9a-cf7e9f5e7f74"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--3eeee68c-4f87-5934-810a-24add8ada0b4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1087: ACCOUNT DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1087: ACCOUNT DISCOVERY","url":"https://attack.mitre.org/techniques/T1087: ACCOUNT DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--469cdb48-a80a-57a1-aa56-668b7429582a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--3eeee68c-4f87-5934-810a-24add8ada0b4"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--ff17dd9a-2362-5b5c-bc25-ba0a884b580f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1560.001: ARCHIVE VIA UTILITY","external_references":[{"source_name":"mitre-attack","external_id":"T1560.001: ARCHIVE VIA UTILITY","url":"https://attack.mitre.org/techniques/T1560.001: ARCHIVE VIA UTILITY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--8f5960ac-2e78-544b-9079-e02b83dcb1b1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--ff17dd9a-2362-5b5c-bc25-ba0a884b580f"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--7b9cd7aa-9472-5604-8363-1bc759ae90c3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique TA0009: COLLECTION","external_references":[{"source_name":"mitre-attack","external_id":"TA0009: COLLECTION","url":"https://attack.mitre.org/techniques/TA0009: COLLECTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--d0b75780-f7fa-5e51-af37-0ad6fab4445e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--7b9cd7aa-9472-5604-8363-1bc759ae90c3"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--abbb39a5-1fb5-527d-a4a0-462b2a23735b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique TA0011: COMMAND AND CONTROL","external_references":[{"source_name":"mitre-attack","external_id":"TA0011: COMMAND AND CONTROL","url":"https://attack.mitre.org/techniques/TA0011: COMMAND AND CONTROL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--2f782078-27e9-57be-ba13-03191e883d17","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--abbb39a5-1fb5-527d-a4a0-462b2a23735b"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--d78f58be-e555-58ca-ae58-9b3f1c84e3ac","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1059: COMMAND AND SCRIPTING INTERPRETER","external_references":[{"source_name":"mitre-attack","external_id":"T1059: COMMAND AND SCRIPTING INTERPRETER","url":"https://attack.mitre.org/techniques/T1059: COMMAND AND SCRIPTING INTERPRETER"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--3ee5d308-21ba-5df5-96fd-739c89da4a6b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--d78f58be-e555-58ca-ae58-9b3f1c84e3ac"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1059.001: POWERSHELL","external_references":[{"source_name":"mitre-attack","external_id":"T1059.001: POWERSHELL","url":"https://attack.mitre.org/techniques/T1059.001: POWERSHELL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--b8f16313-48fc-53cd-b7db-7b5909b30569","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--92abfb38-1556-5891-bcea-ed2ff8c46025","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--8009d247-829b-54ae-bbfb-a00a8208ee81","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1136.002: DOMAIN ACCOUNT","external_references":[{"source_name":"mitre-attack","external_id":"T1136.002: DOMAIN ACCOUNT","url":"https://attack.mitre.org/techniques/T1136.002: DOMAIN ACCOUNT"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--fc20b50d-df0f-5d5c-b24a-a53967232c12","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--8009d247-829b-54ae-bbfb-a00a8208ee81"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--cf654767-227a-5d00-9f82-a550eeba1490","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1136.001: LOCAL ACCOUNT","external_references":[{"source_name":"mitre-attack","external_id":"T1136.001: LOCAL ACCOUNT","url":"https://attack.mitre.org/techniques/T1136.001: LOCAL ACCOUNT"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--5e82b15e-cfd1-5351-91a1-a2120a86a91f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--cf654767-227a-5d00-9f82-a550eeba1490"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--4dfa0133-19d7-558a-9806-291cdc07ec61","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1543.003: WINDOWS SERVICE","external_references":[{"source_name":"mitre-attack","external_id":"T1543.003: WINDOWS SERVICE","url":"https://attack.mitre.org/techniques/T1543.003: WINDOWS SERVICE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--058ff027-3e27-5922-979c-990d009ffe2a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--4dfa0133-19d7-558a-9806-291cdc07ec61"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--bc838a74-1e49-5ab3-bafd-9de9528e8351","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique TA0006: CREDENTIAL ACCESS","external_references":[{"source_name":"mitre-attack","external_id":"TA0006: CREDENTIAL ACCESS","url":"https://attack.mitre.org/techniques/TA0006: CREDENTIAL ACCESS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--dc3c5202-734a-5835-b9bc-8001671a1e4d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--bc838a74-1e49-5ab3-bafd-9de9528e8351"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--e632955e-297b-569e-a458-cab9dbe12bab","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1003: OS CREDENTIAL DUMPING","external_references":[{"source_name":"mitre-attack","external_id":"T1003: OS CREDENTIAL DUMPING","url":"https://attack.mitre.org/techniques/T1003: OS CREDENTIAL DUMPING"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--83591929-54c3-5d28-a377-ed606308279c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--e632955e-297b-569e-a458-cab9dbe12bab"},{"type":"relationship","spec_version":"2.1","id":"relationship--44f29639-002a-52c6-bc8d-5878784f098b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--e46e931b-8da7-5046-b02c-552590554321","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique TA0005: DEFENSE EVASION","external_references":[{"source_name":"mitre-attack","external_id":"TA0005: DEFENSE EVASION","url":"https://attack.mitre.org/techniques/TA0005: DEFENSE EVASION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--e32f803f-85a6-5633-b02e-734c67e564d2","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--e46e931b-8da7-5046-b02c-552590554321"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--911a8af3-d599-5d6a-ab9b-f3130ac4540b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique TA0007: DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"TA0007: DISCOVERY","url":"https://attack.mitre.org/techniques/TA0007: DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--89b44a9d-d584-5a5f-a3ef-48e6ceccce33","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--911a8af3-d599-5d6a-ab9b-f3130ac4540b"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--6ff1b92f-89a7-583b-b8ac-c179ad81a451","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1482: DOMAIN TRUST DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1482: DOMAIN TRUST DISCOVERY","url":"https://attack.mitre.org/techniques/T1482: DOMAIN TRUST DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--7c77edfb-761f-5d67-b3bc-9b36b8cb0872","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--6ff1b92f-89a7-583b-b8ac-c179ad81a451"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--c766f3ae-00d8-5e1e-966f-2ff2363bb5d2","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique TA0002: EXECUTION","external_references":[{"source_name":"mitre-attack","external_id":"TA0002: EXECUTION","url":"https://attack.mitre.org/techniques/TA0002: EXECUTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--b913c702-79ad-59a1-a8e3-5f5eb609f021","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--c766f3ae-00d8-5e1e-966f-2ff2363bb5d2"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--52c8476d-26b5-599c-91b1-ebf98115378c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique TA0010: EXFILTRATION","external_references":[{"source_name":"mitre-attack","external_id":"TA0010: EXFILTRATION","url":"https://attack.mitre.org/techniques/TA0010: EXFILTRATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--6c33ef8a-6114-5bfe-961e-4a723421a2b1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--52c8476d-26b5-599c-91b1-ebf98115378c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--0018c874-d41e-53f3-8a5f-018309837885","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1048: EXFILTRATION OVER ALTERNATIVE PROTOCOL","external_references":[{"source_name":"mitre-attack","external_id":"T1048: EXFILTRATION OVER ALTERNATIVE PROTOCOL","url":"https://attack.mitre.org/techniques/T1048: EXFILTRATION OVER ALTERNATIVE PROTOCOL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--08fe3188-9d36-5803-9295-3f1a5e53fff8","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--0018c874-d41e-53f3-8a5f-018309837885"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--6ecf4308-0bd7-5bb8-b552-14cd15320a32","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1048.003: EXFILTRATION OVER UNENCRYPTED NON-C2 PROTOCOL","external_references":[{"source_name":"mitre-attack","external_id":"T1048.003: EXFILTRATION OVER UNENCRYPTED NON-C2 PROTOCOL","url":"https://attack.mitre.org/techniques/T1048.003: EXFILTRATION OVER UNENCRYPTED NON-C2 PROTOCOL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--a8e728c9-390f-596b-ae6e-c758b258ae82","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--6ecf4308-0bd7-5bb8-b552-14cd15320a32"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--82419d22-299b-57e8-8782-819a702f7468","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1567: EXFILTRATION OVER WEB SERVICE","external_references":[{"source_name":"mitre-attack","external_id":"T1567: EXFILTRATION OVER WEB SERVICE","url":"https://attack.mitre.org/techniques/T1567: EXFILTRATION OVER WEB SERVICE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--72de9535-5cea-575d-becc-e7ba743e12f5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--82419d22-299b-57e8-8782-819a702f7468"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--3055ba8c-9f7c-5752-ba06-78ea080c44ab","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1567.001: EXFILTRATION OVER OTHER NETWORK MEDIUM","external_references":[{"source_name":"mitre-attack","external_id":"T1567.001: EXFILTRATION OVER OTHER NETWORK MEDIUM","url":"https://attack.mitre.org/techniques/T1567.001: EXFILTRATION OVER OTHER NETWORK MEDIUM"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--8d0382b9-964d-5efc-bda6-b1d701643ded","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--3055ba8c-9f7c-5752-ba06-78ea080c44ab"},{"type":"relationship","spec_version":"2.1","id":"relationship--94b88732-8288-57da-a043-a588eda28c6b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1190: EXPLOIT PUBLIC-FACING APPLICATION","external_references":[{"source_name":"mitre-attack","external_id":"T1190: EXPLOIT PUBLIC-FACING APPLICATION","url":"https://attack.mitre.org/techniques/T1190: EXPLOIT PUBLIC-FACING APPLICATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--88423894-44f0-55c1-afbf-3b8d0dfd0b7e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--d0bd0bf8-efef-5bb2-8b8d-a43395f11670","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--3c56009c-3d1f-5821-8c89-4ca4a0996ee2"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--d6072347-6a27-513e-aa9a-e3ced566f6bb","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1083: FILE AND DIRECTORY DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1083: FILE AND DIRECTORY DISCOVERY","url":"https://attack.mitre.org/techniques/T1083: FILE AND DIRECTORY DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--bf3f9358-deaf-5288-aab4-342a4771d9bf","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--d6072347-6a27-513e-aa9a-e3ced566f6bb"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--4b38d0b3-5f17-58b3-bee5-73b57d668693","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique TA0040: IMPACT","external_references":[{"source_name":"mitre-attack","external_id":"TA0040: IMPACT","url":"https://attack.mitre.org/techniques/TA0040: IMPACT"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--a788bb54-bbbc-5b1d-bfac-2bab70ce24f5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--4b38d0b3-5f17-58b3-bee5-73b57d668693"},{"type":"relationship","spec_version":"2.1","id":"relationship--e873a6f4-520a-5f29-8063-3f098658f216","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--26a065fd-80e9-54d1-8b71-7ab01689ab7f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1562.002: DISABLE WINDOWS EVENT LOGGING","external_references":[{"source_name":"mitre-attack","external_id":"T1562.002: DISABLE WINDOWS EVENT LOGGING","url":"https://attack.mitre.org/techniques/T1562.002: DISABLE WINDOWS EVENT LOGGING"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--9c9e6386-9029-560e-997e-ddbcd726f260","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--26a065fd-80e9-54d1-8b71-7ab01689ab7f"},{"type":"relationship","spec_version":"2.1","id":"relationship--89d264a8-2f15-56ec-9118-0c5312f42bfd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--ea836819-2c59-5dce-b733-fb24832984da","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique TA0001: INITIAL ACCESS","external_references":[{"source_name":"mitre-attack","external_id":"TA0001: INITIAL ACCESS","url":"https://attack.mitre.org/techniques/TA0001: INITIAL ACCESS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--0294b535-be41-5532-b576-6dc5e3b7eedd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--ea836819-2c59-5dce-b733-fb24832984da"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--41d1f133-ebb2-5443-aa50-3b4ed95b9658","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique TA0008: LATERAL MOVEMENT","external_references":[{"source_name":"mitre-attack","external_id":"TA0008: LATERAL MOVEMENT","url":"https://attack.mitre.org/techniques/TA0008: LATERAL MOVEMENT"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--73b1e698-458b-5d97-a0d9-192ac228a837","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--41d1f133-ebb2-5443-aa50-3b4ed95b9658"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--005b7141-741d-5927-bd5b-253aec9d3477","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1570: LATERAL TOOL TRANSFER","external_references":[{"source_name":"mitre-attack","external_id":"T1570: LATERAL TOOL TRANSFER","url":"https://attack.mitre.org/techniques/T1570: LATERAL TOOL TRANSFER"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--3477a96b-ada5-54de-893c-83cf5b74eefe","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--005b7141-741d-5927-bd5b-253aec9d3477"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--aa55ac8c-0127-5fec-a66d-2fb80fc5770e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1112: MODIFY REGISTRY","external_references":[{"source_name":"mitre-attack","external_id":"T1112: MODIFY REGISTRY","url":"https://attack.mitre.org/techniques/T1112: MODIFY REGISTRY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--7ca9e4ca-6aff-561e-a37a-ed7d86dc2383","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--aa55ac8c-0127-5fec-a66d-2fb80fc5770e"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--2fa3d470-1027-52ef-910e-02e00b738c0b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1003.001: LSASS MEMORY","external_references":[{"source_name":"mitre-attack","external_id":"T1003.001: LSASS MEMORY","url":"https://attack.mitre.org/techniques/T1003.001: LSASS MEMORY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--a5a44ce0-4aa1-57d1-92c8-914b22fd6c92","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--2fa3d470-1027-52ef-910e-02e00b738c0b"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--6b250b99-6fd3-5ada-8a91-4cfa90b15fac","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1003.002: SECURITY ACCOUNT MANAGER","external_references":[{"source_name":"mitre-attack","external_id":"T1003.002: SECURITY ACCOUNT MANAGER","url":"https://attack.mitre.org/techniques/T1003.002: SECURITY ACCOUNT MANAGER"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--65ce1853-92b2-5a38-9ad2-33c89ed68f1d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--6b250b99-6fd3-5ada-8a91-4cfa90b15fac"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--c6b9a8d6-0c23-5162-ba26-4c5935c6713d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1069: PERMISSION GROUPS DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1069: PERMISSION GROUPS DISCOVERY","url":"https://attack.mitre.org/techniques/T1069: PERMISSION GROUPS DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--cf84bb73-e185-5bf3-8814-6d86c13bc7aa","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--c6b9a8d6-0c23-5162-ba26-4c5935c6713d"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--9911f220-a14b-503f-aab4-534d965ba5c0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique TA0003: PERSISTENCE","external_references":[{"source_name":"mitre-attack","external_id":"TA0003: PERSISTENCE","url":"https://attack.mitre.org/techniques/TA0003: PERSISTENCE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--3ab35d93-c880-5c7c-a694-148e5ba1518c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--9911f220-a14b-503f-aab4-534d965ba5c0"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--a4dc579d-d897-5219-bc30-fe3cd6d4e17d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1566: PHISHING","external_references":[{"source_name":"mitre-attack","external_id":"T1566: PHISHING","url":"https://attack.mitre.org/techniques/T1566: PHISHING"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--223e8758-258c-5e3b-a00d-aaaef91594cd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--a4dc579d-d897-5219-bc30-fe3cd6d4e17d"},{"type":"relationship","spec_version":"2.1","id":"relationship--62690cba-f097-5281-a73a-3e0ebfcae2ae","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--c936ce1b-2bbf-59ed-ae9e-2897cc1129e5"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--68b26d47-453b-58f8-b1a1-bb41b1969bed","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1566.002: SPEARPHISHING LINK","external_references":[{"source_name":"mitre-attack","external_id":"T1566.002: SPEARPHISHING LINK","url":"https://attack.mitre.org/techniques/T1566.002: SPEARPHISHING LINK"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--3e83fe42-1b85-5068-86aa-445524d6b55c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--68b26d47-453b-58f8-b1a1-bb41b1969bed"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--0f949b67-daa3-5971-ab2e-a3c56df11258","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique TA0004: PRIVILEGE ESCALATION","external_references":[{"source_name":"mitre-attack","external_id":"TA0004: PRIVILEGE ESCALATION","url":"https://attack.mitre.org/techniques/TA0004: PRIVILEGE ESCALATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--787dd18c-9da4-58db-8574-0cfffdc1be9f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--0f949b67-daa3-5971-ab2e-a3c56df11258"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--ab4983d8-060c-5016-a682-64ed7b711d8f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1057: PROCESS DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1057: PROCESS DISCOVERY","url":"https://attack.mitre.org/techniques/T1057: PROCESS DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--9c67dec5-eacc-5d41-83f8-6cb7adcb51f2","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--ab4983d8-060c-5016-a682-64ed7b711d8f"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--063148fa-8377-5265-b3e7-adb57e863185","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1229: REMOTE ACCESS SOFTWARE","external_references":[{"source_name":"mitre-attack","external_id":"T1229: REMOTE ACCESS SOFTWARE","url":"https://attack.mitre.org/techniques/T1229: REMOTE ACCESS SOFTWARE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--8aa869e9-92fc-5cfa-8d53-c13d932f6954","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--063148fa-8377-5265-b3e7-adb57e863185"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--62023884-7b7a-5feb-b024-718ff1015aba","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1105: REMOTE FILE COPY","external_references":[{"source_name":"mitre-attack","external_id":"T1105: REMOTE FILE COPY","url":"https://attack.mitre.org/techniques/T1105: REMOTE FILE COPY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--876760b2-8359-5851-b936-7ed105f89339","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--62023884-7b7a-5feb-b024-718ff1015aba"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--ccc64fc9-8795-5bef-9a32-389a5239333d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1021.002: SMB/WINDOWS ADMIN SHARES","external_references":[{"source_name":"mitre-attack","external_id":"T1021.002: SMB/WINDOWS ADMIN SHARES","url":"https://attack.mitre.org/techniques/T1021.002: SMB/WINDOWS ADMIN SHARES"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--4f42e42e-c6e5-57f2-90c1-2119974e496d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--ccc64fc9-8795-5bef-9a32-389a5239333d"},{"type":"relationship","spec_version":"2.1","id":"relationship--a435ee8d-fdda-56a0-a9eb-dd79a98cb521","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--815dad65-a680-5efd-8c47-bbadc55751a9","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1018: REMOTE SYSTEM DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1018: REMOTE SYSTEM DISCOVERY","url":"https://attack.mitre.org/techniques/T1018: REMOTE SYSTEM DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--4fb4707c-59ad-5ba7-8675-3d10df58d55e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--815dad65-a680-5efd-8c47-bbadc55751a9"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--f21341c3-6e57-539d-a223-9f2170b14fc6","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1489: SERVICE STOP","external_references":[{"source_name":"mitre-attack","external_id":"T1489: SERVICE STOP","url":"https://attack.mitre.org/techniques/T1489: SERVICE STOP"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--47306e02-d34c-5516-a908-18a41cd6ebde","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--f21341c3-6e57-539d-a223-9f2170b14fc6"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--05cf6c8e-7525-505d-8407-f66e24e7e584","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1555.003: CREDENTIALS FROM WEB BROWSERS","external_references":[{"source_name":"mitre-attack","external_id":"T1555.003: CREDENTIALS FROM WEB BROWSERS","url":"https://attack.mitre.org/techniques/T1555.003: CREDENTIALS FROM WEB BROWSERS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--83cfa09f-ad79-5796-ac28-fa7aecc07a1c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--05cf6c8e-7525-505d-8407-f66e24e7e584"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--31af36a7-3964-5a70-9498-d8ab3d0c507c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1082: SYSTEM INFORMATION DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1082: SYSTEM INFORMATION DISCOVERY","url":"https://attack.mitre.org/techniques/T1082: SYSTEM INFORMATION DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--c7ba5b0a-89d6-56df-8c19-a026bde36f90","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--31af36a7-3964-5a70-9498-d8ab3d0c507c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--8ade5be2-4717-5f34-ac0f-13b47fc55e88","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1016: SYSTEM NETWORK CONFIGURATION DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1016: SYSTEM NETWORK CONFIGURATION DISCOVERY","url":"https://attack.mitre.org/techniques/T1016: SYSTEM NETWORK CONFIGURATION DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--903d4cf8-e06f-5789-883a-a92378cb38f1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--8ade5be2-4717-5f34-ac0f-13b47fc55e88"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--0b75cf8a-ac12-524d-badb-5904cc1844b3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1059.002: SERVICE EXECUTION","external_references":[{"source_name":"mitre-attack","external_id":"T1059.002: SERVICE EXECUTION","url":"https://attack.mitre.org/techniques/T1059.002: SERVICE EXECUTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--b510424d-0103-50b4-92c7-2d4da17c4675","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--0b75cf8a-ac12-524d-badb-5904cc1844b3"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--9da45399-37bb-588b-aec7-ecbea9215347","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1537: TRANSFER DATA TO CLOUD ACCOUNT","external_references":[{"source_name":"mitre-attack","external_id":"T1537: TRANSFER DATA TO CLOUD ACCOUNT","url":"https://attack.mitre.org/techniques/T1537: TRANSFER DATA TO CLOUD ACCOUNT"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--46907b67-10ec-559f-9a96-c2a0df1253a9","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--9da45399-37bb-588b-aec7-ecbea9215347"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--76839f0b-4e55-579b-b4c3-76505a949a5b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1552.001: CREDENTIALS IN FILES","external_references":[{"source_name":"mitre-attack","external_id":"T1552.001: CREDENTIALS IN FILES","url":"https://attack.mitre.org/techniques/T1552.001: CREDENTIALS IN FILES"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--9a8500d5-ab1c-5546-b624-6a7a5d112c39","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--76839f0b-4e55-579b-b4c3-76505a949a5b"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--2724c52f-c706-55e4-9e63-f3f0bb377daa","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1552.002: CREDENTIALS IN REGISTRY","external_references":[{"source_name":"mitre-attack","external_id":"T1552.002: CREDENTIALS IN REGISTRY","url":"https://attack.mitre.org/techniques/T1552.002: CREDENTIALS IN REGISTRY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--94587283-27d7-5d57-91ac-645de3eadb97","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--2724c52f-c706-55e4-9e63-f3f0bb377daa"},{"type":"relationship","spec_version":"2.1","id":"relationship--907792e9-2ddd-53c7-a1d1-d2f81e242341","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--edd49e22-3cf6-52b0-a964-cc97c62d25c1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1078.002: DOMAIN ACCOUNTS","external_references":[{"source_name":"mitre-attack","external_id":"T1078.002: DOMAIN ACCOUNTS","url":"https://attack.mitre.org/techniques/T1078.002: DOMAIN ACCOUNTS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--d5007ba3-1b7c-5efe-9d9c-10afb5e33e3d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--edd49e22-3cf6-52b0-a964-cc97c62d25c1"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--c29ef76f-bb05-597d-887f-747cfda6938c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1071.004: WEB SERVICE","external_references":[{"source_name":"mitre-attack","external_id":"T1071.004: WEB SERVICE","url":"https://attack.mitre.org/techniques/T1071.004: WEB SERVICE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--9712122e-9a39-57d7-9090-d66c34a2611f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--c29ef76f-bb05-597d-887f-747cfda6938c"},{"type":"relationship","spec_version":"2.1","id":"relationship--194edf57-50eb-524c-a26b-ffab8d5a9f4e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7c4e13f7-d954-5103-b2bf-7dba805ea064","target_ref":"attack-pattern--abf9da00-5965-549c-b277-81f9ff9940d1"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--288d49b6-edbd-5570-8f74-fa67fca53d63","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"AKO","description":"Ransomware cartel / extortion group 'ako' monitored by CTI.FYI.","aliases":["ako"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ako.html","description":"CTI.FYI Dossier for ako"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--0150d3f8-e6ea-52ee-997c-40caba5c8895","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Alphalocker","description":"Ransomware cartel / extortion group 'alphalocker' monitored by CTI.FYI.","aliases":["alphalocker"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/alphalocker.html","description":"CTI.FYI Dossier for alphalocker"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--a924106d-930d-595b-b73d-d5b38d2dc23e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Alphv","description":"Active from November 2021 until an exit scam in March 2024, ALPHV pioneered enterprise ransomware engineering in Rust, providing a highly customizable payload for Windows, Linux, and VMware ESXi environments. The cartel targeted critical infrastructure, healthcare, defense, and technology conglomerates internationally, notorious for conducting the catastrophic Change Healthcare compromise. Initial access relied on credential theft from brokers and edge appliance exploitation, combined with aggressive triple extortion tactics incorporating stolen data leaks, DDoS attacks, and regulatory complaints to the SEC.","aliases":["alphv","BlackCat","ALPHV-ng","Noberus"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/alphv.html","description":"CTI.FYI Dossier for alphv"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--a452c9e3-ba16-5b66-bdf1-d66b61307620","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--a924106d-930d-595b-b73d-d5b38d2dc23e","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--2d94e1d5-9732-5abd-a78c-4661e09fb109","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--a924106d-930d-595b-b73d-d5b38d2dc23e","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--673ab657-e967-5621-bcb0-92f6528cf8bf","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--a924106d-930d-595b-b73d-d5b38d2dc23e","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--97736113-82bb-52ae-ae78-f6d260bde668","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--a924106d-930d-595b-b73d-d5b38d2dc23e","target_ref":"attack-pattern--abf9da00-5965-549c-b277-81f9ff9940d1"},{"type":"relationship","spec_version":"2.1","id":"relationship--7734f627-655b-5213-a8b7-401447eb9e43","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--a924106d-930d-595b-b73d-d5b38d2dc23e","target_ref":"attack-pattern--ccc64fc9-8795-5bef-9a32-389a5239333d"},{"type":"relationship","spec_version":"2.1","id":"relationship--9f49ab57-fb3e-5d43-805e-584fa2376194","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--a924106d-930d-595b-b73d-d5b38d2dc23e","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--9a5dd0c5-5744-5f37-9bdc-c049001b859d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--a924106d-930d-595b-b73d-d5b38d2dc23e","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--f402d15b-a71f-5d31-a9da-ff50a2b4beba","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--a924106d-930d-595b-b73d-d5b38d2dc23e","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--f59b57b7-aeac-5756-8c0e-b6c4e462564b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--a924106d-930d-595b-b73d-d5b38d2dc23e","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--3ed2bc06-37d1-5ca9-93bb-d8e89b771eec","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1498: NETWORK DENIAL OF SERVICE","external_references":[{"source_name":"mitre-attack","external_id":"T1498: NETWORK DENIAL OF SERVICE","url":"https://attack.mitre.org/techniques/T1498: NETWORK DENIAL OF SERVICE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--3980192a-9fe6-5c48-8730-8ac0d42fca5e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--a924106d-930d-595b-b73d-d5b38d2dc23e","target_ref":"attack-pattern--3ed2bc06-37d1-5ca9-93bb-d8e89b771eec"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--39642967-0c38-51e6-9d15-8c7f4d6a4007","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1070.004: FILE DELETION","external_references":[{"source_name":"mitre-attack","external_id":"T1070.004: FILE DELETION","url":"https://attack.mitre.org/techniques/T1070.004: FILE DELETION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--74659afc-6422-5a69-8d29-9785a22195d6","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--a924106d-930d-595b-b73d-d5b38d2dc23e","target_ref":"attack-pattern--39642967-0c38-51e6-9d15-8c7f4d6a4007"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--5d46fea8-406f-5300-af57-1fff3f7c12ae","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Anubis","description":"Ransomware cartel / extortion group 'anubis' monitored by CTI.FYI.","aliases":["anubis"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/anubis.html","description":"CTI.FYI Dossier for anubis"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--f1583c13-b988-5fb1-8e28-04d80ff5ee16","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Apos","description":"Ransomware cartel / extortion group 'apos' monitored by CTI.FYI.","aliases":["apos"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/apos.html","description":"CTI.FYI Dossier for apos"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--5b5b22cf-185f-5fe1-8c34-ee8e06f405e4","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Apt73","description":"A new ransomware group is said to have emerged in mid-April 2024, under the name \"APT73.\" It's worth noting that the group reportedly self-proclaimed as an APT, which stands for \"Advanced Persistent Threat\" in the cybersecurity field.\nAccording to research, much of the available information about the aforementioned group came from another ransomware group known as LockBit. This is evident as the group, on its Data Leak Site (DLS) website, added pages such as \"Contact Us,\" \"How to buy Bitcoin,\" \"Web Security Bug Bounty,\" and \"Mirrors.\"\nAnother relevant fact is that this group is also known as Ransomware Eraleig. This is because the group allegedly used a domain in the past to disclose information about victims. There is no information available about any Tactics, Techniques, and Procedures associated with this ransomware group, nor about the latest artifacts used for encryption purposes.","aliases":["apt73","Eraleign"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/apt73.html","description":"CTI.FYI Dossier for apt73"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--aa3867e1-89bb-5422-bd3c-62b8a5c441b4","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Arcusmedia","description":"Ransomware cartel / extortion group 'arcusmedia' monitored by CTI.FYI.","aliases":["arcusmedia","arcus media"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/arcusmedia.html","description":"CTI.FYI Dossier for arcusmedia"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--380b4b0d-df64-58c7-a3b4-7cd658031165","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Argonauts","description":"Ransomware cartel / extortion group 'argonauts' monitored by CTI.FYI.","aliases":["argonauts"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/argonauts.html","description":"CTI.FYI Dossier for argonauts"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--0c0f4d20-d2fe-5af5-867d-9a0916eae0e6","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Arkana","description":"Ransomware cartel / extortion group 'arkana' monitored by CTI.FYI.","aliases":["arkana"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/arkana.html","description":"CTI.FYI Dossier for arkana"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e44ab2f5-78d9-5128-a6d5-edf93768dec3","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Arvinclub","description":"Ransomware cartel / extortion group 'arvinclub' monitored by CTI.FYI.","aliases":["arvinclub"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/arvinclub.html","description":"CTI.FYI Dossier for arvinclub"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--cbfeb7f9-3ac9-5877-a36e-d7cce2e3df88","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Atomsilo","description":"AtomSilo is a new Ransomware recently seen in September 2021 during one of their attacks by exploiting a recently revealed vulnerability (CVE-2021-26084) in Atlassian’s Confluence Collaboration Software for initial access. The Ransomware used the double extortion method which is gaining popularity among ransomware threat actors where they first, exfiltrate the confidential information and as a second step encrypt the system files.","aliases":["atomsilo"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/atomsilo.html","description":"CTI.FYI Dossier for atomsilo"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c828267c-0607-5e9d-919b-4e7ad5c95611","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Avaddon","description":"Ransomware cartel / extortion group 'avaddon' monitored by CTI.FYI.","aliases":["avaddon"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/avaddon.html","description":"CTI.FYI Dossier for avaddon"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--61ad59cd-36ec-5323-b060-c37cb1940836","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Avos","description":"Ransomware cartel / extortion group 'avos' monitored by CTI.FYI.","aliases":["avos"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/avos.html","description":"CTI.FYI Dossier for avos"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--86907256-c6e8-537c-8849-df7af6f1d81c","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Avoslocker","description":"Ransomware cartel / extortion group 'avoslocker' monitored by CTI.FYI.","aliases":["avoslocker"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/avoslocker.html","description":"CTI.FYI Dossier for avoslocker"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--9ef88fe6-9016-5441-ad9f-d67c4b5b243c","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Aware","description":"Ransomware cartel / extortion group 'aware' monitored by CTI.FYI.","aliases":["aware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/aware.html","description":"CTI.FYI Dossier for aware"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d4584271-52fc-5def-9358-ffb252ca804f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Aztroteam","description":"Ransomware cartel / extortion group 'aztroteam' monitored by CTI.FYI.","aliases":["aztroteam"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/aztroteam.html","description":"CTI.FYI Dossier for aztroteam"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--deb3e86c-b3b1-5695-8eb9-7c17f8bab6ba","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Babuk","description":"Ransomware cartel / extortion group 'babuk' monitored by CTI.FYI.","aliases":["babuk"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/babuk.html","description":"CTI.FYI Dossier for babuk"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--1860e948-30aa-5628-adb4-6f19d5b25f33","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Babuk2","description":"Ransomware cartel / extortion group 'babuk2' monitored by CTI.FYI.","aliases":["babuk2"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/babuk2.html","description":"CTI.FYI Dossier for babuk2"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--acbcc596-6fcb-5c1d-959a-1cc4f9d4b196","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Babyduck","description":"Ransomware cartel / extortion group 'babyduck' monitored by CTI.FYI.","aliases":["babyduck"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/babyduck.html","description":"CTI.FYI Dossier for babyduck"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--24ef36ea-6ce6-537d-bb88-c817b319c998","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Beast","description":"Ransomware cartel / extortion group 'beast' monitored by CTI.FYI.","aliases":["beast"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/beast.html","description":"CTI.FYI Dossier for beast"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e234c08a-2658-5dd8-8fb2-9242ed334004","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Benzona","description":"Ransomware cartel / extortion group 'benzona' monitored by CTI.FYI.","aliases":["benzona"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/benzona.html","description":"CTI.FYI Dossier for benzona"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--80af5997-f4bc-5f9f-aa8c-a7e5a47ad028","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Bert","description":"Ransomware cartel / extortion group 'bert' monitored by CTI.FYI.","aliases":["bert"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/bert.html","description":"CTI.FYI Dossier for bert"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--1d04bf91-9906-55c1-b763-3a25544655c9","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Bianlian","description":"Debuting in June 2022 with a custom Go-based encryptor, BianLian strategically shifted in early 2023 to an extortion-only model focusing on massive data theft rather than file locking following public decryptor availability. The syndicate targets healthcare, legal, manufacturing, and financial organizations primarily situated in the United States and Europe. Gaining entry through compromised RDP/VPN credentials and unpatched perimeter vulnerabilities, operators exfiltrate gigabytes of proprietary records before threatening public disclosure and directly harassing enterprise clients.","aliases":["bianlian","Bian Lian"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/bianlian.html","description":"CTI.FYI Dossier for bianlian"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--ac7b481c-439a-56fa-af95-22a51842f866","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--1d04bf91-9906-55c1-b763-3a25544655c9","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--95eae118-c41b-5d57-be87-c8864a5a8c51","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--1d04bf91-9906-55c1-b763-3a25544655c9","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--99ab42b0-2da8-5580-98d9-e2d309831593","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--1d04bf91-9906-55c1-b763-3a25544655c9","target_ref":"attack-pattern--3c56009c-3d1f-5821-8c89-4ca4a0996ee2"},{"type":"relationship","spec_version":"2.1","id":"relationship--334e32b1-4874-5ada-a05a-4d316f760000","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--1d04bf91-9906-55c1-b763-3a25544655c9","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--96d11231-0cec-52c0-8024-7e957b5338b0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--1d04bf91-9906-55c1-b763-3a25544655c9","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"relationship","spec_version":"2.1","id":"relationship--d9b7a32f-d342-5326-a403-decc281ac3b8","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--1d04bf91-9906-55c1-b763-3a25544655c9","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--408ac848-4a86-508e-a56e-83c6e2861f83","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--1d04bf91-9906-55c1-b763-3a25544655c9","target_ref":"attack-pattern--d6072347-6a27-513e-aa9a-e3ced566f6bb"},{"type":"relationship","spec_version":"2.1","id":"relationship--4a120826-7f03-51b7-95f0-f1ae75cdc9cf","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--1d04bf91-9906-55c1-b763-3a25544655c9","target_ref":"attack-pattern--ff17dd9a-2362-5b5c-bc25-ba0a884b580f"},{"type":"relationship","spec_version":"2.1","id":"relationship--ef8112af-2c4a-57b7-bf40-4566650a530d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--1d04bf91-9906-55c1-b763-3a25544655c9","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--71ddcca7-b684-5955-b02f-2d56ebc5303e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--1d04bf91-9906-55c1-b763-3a25544655c9","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--9a5fd149-1b32-5eef-9fec-d6d3897036e6","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Blackbasta","description":"Emerging in April 2022 as an offshoot linked to Conti core developers and FIN7 (UNC4393), Black Basta operates a closed, elite Ransomware-as-a-Service model using sophisticated C/C++ binaries for Windows and ESXi. The cartel targets healthcare, defense, manufacturing, and government entities in the United States, Europe, and Australia with swift multithreaded ChaCha20 encryption. Access vectors encompass Qakbot and DarkGate malware distribution, spearphishing, voice phishing (vishing) impersonating IT helpdesks, and double extortion through their Basta News leak platform.","aliases":["blackbasta","Black Basta","UNC4393"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/blackbasta.html","description":"CTI.FYI Dossier for blackbasta"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--1239e730-ae84-5161-88c8-9993eacce80c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9a5fd149-1b32-5eef-9fec-d6d3897036e6","target_ref":"attack-pattern--c936ce1b-2bbf-59ed-ae9e-2897cc1129e5"},{"type":"relationship","spec_version":"2.1","id":"relationship--4eff3564-ca5f-56b8-a5e8-094bd2bc711d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9a5fd149-1b32-5eef-9fec-d6d3897036e6","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--bfbcc3c1-89b9-5ed1-802d-90b03b75fabd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9a5fd149-1b32-5eef-9fec-d6d3897036e6","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--688ec727-85dd-5cc2-aef8-07835b601d34","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9a5fd149-1b32-5eef-9fec-d6d3897036e6","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--1b0c5018-ad3f-5eb2-86e4-a0bc5687bf2f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9a5fd149-1b32-5eef-9fec-d6d3897036e6","target_ref":"attack-pattern--abf9da00-5965-549c-b277-81f9ff9940d1"},{"type":"relationship","spec_version":"2.1","id":"relationship--cf761f97-6807-5c8b-b775-1d6e4940787f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9a5fd149-1b32-5eef-9fec-d6d3897036e6","target_ref":"attack-pattern--ccc64fc9-8795-5bef-9a32-389a5239333d"},{"type":"relationship","spec_version":"2.1","id":"relationship--fbe5287f-d118-58fa-a37b-182a19c6cab6","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9a5fd149-1b32-5eef-9fec-d6d3897036e6","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--942c212e-9553-5be7-966e-11c07c96cb67","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9a5fd149-1b32-5eef-9fec-d6d3897036e6","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--06bb9854-66ee-5914-9b5b-ab047a021f52","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9a5fd149-1b32-5eef-9fec-d6d3897036e6","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--a37036e5-3e15-5b5e-8102-5097a1e47dbd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9a5fd149-1b32-5eef-9fec-d6d3897036e6","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3735c882-bec5-5589-84da-406658b1cfdd","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Blackbyte","description":"Ransomware cartel / extortion group 'blackbyte' monitored by CTI.FYI.","aliases":["blackbyte"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/blackbyte.html","description":"CTI.FYI Dossier for blackbyte"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d5508785-2492-5063-98a2-854936bbaee1","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Blacklock","description":"Ransomware cartel / extortion group 'blacklock' monitored by CTI.FYI.","aliases":["blacklock"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/blacklock.html","description":"CTI.FYI Dossier for blacklock"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e9f49ae5-1b63-5bc5-a420-12419073986a","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Blackmatter","description":"Ransomware cartel / extortion group 'blackmatter' monitored by CTI.FYI.","aliases":["blackmatter"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/blackmatter.html","description":"CTI.FYI Dossier for blackmatter"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--182a2b31-311a-5fbc-aa23-213ea41cf4f7","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Blacknevas","description":"Ransomware cartel / extortion group 'blacknevas' monitored by CTI.FYI.","aliases":["blacknevas"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/blacknevas.html","description":"CTI.FYI Dossier for blacknevas"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--cf71ab9c-5cf1-5163-aadf-28838c603036","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Blackout","description":"Ransomware","aliases":["blackout"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/blackout.html","description":"CTI.FYI Dossier for blackout"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--98d1cd6d-74b2-54fe-b2e0-585cea713ca6","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Blackshadow","description":"Ransomware cartel / extortion group 'blackshadow' monitored by CTI.FYI.","aliases":["blackshadow"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/blackshadow.html","description":"CTI.FYI Dossier for blackshadow"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--0e92b630-431f-5efc-a5c7-bf581fbcf3dd","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Blackshrantac","description":"Ransomware cartel / extortion group 'blackshrantac' monitored by CTI.FYI.","aliases":["blackshrantac"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/blackshrantac.html","description":"CTI.FYI Dossier for blackshrantac"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c15fd9a0-16e9-5a76-a010-1a4c1c9c6c7f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Blacksuit","description":"Emerging in May 2023, BlackSuit is an aggressive double-extortion ransomware operation operated by the former Conti and Royal syndicate core (tracked by Unit 42 as Ignoble Scorpius). Written in C++ targeting both Windows and Linux/VMware ESXi architectures (sharing over 98% binary code similarity with Royal), the group conducts high-impact intrusions demanding tens of millions of dollars across critical infrastructure, manufacturing, education, and healthcare sectors. Initial access is established through callback phishing (vishing), compromised third-party credentials, and the exploitation of edge network devices and VPN vulnerabilities.","aliases":["blacksuit","Royal","Royal Ransomware","Ignoble Scorpius"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/blacksuit.html","description":"CTI.FYI Dossier for blacksuit"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--7080e75a-3a92-59b2-b54a-9983f48f6bcd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c15fd9a0-16e9-5a76-a010-1a4c1c9c6c7f","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--694deecb-6200-5fbf-9576-9e2aee70be28","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c15fd9a0-16e9-5a76-a010-1a4c1c9c6c7f","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--75c27c74-db7b-5a81-9f0f-98ee8266e16c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c15fd9a0-16e9-5a76-a010-1a4c1c9c6c7f","target_ref":"attack-pattern--c936ce1b-2bbf-59ed-ae9e-2897cc1129e5"},{"type":"relationship","spec_version":"2.1","id":"relationship--d7c4aceb-9a8e-5be9-87db-50881986eb44","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c15fd9a0-16e9-5a76-a010-1a4c1c9c6c7f","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--a87fb660-b1c9-5bb8-aa16-c76bcd77e024","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c15fd9a0-16e9-5a76-a010-1a4c1c9c6c7f","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"relationship","spec_version":"2.1","id":"relationship--3bb9c9de-02d5-5168-b390-fca7d4b119bf","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c15fd9a0-16e9-5a76-a010-1a4c1c9c6c7f","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--7b19a953-4e92-5944-a115-f012d67b6e33","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c15fd9a0-16e9-5a76-a010-1a4c1c9c6c7f","target_ref":"attack-pattern--ccc64fc9-8795-5bef-9a32-389a5239333d"},{"type":"relationship","spec_version":"2.1","id":"relationship--967f5940-a791-5955-ba88-2500274cfc63","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c15fd9a0-16e9-5a76-a010-1a4c1c9c6c7f","target_ref":"attack-pattern--2fa3d470-1027-52ef-910e-02e00b738c0b"},{"type":"relationship","spec_version":"2.1","id":"relationship--8268f3db-e44b-5385-981f-70220e9f344d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c15fd9a0-16e9-5a76-a010-1a4c1c9c6c7f","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--a89bbaff-4b11-5fe8-8d3a-d8ec6025d02e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c15fd9a0-16e9-5a76-a010-1a4c1c9c6c7f","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--750cedd8-788b-561c-b930-9958203f5bbd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c15fd9a0-16e9-5a76-a010-1a4c1c9c6c7f","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--10374994-d442-5303-988c-b91bba2e3548","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c15fd9a0-16e9-5a76-a010-1a4c1c9c6c7f","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--708084f2-4d0d-5a02-86f5-6f3ed505eb23","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Blacktor","description":"Ransomware cartel / extortion group 'blacktor' monitored by CTI.FYI.","aliases":["blacktor"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/blacktor.html","description":"CTI.FYI Dossier for blacktor"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--16c24f7d-5729-5b13-b172-750152d0c452","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Bluebox","description":"Ransomware cartel / extortion group 'bluebox' monitored by CTI.FYI.","aliases":["bluebox"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/bluebox.html","description":"CTI.FYI Dossier for bluebox"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3689888e-fd44-5f33-bd36-3c7152c7a2cf","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Bluelocker","description":"Ransomware cartel / extortion group 'bluelocker' monitored by CTI.FYI.","aliases":["bluelocker"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/bluelocker.html","description":"CTI.FYI Dossier for bluelocker"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e1b8b6f1-d680-5b78-8e2f-2d893ee9d57b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Bluesky","description":"Ransomware cartel / extortion group 'bluesky' monitored by CTI.FYI.","aliases":["bluesky"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/bluesky.html","description":"CTI.FYI Dossier for bluesky"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--491c548c-b45e-5a3b-a4e8-f90b4b2674e1","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Bonacigroup","description":"Ransomware cartel / extortion group 'bonacigroup' monitored by CTI.FYI.","aliases":["bonacigroup"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/bonacigroup.html","description":"CTI.FYI Dossier for bonacigroup"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--8e453c2a-4684-5db3-b1bb-2f7568c437e6","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Bqtlock","description":"Ransomware cartel / extortion group 'bqtlock' monitored by CTI.FYI.","aliases":["bqtlock"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/bqtlock.html","description":"CTI.FYI Dossier for bqtlock"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--aadd1b7f-ebbd-5489-a99d-e8cc4fb3562d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Braincipher","description":"In mid-June 2024, a new ransomware operation named Brain Cipher emerged, notably targeting Indonesia's National Data Center. This attack disrupted immigration operations at airports and various other government services.\nThe payload employed by this group is based on the leaked LockBit 3.0 builder. Comparative analyses have confirmed significant similarities between Brain Cipher and LockBit 3.0 samples. Notably, the attackers modified the ransomware to not only append a new extension to encrypted files but also to encrypt the filenames themselves.\nAdditionally, it was identified that the group appears to be in its early stages, as evidenced by their use of the leaked LockBit 3.0 builder and their recent operations. After encrypting the data, the ransomware generates ransom notes named “added_extension.README.txt.” These notes contain a description of what occurred and a link to the attackers' website hosted on the Tor network.","aliases":["BrainCipher","brain cipher"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/braincipher.html","description":"CTI.FYI Dossier for BrainCipher"}]},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--6585ebda-91ae-5337-aa38-94a195d85fb7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1204.002: MALICIOUS FILE","external_references":[{"source_name":"mitre-attack","external_id":"T1204.002: MALICIOUS FILE","url":"https://attack.mitre.org/techniques/T1204.002: MALICIOUS FILE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--d410a8e6-5714-53e6-b39a-5270792f7b18","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aadd1b7f-ebbd-5489-a99d-e8cc4fb3562d","target_ref":"attack-pattern--6585ebda-91ae-5337-aa38-94a195d85fb7"},{"type":"relationship","spec_version":"2.1","id":"relationship--59e82c96-8ca4-5f3f-bc23-f57815ca1b7e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aadd1b7f-ebbd-5489-a99d-e8cc4fb3562d","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--a04758ed-4e8a-59ff-bf36-5413200833b2","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aadd1b7f-ebbd-5489-a99d-e8cc4fb3562d","target_ref":"attack-pattern--39642967-0c38-51e6-9d15-8c7f4d6a4007"},{"type":"relationship","spec_version":"2.1","id":"relationship--d44dce02-b3bd-5486-b1b2-52069a520307","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aadd1b7f-ebbd-5489-a99d-e8cc4fb3562d","target_ref":"attack-pattern--d6072347-6a27-513e-aa9a-e3ced566f6bb"},{"type":"relationship","spec_version":"2.1","id":"relationship--44c9797a-4c1a-5963-8aad-1b0ddc614ada","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aadd1b7f-ebbd-5489-a99d-e8cc4fb3562d","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--1efa4f30-4a30-5496-b99b-578e836ef4b2","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aadd1b7f-ebbd-5489-a99d-e8cc4fb3562d","target_ref":"attack-pattern--c766f3ae-00d8-5e1e-966f-2ff2363bb5d2"},{"type":"relationship","spec_version":"2.1","id":"relationship--f981a7bc-7d6b-50fa-aef6-10f850451721","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aadd1b7f-ebbd-5489-a99d-e8cc4fb3562d","target_ref":"attack-pattern--e46e931b-8da7-5046-b02c-552590554321"},{"type":"relationship","spec_version":"2.1","id":"relationship--ff47ca44-3da4-570e-972f-2e5a7524d3e0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aadd1b7f-ebbd-5489-a99d-e8cc4fb3562d","target_ref":"attack-pattern--911a8af3-d599-5d6a-ab9b-f3130ac4540b"},{"type":"relationship","spec_version":"2.1","id":"relationship--cc1b2b56-0464-51b3-9ea9-3ebaa4bdf0dc","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aadd1b7f-ebbd-5489-a99d-e8cc4fb3562d","target_ref":"attack-pattern--4b38d0b3-5f17-58b3-bee5-73b57d668693"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--8f1196b6-6ad9-5a8a-be13-9e844d704c49","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Bravox","description":"Ransomware cartel / extortion group 'bravox' monitored by CTI.FYI.","aliases":["bravox"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/bravox.html","description":"CTI.FYI Dossier for bravox"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--2389217c-0ce1-5fc3-a80d-d55bb7739e44","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Brotherhood","description":"Ransomware cartel / extortion group 'brotherhood' monitored by CTI.FYI.","aliases":["brotherhood"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/brotherhood.html","description":"CTI.FYI Dossier for brotherhood"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Cactus","description":"The CACTUS ransomware is said to have emerged around March 2023. The group became known for exploiting vulnerabilities to gain initial access and maintain a presence within the organization's infrastructure.\nThere is little known information about the ransomware group, except that it emerged on the mentioned date and, following encryption, a text file named 'cAcTuS.readme.txt' would be created. Additionally, encrypted files were altered to the '.cts1' extension, and data exfiltration and victim extortion were conducted through the use of the service known as Tox.\nAs mentioned earlier, the ransomware especially exploits vulnerabilities in VPNs, also utilizing obfuscation techniques to conceal its activities, such as employing UPX and utilizing encryption algorithms like OpenSSL, AES OCB, ChaCha20_Poly1305, system reinitializations, and others.","aliases":["cactus"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/cactus.html","description":"CTI.FYI Dossier for cactus"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--502bb246-1d89-53f4-808d-f2adc7deb87b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--ea836819-2c59-5dce-b733-fb24832984da"},{"type":"relationship","spec_version":"2.1","id":"relationship--201770ac-b965-5649-928c-2262c3b41059","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--c766f3ae-00d8-5e1e-966f-2ff2363bb5d2"},{"type":"relationship","spec_version":"2.1","id":"relationship--b52a0212-3bbf-5f4c-9add-666debe00cb2","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--9911f220-a14b-503f-aab4-534d965ba5c0"},{"type":"relationship","spec_version":"2.1","id":"relationship--1aeee58a-e929-5de9-92fe-33cdbdfe83fa","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--0f949b67-daa3-5971-ab2e-a3c56df11258"},{"type":"relationship","spec_version":"2.1","id":"relationship--accba405-c22b-592a-8399-c82069c37649","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--e46e931b-8da7-5046-b02c-552590554321"},{"type":"relationship","spec_version":"2.1","id":"relationship--5941675a-f037-51f3-972c-a442d7d31805","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--bc838a74-1e49-5ab3-bafd-9de9528e8351"},{"type":"relationship","spec_version":"2.1","id":"relationship--5fb86a94-f2d9-5d83-a493-baddadd05ca5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--911a8af3-d599-5d6a-ab9b-f3130ac4540b"},{"type":"relationship","spec_version":"2.1","id":"relationship--1e6a388f-1db7-5702-b46f-92f2de048e76","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--41d1f133-ebb2-5443-aa50-3b4ed95b9658"},{"type":"relationship","spec_version":"2.1","id":"relationship--2e6dfc35-f9ec-5284-872c-f5fa96c38dd4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--7b9cd7aa-9472-5604-8363-1bc759ae90c3"},{"type":"relationship","spec_version":"2.1","id":"relationship--c21ed39a-7e11-5ca4-9509-e7ba6732c26b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--abbb39a5-1fb5-527d-a4a0-462b2a23735b"},{"type":"relationship","spec_version":"2.1","id":"relationship--8e5bcde8-8a91-5394-a7a5-5ceb682a9f91","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--52c8476d-26b5-599c-91b1-ebf98115378c"},{"type":"relationship","spec_version":"2.1","id":"relationship--4bd62206-b580-5e16-ae0d-d7f1292cb199","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--4b38d0b3-5f17-58b3-bee5-73b57d668693"},{"type":"relationship","spec_version":"2.1","id":"relationship--84b3652c-cffd-5165-b106-c3d1f28a1551","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--bacc350b-18c6-5016-b4f2-f53fdd1091aa","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"relationship","spec_version":"2.1","id":"relationship--c6f606ab-de2e-5ed3-ae9c-7f305af1b644","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--05cf6c8e-7525-505d-8407-f66e24e7e584"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--20b4c69e-828e-550a-831b-65b7241fd338","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1027: OBFUSCATED FILES OR INFORMATION","external_references":[{"source_name":"mitre-attack","external_id":"T1027: OBFUSCATED FILES OR INFORMATION","url":"https://attack.mitre.org/techniques/T1027: OBFUSCATED FILES OR INFORMATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--ea447344-3848-575d-b3a3-a4d806640c28","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--20b4c69e-828e-550a-831b-65b7241fd338"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--21278ee5-fd98-584c-a0c7-074a3e278dd7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1049: SYSTEM NETWORK CONNECTIONS DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1049: SYSTEM NETWORK CONNECTIONS DISCOVERY","url":"https://attack.mitre.org/techniques/T1049: SYSTEM NETWORK CONNECTIONS DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--0443c65d-5514-50ea-bc91-a861a9c9fed5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--21278ee5-fd98-584c-a0c7-074a3e278dd7"},{"type":"relationship","spec_version":"2.1","id":"relationship--d587e77a-9527-5522-b029-87ca92bb5b2f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--d78f58be-e555-58ca-ae58-9b3f1c84e3ac"},{"type":"relationship","spec_version":"2.1","id":"relationship--3d89c2a5-8513-5692-913f-337b58bbd9bd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--65b85666-76d4-56fd-a044-e1ca5a672c37","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--7af135c9-7c05-5af0-8e55-dcc77d44b0f7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--3b3206e2-b6eb-57f1-b12d-ae9e54bc0ea7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--e632955e-297b-569e-a458-cab9dbe12bab"},{"type":"relationship","spec_version":"2.1","id":"relationship--b85cda3f-84ac-5b38-b6da-2d6eff524c02","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--815dad65-a680-5efd-8c47-bbadc55751a9"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--7d14d34e-4fed-5688-8e3b-71e639598599","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1072: SOFTWARE DEPLOYMENT TOOLS","external_references":[{"source_name":"mitre-attack","external_id":"T1072: SOFTWARE DEPLOYMENT TOOLS","url":"https://attack.mitre.org/techniques/T1072: SOFTWARE DEPLOYMENT TOOLS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--2431d83f-69f5-5d0c-9258-c82a6b64bbf7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--7d14d34e-4fed-5688-8e3b-71e639598599"},{"type":"relationship","spec_version":"2.1","id":"relationship--17845418-a4df-5ebf-9bce-0eee66f40d1c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--005b7141-741d-5927-bd5b-253aec9d3477"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--d5b15a6d-b955-5900-9821-562e75b89c99","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1219: REMOTE ACCESS SOFTWARE","external_references":[{"source_name":"mitre-attack","external_id":"T1219: REMOTE ACCESS SOFTWARE","url":"https://attack.mitre.org/techniques/T1219: REMOTE ACCESS SOFTWARE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--d9247b94-590b-5afd-abca-90db6c5e3f66","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--d5b15a6d-b955-5900-9821-562e75b89c99"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--ff1278ea-83eb-5923-ad16-5af81522e5e3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1027.002: SOFTWARE PACKING","external_references":[{"source_name":"mitre-attack","external_id":"T1027.002: SOFTWARE PACKING","url":"https://attack.mitre.org/techniques/T1027.002: SOFTWARE PACKING"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--aedf702d-fb6a-5d8b-a23c-71be0278d89d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--ff1278ea-83eb-5923-ad16-5af81522e5e3"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--e9227c40-1fbd-5838-9f59-a55712e0b3a3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1087.002: DOMAIN ACCOUNT","external_references":[{"source_name":"mitre-attack","external_id":"T1087.002: DOMAIN ACCOUNT","url":"https://attack.mitre.org/techniques/T1087.002: DOMAIN ACCOUNT"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--71ec88af-4adf-5f11-b48b-938f8ebc8405","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--e9227c40-1fbd-5838-9f59-a55712e0b3a3"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--f003c278-bfaf-57bf-a0a3-409afc25ca02","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1053.005: SCHEDULED TASK","external_references":[{"source_name":"mitre-attack","external_id":"T1053.005: SCHEDULED TASK","url":"https://attack.mitre.org/techniques/T1053.005: SCHEDULED TASK"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--9f8c39eb-5d1d-5949-99cb-53168aaa0ccc","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--f003c278-bfaf-57bf-a0a3-409afc25ca02"},{"type":"relationship","spec_version":"2.1","id":"relationship--f576fc7a-ec4e-5d51-b9de-d7956cea3585","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--3eeee68c-4f87-5934-810a-24add8ada0b4"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--2c46deba-d61b-5e30-baec-1d375ab04052","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1119: AUTOMATED COLLECTION","external_references":[{"source_name":"mitre-attack","external_id":"T1119: AUTOMATED COLLECTION","url":"https://attack.mitre.org/techniques/T1119: AUTOMATED COLLECTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--deba8743-7813-561a-a48c-ed367b6d4f59","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--2c46deba-d61b-5e30-baec-1d375ab04052"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--10fdb2da-2faf-501d-bbf4-f3ba50e7b46c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1136: CREATE ACCOUNT","external_references":[{"source_name":"mitre-attack","external_id":"T1136: CREATE ACCOUNT","url":"https://attack.mitre.org/techniques/T1136: CREATE ACCOUNT"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--1f88cb8d-d28d-5706-b53b-69a9d45c2676","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--10fdb2da-2faf-501d-bbf4-f3ba50e7b46c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--7e803cee-6f36-5e91-bfb6-bc29922d433c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1090: PROXY","external_references":[{"source_name":"mitre-attack","external_id":"T1090: PROXY","url":"https://attack.mitre.org/techniques/T1090: PROXY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--e5a0b31e-de90-5aec-b314-b4294fe3d023","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2c1b65ae-2a06-57d3-a1eb-8d39c8c3982e","target_ref":"attack-pattern--7e803cee-6f36-5e91-bfb6-bc29922d433c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--8f463a4f-e5d2-5ff7-8baa-faf7fe9e97d0","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Cephalus","description":"Ransomware cartel / extortion group 'cephalus' monitored by CTI.FYI.","aliases":["cephalus"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/cephalus.html","description":"CTI.FYI Dossier for cephalus"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--56813c1b-1727-5a55-b4af-162e9a9a120b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Chaos","description":"Ransomware cartel / extortion group 'chaos' monitored by CTI.FYI.","aliases":["chaos"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/chaos.html","description":"CTI.FYI Dossier for chaos"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c186d2bd-77a7-5543-80f6-db7def1fd1e1","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Cheers","description":"Ransomware cartel / extortion group 'cheers' monitored by CTI.FYI.","aliases":["cheers"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/cheers.html","description":"CTI.FYI Dossier for cheers"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--57d9e6fb-2b1a-5edd-a233-bcb10c5e5837","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Chilelocker","description":"Ransomware cartel / extortion group 'chilelocker' monitored by CTI.FYI.","aliases":["chilelocker"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/chilelocker.html","description":"CTI.FYI Dossier for chilelocker"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--25db06d8-a7ce-59e7-bfc3-b1d29e094f8e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Chort","description":"Ransomware cartel / extortion group 'chort' monitored by CTI.FYI.","aliases":["chort"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/chort.html","description":"CTI.FYI Dossier for chort"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--4873ef74-1e3d-55fd-a40e-c88a270c4a4c","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Cicada3301","description":"Ransomware cartel / extortion group 'cicada3301' monitored by CTI.FYI.","aliases":["cicada3301"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/cicada3301.html","description":"CTI.FYI Dossier for cicada3301"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c574715e-b478-5521-94d5-4a2d3f8b7bcc","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ciphbit","description":"Ransomware cartel / extortion group 'ciphbit' monitored by CTI.FYI.","aliases":["ciphbit"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ciphbit.html","description":"CTI.FYI Dossier for ciphbit"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--8df89988-10ae-578e-9368-4d93eda778f0","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Cipherforce","description":"Ransomware cartel / extortion group 'cipherforce' monitored by CTI.FYI.","aliases":["cipherforce"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/cipherforce.html","description":"CTI.FYI Dossier for cipherforce"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--189c2aaf-502d-54ab-90ce-a85fde3834b9","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Cloak","description":"Ransomware cartel / extortion group 'cloak' monitored by CTI.FYI.","aliases":["cloak"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/cloak.html","description":"CTI.FYI Dossier for cloak"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Clop","description":"Observed for the first time in Febuary 2019, variant from CryptoMix Family, itself a variation from CryptXXX and CryptoWall family","aliases":["clop","Cl0p"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/clop.html","description":"CTI.FYI Dossier for clop"}]},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--cb7522cf-b85c-5e17-88e4-95d687bf17c2","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1001: DATA OBFUSCATION","external_references":[{"source_name":"mitre-attack","external_id":"T1001: DATA OBFUSCATION","url":"https://attack.mitre.org/techniques/T1001: DATA OBFUSCATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--fe78a96c-2e4f-513c-96f2-c2ce5592373b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--cb7522cf-b85c-5e17-88e4-95d687bf17c2"},{"type":"relationship","spec_version":"2.1","id":"relationship--d1fdd619-525d-542f-b47d-908c8ca1783a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--e632955e-297b-569e-a458-cab9dbe12bab"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--ba6b20a4-a59f-5097-bad1-868c4fe6dcbb","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1005: DATA FROM LOCAL SYSTEM","external_references":[{"source_name":"mitre-attack","external_id":"T1005: DATA FROM LOCAL SYSTEM","url":"https://attack.mitre.org/techniques/T1005: DATA FROM LOCAL SYSTEM"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--29e7cae7-0d62-5ab0-a82e-346903e34a3e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--ba6b20a4-a59f-5097-bad1-868c4fe6dcbb"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--9c9fab64-1fa1-52c9-9ed9-a70c94fd7f6b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1011: EXFILTRATION OVER OTHER NETWORK MEDIUM","external_references":[{"source_name":"mitre-attack","external_id":"T1011: EXFILTRATION OVER OTHER NETWORK MEDIUM","url":"https://attack.mitre.org/techniques/T1011: EXFILTRATION OVER OTHER NETWORK MEDIUM"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--4bff7162-dd72-5bd2-a604-9f1f31bfc2ac","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--9c9fab64-1fa1-52c9-9ed9-a70c94fd7f6b"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--6667805a-1335-5805-9f54-43cc1e242b71","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1012: QUERY REGISTRY","external_references":[{"source_name":"mitre-attack","external_id":"T1012: QUERY REGISTRY","url":"https://attack.mitre.org/techniques/T1012: QUERY REGISTRY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--adc23b3c-3b1e-527b-abd8-6ab6f3012a9c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--6667805a-1335-5805-9f54-43cc1e242b71"},{"type":"relationship","spec_version":"2.1","id":"relationship--cfe31333-0af1-5407-9ce4-aa275fec017f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--8ade5be2-4717-5f34-ac0f-13b47fc55e88"},{"type":"relationship","spec_version":"2.1","id":"relationship--e50f970c-e69b-53ee-b9ac-0a4f40c0e39c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--815dad65-a680-5efd-8c47-bbadc55751a9"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--a7723a62-8e11-57f5-ab7e-559a29bb2fb4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1020: AUTOMATED EXFILTRATION","external_references":[{"source_name":"mitre-attack","external_id":"T1020: AUTOMATED EXFILTRATION","url":"https://attack.mitre.org/techniques/T1020: AUTOMATED EXFILTRATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--6edeb2e5-b8e7-5c00-9e5c-fe16088c5730","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--a7723a62-8e11-57f5-ab7e-559a29bb2fb4"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--8ecf0644-f8fb-5a3b-b76a-12e986528f80","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1021: REMOTE SERVICES","external_references":[{"source_name":"mitre-attack","external_id":"T1021: REMOTE SERVICES","url":"https://attack.mitre.org/techniques/T1021: REMOTE SERVICES"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--d5838773-f7ef-561d-ae12-8fa7a37417ba","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--8ecf0644-f8fb-5a3b-b76a-12e986528f80"},{"type":"relationship","spec_version":"2.1","id":"relationship--6f0fb7cb-4147-5a67-9dc2-7a425c53f879","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--ccc64fc9-8795-5bef-9a32-389a5239333d"},{"type":"relationship","spec_version":"2.1","id":"relationship--00294a48-5f6a-5981-967d-e9130e2861bd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--20b4c69e-828e-550a-831b-65b7241fd338"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--bfe60fdc-5873-50ec-8687-264ad08a1cf3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1036: MASQUERADING","external_references":[{"source_name":"mitre-attack","external_id":"T1036: MASQUERADING","url":"https://attack.mitre.org/techniques/T1036: MASQUERADING"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--765bc3c3-a7c7-50ef-9eaa-1c0566b05346","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--bfe60fdc-5873-50ec-8687-264ad08a1cf3"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--2ba2da27-59d7-5cb5-9be8-591de5714381","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1036.001: INVALID CODE SIGNATURE","external_references":[{"source_name":"mitre-attack","external_id":"T1036.001: INVALID CODE SIGNATURE","url":"https://attack.mitre.org/techniques/T1036.001: INVALID CODE SIGNATURE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--316398e9-db94-5cc3-b68a-1c7542035dc5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--2ba2da27-59d7-5cb5-9be8-591de5714381"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--5b74addd-c071-5333-b9cf-71e931b77520","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1037: BOOT OR LOGON INITIALIZATION SCRIPTS","external_references":[{"source_name":"mitre-attack","external_id":"T1037: BOOT OR LOGON INITIALIZATION SCRIPTS","url":"https://attack.mitre.org/techniques/T1037: BOOT OR LOGON INITIALIZATION SCRIPTS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--67a00458-4cb6-5b1d-9d17-d7070bdf52ab","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--5b74addd-c071-5333-b9cf-71e931b77520"},{"type":"relationship","spec_version":"2.1","id":"relationship--dc06f556-792f-5871-a047-230b9cdcb1f9","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--0018c874-d41e-53f3-8a5f-018309837885"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--bfa2bae9-2745-5ea7-a226-5dadeb646f84","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1052: EXFILTRATION OVER PHYSICAL MEDIUM","external_references":[{"source_name":"mitre-attack","external_id":"T1052: EXFILTRATION OVER PHYSICAL MEDIUM","url":"https://attack.mitre.org/techniques/T1052: EXFILTRATION OVER PHYSICAL MEDIUM"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--4c438d19-7e28-5c8e-b180-cff81f4c55a0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--bfa2bae9-2745-5ea7-a226-5dadeb646f84"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--b57b438d-2bd8-5920-899d-f1f637c164e4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1053: SCHEDULED TASK/JOB","external_references":[{"source_name":"mitre-attack","external_id":"T1053: SCHEDULED TASK/JOB","url":"https://attack.mitre.org/techniques/T1053: SCHEDULED TASK/JOB"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--f8512b83-485a-5323-be43-7049c5ba3e20","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--b57b438d-2bd8-5920-899d-f1f637c164e4"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--4778b433-8059-5770-a57e-a4d25252c9ae","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1055: PROCESS INJECTION","external_references":[{"source_name":"mitre-attack","external_id":"T1055: PROCESS INJECTION","url":"https://attack.mitre.org/techniques/T1055: PROCESS INJECTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--5bd238e0-db4f-5774-a252-c1ebd59b97f8","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--4778b433-8059-5770-a57e-a4d25252c9ae"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--e2b155ed-3031-5869-9a70-36668f12d797","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1055.001: DYNAMIC-LINK LIBRARY INJECTION","external_references":[{"source_name":"mitre-attack","external_id":"T1055.001: DYNAMIC-LINK LIBRARY INJECTION","url":"https://attack.mitre.org/techniques/T1055.001: DYNAMIC-LINK LIBRARY INJECTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--4fc91846-3e1f-501f-91d6-1d9ebd5ef92a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--e2b155ed-3031-5869-9a70-36668f12d797"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--34d894dd-00ca-58b6-a080-64eafa80188b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1056: INPUT CAPTURE","external_references":[{"source_name":"mitre-attack","external_id":"T1056: INPUT CAPTURE","url":"https://attack.mitre.org/techniques/T1056: INPUT CAPTURE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--8989bd15-a41b-5df0-9f0d-df55db61fcda","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--34d894dd-00ca-58b6-a080-64eafa80188b"},{"type":"relationship","spec_version":"2.1","id":"relationship--bfa95671-469f-5ef9-8661-e8d989962e59","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--ab4983d8-060c-5016-a682-64ed7b711d8f"},{"type":"relationship","spec_version":"2.1","id":"relationship--d98a9797-d396-54cb-8ed5-de73f887f742","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--d78f58be-e555-58ca-ae58-9b3f1c84e3ac"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--0ec681cb-5230-548d-84e8-eb024c7098fc","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1063: SECURITY SOFTWARE DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1063: SECURITY SOFTWARE DISCOVERY","url":"https://attack.mitre.org/techniques/T1063: SECURITY SOFTWARE DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--870d2dc8-6dd6-5cc8-b4ca-572e37e5ce30","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--0ec681cb-5230-548d-84e8-eb024c7098fc"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--0304e34b-0acb-5752-ac30-154066831be9","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1068: EXPLOITATION FOR PRIVILEGE ESCALATION","external_references":[{"source_name":"mitre-attack","external_id":"T1068: EXPLOITATION FOR PRIVILEGE ESCALATION","url":"https://attack.mitre.org/techniques/T1068: EXPLOITATION FOR PRIVILEGE ESCALATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--891a7a04-ffc9-5b66-a88e-025da459d397","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--0304e34b-0acb-5752-ac30-154066831be9"},{"type":"relationship","spec_version":"2.1","id":"relationship--bda2e22e-38f6-50fe-b577-eaea862926fd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--c6b9a8d6-0c23-5162-ba26-4c5935c6713d"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--b14af15f-1bd0-53cd-8d4d-943264637567","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1070: INDICATOR REMOVAL","external_references":[{"source_name":"mitre-attack","external_id":"T1070: INDICATOR REMOVAL","url":"https://attack.mitre.org/techniques/T1070: INDICATOR REMOVAL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--2a14fc10-85bb-5a5c-9592-c99c16ccc598","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--b14af15f-1bd0-53cd-8d4d-943264637567"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--3e3ccae6-7ca3-5682-9d01-d364e8be12d1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1070.001: CLEAR WINDOWS EVENT LOGS","external_references":[{"source_name":"mitre-attack","external_id":"T1070.001: CLEAR WINDOWS EVENT LOGS","url":"https://attack.mitre.org/techniques/T1070.001: CLEAR WINDOWS EVENT LOGS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--6935d9ad-32a6-5673-bad9-d9ea328c9628","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--3e3ccae6-7ca3-5682-9d01-d364e8be12d1"},{"type":"relationship","spec_version":"2.1","id":"relationship--3ee927f6-43a7-5ff5-a126-697160cc9f85","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--39642967-0c38-51e6-9d15-8c7f4d6a4007"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--67fc5ffb-8f7e-5afa-b98e-f3aab69449ad","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1071: APPLICATION LAYER PROTOCOL","external_references":[{"source_name":"mitre-attack","external_id":"T1071: APPLICATION LAYER PROTOCOL","url":"https://attack.mitre.org/techniques/T1071: APPLICATION LAYER PROTOCOL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--e59c8008-79f0-5ab8-b43f-325d533dc6e6","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--67fc5ffb-8f7e-5afa-b98e-f3aab69449ad"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--8a3b34b1-1aba-5632-a9b2-2cdd7d9bd3f9","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1074: DATA STAGED","external_references":[{"source_name":"mitre-attack","external_id":"T1074: DATA STAGED","url":"https://attack.mitre.org/techniques/T1074: DATA STAGED"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--f4a6fd94-c0ad-5e50-bac7-f31cc99c32c4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--8a3b34b1-1aba-5632-a9b2-2cdd7d9bd3f9"},{"type":"relationship","spec_version":"2.1","id":"relationship--047f1d86-b151-56f0-a318-01666ed27b04","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--bc556ac3-883a-559d-a321-aaaebf2e573e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--31af36a7-3964-5a70-9498-d8ab3d0c507c"},{"type":"relationship","spec_version":"2.1","id":"relationship--c6dd73be-e6f9-5a32-bfe6-0912548ececc","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--d6072347-6a27-513e-aa9a-e3ced566f6bb"},{"type":"relationship","spec_version":"2.1","id":"relationship--580f91c7-f1ff-5d02-8675-f9e231e79559","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--3eeee68c-4f87-5934-810a-24add8ada0b4"},{"type":"relationship","spec_version":"2.1","id":"relationship--59f3bff7-25b5-562e-ab46-c95a6afa7eef","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--7e803cee-6f36-5e91-bfb6-bc29922d433c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--fe32be21-5c41-5bee-a0a5-94cdc93bdb20","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1098: ACCOUNT MANIPULATION","external_references":[{"source_name":"mitre-attack","external_id":"T1098: ACCOUNT MANIPULATION","url":"https://attack.mitre.org/techniques/T1098: ACCOUNT MANIPULATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--2ed11ded-151a-5e4e-84c0-7ab52148c242","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--fe32be21-5c41-5bee-a0a5-94cdc93bdb20"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--78694cce-8ddd-5df8-8084-61c2a4886773","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1102: WEB SERVICE","external_references":[{"source_name":"mitre-attack","external_id":"T1102: WEB SERVICE","url":"https://attack.mitre.org/techniques/T1102: WEB SERVICE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--a42056d7-7f7d-57eb-98a3-358831188756","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--78694cce-8ddd-5df8-8084-61c2a4886773"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--86ea6e1e-4e94-5a99-8299-3cff4343ce8d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1106: NATIVE API","external_references":[{"source_name":"mitre-attack","external_id":"T1106: NATIVE API","url":"https://attack.mitre.org/techniques/T1106: NATIVE API"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--6224d67c-dfac-5676-8da9-14cc8711da44","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--86ea6e1e-4e94-5a99-8299-3cff4343ce8d"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--fe655efc-5db9-576e-972c-8915b320608c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1110: BRUTE FORCE","external_references":[{"source_name":"mitre-attack","external_id":"T1110: BRUTE FORCE","url":"https://attack.mitre.org/techniques/T1110: BRUTE FORCE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--d1cf9aa8-c96b-5b43-b067-011eacdf976e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--fe655efc-5db9-576e-972c-8915b320608c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--096706ab-81fb-55c9-aa09-1079d3708f8f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1114: EMAIL COLLECTION","external_references":[{"source_name":"mitre-attack","external_id":"T1114: EMAIL COLLECTION","url":"https://attack.mitre.org/techniques/T1114: EMAIL COLLECTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--d28f0b6d-556b-5944-9e9c-6b6ab329e63b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--096706ab-81fb-55c9-aa09-1079d3708f8f"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--075ca454-940b-5793-ad00-1e3ce01df6b4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1127: TRUSTED DEVELOPER UTILITIES PROXY EXECUTION","external_references":[{"source_name":"mitre-attack","external_id":"T1127: TRUSTED DEVELOPER UTILITIES PROXY EXECUTION","url":"https://attack.mitre.org/techniques/T1127: TRUSTED DEVELOPER UTILITIES PROXY EXECUTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--4b7271cb-7968-5abb-b847-6bc32ecf40b3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--075ca454-940b-5793-ad00-1e3ce01df6b4"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--a4a93375-4ec3-5eb9-b584-204b39413447","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1132: DATA ENCODING","external_references":[{"source_name":"mitre-attack","external_id":"T1132: DATA ENCODING","url":"https://attack.mitre.org/techniques/T1132: DATA ENCODING"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--b4766d37-297b-5f7c-bbf3-c511304b99bf","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--a4a93375-4ec3-5eb9-b584-204b39413447"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--dd76d731-9e62-5aaf-953f-fd1d4467b178","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1134: ACCESS TOKEN MANIPULATION","external_references":[{"source_name":"mitre-attack","external_id":"T1134: ACCESS TOKEN MANIPULATION","url":"https://attack.mitre.org/techniques/T1134: ACCESS TOKEN MANIPULATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--bccddcc6-9333-585d-a513-f6a88bfb6807","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--dd76d731-9e62-5aaf-953f-fd1d4467b178"},{"type":"relationship","spec_version":"2.1","id":"relationship--0fe9bf24-2670-54b8-910c-5c3c83b3652e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--10fdb2da-2faf-501d-bbf4-f3ba50e7b46c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--bb43bb74-b3ca-5278-a248-c8fbc35b5e02","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1137: OFFICE APPLICATION STARTUP","external_references":[{"source_name":"mitre-attack","external_id":"T1137: OFFICE APPLICATION STARTUP","url":"https://attack.mitre.org/techniques/T1137: OFFICE APPLICATION STARTUP"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--7adfbd82-e398-59a5-857e-ce9271ed6945","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--bb43bb74-b3ca-5278-a248-c8fbc35b5e02"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--c14cca1e-0c94-5138-8e3f-8567ff39a00c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1140: DEOBFUSCATE/DECODE FILES OR INFORMATION","external_references":[{"source_name":"mitre-attack","external_id":"T1140: DEOBFUSCATE/DECODE FILES OR INFORMATION","url":"https://attack.mitre.org/techniques/T1140: DEOBFUSCATE/DECODE FILES OR INFORMATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--96f39ffe-7467-54d6-93de-d874d5a3aa46","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--c14cca1e-0c94-5138-8e3f-8567ff39a00c"},{"type":"relationship","spec_version":"2.1","id":"relationship--7a41edba-fcd0-545f-9ba1-950c6e401707","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--c3b4dbe8-d5e6-58ad-afb4-97c918934a37","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1195: SUPPLY CHAIN COMPROMISE","external_references":[{"source_name":"mitre-attack","external_id":"T1195: SUPPLY CHAIN COMPROMISE","url":"https://attack.mitre.org/techniques/T1195: SUPPLY CHAIN COMPROMISE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--423af12d-e8cd-51cb-a3df-c4309bff9eec","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--c3b4dbe8-d5e6-58ad-afb4-97c918934a37"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--0125e659-5f8e-50b4-959f-e50d53c2404c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1202: INDIRECT COMMAND EXECUTION","external_references":[{"source_name":"mitre-attack","external_id":"T1202: INDIRECT COMMAND EXECUTION","url":"https://attack.mitre.org/techniques/T1202: INDIRECT COMMAND EXECUTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--484530ec-ff69-5eab-83c0-d360fc72fb99","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--0125e659-5f8e-50b4-959f-e50d53c2404c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--027eacb8-f001-556e-b037-d61967fe3820","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1204: USER EXECUTION","external_references":[{"source_name":"mitre-attack","external_id":"T1204: USER EXECUTION","url":"https://attack.mitre.org/techniques/T1204: USER EXECUTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--0416875d-1485-572b-960a-52c8fb5a4df1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--027eacb8-f001-556e-b037-d61967fe3820"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--c3805058-5a9a-5fc2-970c-83a249d0319f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1205: TRAFFIC SIGNALING","external_references":[{"source_name":"mitre-attack","external_id":"T1205: TRAFFIC SIGNALING","url":"https://attack.mitre.org/techniques/T1205: TRAFFIC SIGNALING"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--22499b2c-e507-5b90-9242-051cbb301a77","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--c3805058-5a9a-5fc2-970c-83a249d0319f"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--b0965e8f-532d-5157-bea7-d280854750c9","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1213: DATA FROM INFORMATION REPOSITORIES","external_references":[{"source_name":"mitre-attack","external_id":"T1213: DATA FROM INFORMATION REPOSITORIES","url":"https://attack.mitre.org/techniques/T1213: DATA FROM INFORMATION REPOSITORIES"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--1ecb6406-d96b-5dac-abef-900be9af9390","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--b0965e8f-532d-5157-bea7-d280854750c9"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--455e6cc3-23cb-56d2-a4f4-39a5d9fa5123","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1216: SYSTEM SCRIPT PROXY EXECUTION","external_references":[{"source_name":"mitre-attack","external_id":"T1216: SYSTEM SCRIPT PROXY EXECUTION","url":"https://attack.mitre.org/techniques/T1216: SYSTEM SCRIPT PROXY EXECUTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--a8a6e39c-ba48-57f5-80d5-a1be384f34e9","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--455e6cc3-23cb-56d2-a4f4-39a5d9fa5123"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--7e721531-88d6-5511-ace6-1d0221d7750e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1218: SYSTEM BINARY PROXY EXECUTION","external_references":[{"source_name":"mitre-attack","external_id":"T1218: SYSTEM BINARY PROXY EXECUTION","url":"https://attack.mitre.org/techniques/T1218: SYSTEM BINARY PROXY EXECUTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--a898471e-af0b-5a05-bfc4-72609cc15069","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--7e721531-88d6-5511-ace6-1d0221d7750e"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--08ce24e2-3213-5f35-a64d-57baf2378c73","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1222: FILE AND DIRECTORY PERMISSIONS MODIFICATION","external_references":[{"source_name":"mitre-attack","external_id":"T1222: FILE AND DIRECTORY PERMISSIONS MODIFICATION","url":"https://attack.mitre.org/techniques/T1222: FILE AND DIRECTORY PERMISSIONS MODIFICATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--9faaa3a3-5dd4-5e61-9099-3fbb711526d0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--08ce24e2-3213-5f35-a64d-57baf2378c73"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--6d51adab-289f-5038-87e9-7f0cf6c81f69","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1480: EXECUTION GUARDRAILS","external_references":[{"source_name":"mitre-attack","external_id":"T1480: EXECUTION GUARDRAILS","url":"https://attack.mitre.org/techniques/T1480: EXECUTION GUARDRAILS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--e1982dc0-83d6-5b6d-86a9-609ef165a36d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--6d51adab-289f-5038-87e9-7f0cf6c81f69"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--e27be498-bac6-5c47-820e-b166eacee170","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1484: DOMAIN OR TENANT POLICY MODIFICATION","external_references":[{"source_name":"mitre-attack","external_id":"T1484: DOMAIN OR TENANT POLICY MODIFICATION","url":"https://attack.mitre.org/techniques/T1484: DOMAIN OR TENANT POLICY MODIFICATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--e03099f2-85ff-5d13-8c1b-37e75a0975e4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--e27be498-bac6-5c47-820e-b166eacee170"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--be6b8a06-2195-5310-83d2-d0e2405a0a58","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1484.001: GROUP POLICY MODIFICATION","external_references":[{"source_name":"mitre-attack","external_id":"T1484.001: GROUP POLICY MODIFICATION","url":"https://attack.mitre.org/techniques/T1484.001: GROUP POLICY MODIFICATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--56fe36fe-fe42-5d43-8191-c8ef719318c6","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--be6b8a06-2195-5310-83d2-d0e2405a0a58"},{"type":"relationship","spec_version":"2.1","id":"relationship--673f6e4e-c025-5a38-aaaa-dd69351ac736","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--d577431f-3c94-5e2a-a971-0dacb225adbe","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--3fe4f3aa-b61a-5e49-ab01-3314d4db311f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1491: DEFACEMENT","external_references":[{"source_name":"mitre-attack","external_id":"T1491: DEFACEMENT","url":"https://attack.mitre.org/techniques/T1491: DEFACEMENT"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--87ed01cf-4274-5009-92ed-e8785169d8dc","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--3fe4f3aa-b61a-5e49-ab01-3314d4db311f"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--4dd3d1b6-1125-5d55-a4bc-4e8c44733286","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1497: VIRTUALIZATION/SANDBOX EVASION","external_references":[{"source_name":"mitre-attack","external_id":"T1497: VIRTUALIZATION/SANDBOX EVASION","url":"https://attack.mitre.org/techniques/T1497: VIRTUALIZATION/SANDBOX EVASION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--67be1f95-5dab-5b03-87c1-56da4da573e3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--4dd3d1b6-1125-5d55-a4bc-4e8c44733286"},{"type":"relationship","spec_version":"2.1","id":"relationship--73a255c5-2d3e-5176-86c6-1decf76e2268","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--3ed2bc06-37d1-5ca9-93bb-d8e89b771eec"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--7ab6d933-72bb-5a8e-8cde-4566ae4ad33e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1499: ENDPOINT DENIAL OF SERVICE","external_references":[{"source_name":"mitre-attack","external_id":"T1499: ENDPOINT DENIAL OF SERVICE","url":"https://attack.mitre.org/techniques/T1499: ENDPOINT DENIAL OF SERVICE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--60aa04a8-ae82-5286-bcd1-df3eb4350d27","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--7ab6d933-72bb-5a8e-8cde-4566ae4ad33e"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--a933dfe3-af40-5850-b1df-e0edc6e38e90","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1505: SERVER SOFTWARE COMPONENT","external_references":[{"source_name":"mitre-attack","external_id":"T1505: SERVER SOFTWARE COMPONENT","url":"https://attack.mitre.org/techniques/T1505: SERVER SOFTWARE COMPONENT"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--3978dc25-3f0a-59f4-860b-b7610710ae31","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--a933dfe3-af40-5850-b1df-e0edc6e38e90"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--cf8b618b-f05b-5808-8728-346ef9a153d7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1518: SOFTWARE DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1518: SOFTWARE DISCOVERY","url":"https://attack.mitre.org/techniques/T1518: SOFTWARE DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--c513e1c9-e12f-555e-b947-63f131d887d2","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--cf8b618b-f05b-5808-8728-346ef9a153d7"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--e34ce5a2-3ea8-528a-9370-abaab4f2e07e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1542: PRE-OS BOOT","external_references":[{"source_name":"mitre-attack","external_id":"T1542: PRE-OS BOOT","url":"https://attack.mitre.org/techniques/T1542: PRE-OS BOOT"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--e2d52cbb-8e43-538b-aa8e-09bd6e5c9cd1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--e34ce5a2-3ea8-528a-9370-abaab4f2e07e"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--d1a15bb8-38e3-5bbd-adcc-7cfbdf8bfeae","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1543: CREATE OR MODIFY SYSTEM PROCESS","external_references":[{"source_name":"mitre-attack","external_id":"T1543: CREATE OR MODIFY SYSTEM PROCESS","url":"https://attack.mitre.org/techniques/T1543: CREATE OR MODIFY SYSTEM PROCESS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--ed4dd678-69c5-537e-801f-3cb765148b08","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--d1a15bb8-38e3-5bbd-adcc-7cfbdf8bfeae"},{"type":"relationship","spec_version":"2.1","id":"relationship--a40f0e97-48f4-5cb5-957d-768f05f3db85","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--4dfa0133-19d7-558a-9806-291cdc07ec61"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--48e36551-f72e-52bd-b18b-ac3ab444c58f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1546: EVENT TRIGGERED EXECUTION","external_references":[{"source_name":"mitre-attack","external_id":"T1546: EVENT TRIGGERED EXECUTION","url":"https://attack.mitre.org/techniques/T1546: EVENT TRIGGERED EXECUTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--9f9de9fa-ffa5-559e-86d4-e70e8b848e54","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--48e36551-f72e-52bd-b18b-ac3ab444c58f"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--6e0a2375-3334-5dc0-9ff4-399ffbdffa57","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1547: BOOT OR LOGON AUTOSTART EXECUTION","external_references":[{"source_name":"mitre-attack","external_id":"T1547: BOOT OR LOGON AUTOSTART EXECUTION","url":"https://attack.mitre.org/techniques/T1547: BOOT OR LOGON AUTOSTART EXECUTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--98d0e47c-aefd-5bc0-a5d2-005e0d7cb3dd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--6e0a2375-3334-5dc0-9ff4-399ffbdffa57"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--2cbad7b1-08d1-5336-9fc5-2a6978834913","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1548: ABUSE ELEVATION CONTROL MECHANISM","external_references":[{"source_name":"mitre-attack","external_id":"T1548: ABUSE ELEVATION CONTROL MECHANISM","url":"https://attack.mitre.org/techniques/T1548: ABUSE ELEVATION CONTROL MECHANISM"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--df39ca02-c198-553d-8ac5-1d7969f7a0b3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--2cbad7b1-08d1-5336-9fc5-2a6978834913"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--16e57cdb-b774-5f06-9764-dfc02509b650","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1550: USE ALTERNATE AUTHENTICATION MATERIAL","external_references":[{"source_name":"mitre-attack","external_id":"T1550: USE ALTERNATE AUTHENTICATION MATERIAL","url":"https://attack.mitre.org/techniques/T1550: USE ALTERNATE AUTHENTICATION MATERIAL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--b1aede86-be03-56b5-a255-ac0868970a18","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--16e57cdb-b774-5f06-9764-dfc02509b650"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--5ee1d097-d6f4-5b3c-bcdc-79643fd0d4f7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1552: UNSECURED CREDENTIALS","external_references":[{"source_name":"mitre-attack","external_id":"T1552: UNSECURED CREDENTIALS","url":"https://attack.mitre.org/techniques/T1552: UNSECURED CREDENTIALS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--dcf6d77a-950f-5a54-b7f4-93d3f1c0fe70","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--5ee1d097-d6f4-5b3c-bcdc-79643fd0d4f7"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--3818eff6-f474-5b7d-acdd-eaba85b9d592","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1553: SUBVERT TRUST CONTROLS","external_references":[{"source_name":"mitre-attack","external_id":"T1553: SUBVERT TRUST CONTROLS","url":"https://attack.mitre.org/techniques/T1553: SUBVERT TRUST CONTROLS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--9141832b-7ec2-5745-afcc-be2f0bbd5f94","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--3818eff6-f474-5b7d-acdd-eaba85b9d592"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--1aa819cc-80d5-5984-9f32-a11ae1a2d5bb","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1555: CREDENTIALS FROM PASSWORD STORES","external_references":[{"source_name":"mitre-attack","external_id":"T1555: CREDENTIALS FROM PASSWORD STORES","url":"https://attack.mitre.org/techniques/T1555: CREDENTIALS FROM PASSWORD STORES"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--e72560ea-60eb-51dd-8648-6107d8297f96","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--1aa819cc-80d5-5984-9f32-a11ae1a2d5bb"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--7888e615-3ee0-541e-8a98-9eaf6f1fded9","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1556: MODIFY AUTHENTICATION PROCESS","external_references":[{"source_name":"mitre-attack","external_id":"T1556: MODIFY AUTHENTICATION PROCESS","url":"https://attack.mitre.org/techniques/T1556: MODIFY AUTHENTICATION PROCESS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--9c4df3b6-55ee-5e63-a1b0-325376fe1ae7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--7888e615-3ee0-541e-8a98-9eaf6f1fded9"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--210b9a29-8bb2-53fc-a70b-524524e1f259","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1557: ADVERSARY-IN-THE-MIDDLE","external_references":[{"source_name":"mitre-attack","external_id":"T1557: ADVERSARY-IN-THE-MIDDLE","url":"https://attack.mitre.org/techniques/T1557: ADVERSARY-IN-THE-MIDDLE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--0820b4df-d7b8-54b2-98f9-218c46e95699","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--210b9a29-8bb2-53fc-a70b-524524e1f259"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--9cb22f20-795d-5af7-944a-a2dcdc4ef6c3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1558: STEAL OR FORGE KERBEROS TICKETS","external_references":[{"source_name":"mitre-attack","external_id":"T1558: STEAL OR FORGE KERBEROS TICKETS","url":"https://attack.mitre.org/techniques/T1558: STEAL OR FORGE KERBEROS TICKETS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--01dc9ad2-acf8-589c-85eb-5be760a8c12e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--9cb22f20-795d-5af7-944a-a2dcdc4ef6c3"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--45f8e39a-7893-5d43-869d-fbb4bb7afaeb","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1559: INTER-PROCESS COMMUNICATION","external_references":[{"source_name":"mitre-attack","external_id":"T1559: INTER-PROCESS COMMUNICATION","url":"https://attack.mitre.org/techniques/T1559: INTER-PROCESS COMMUNICATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--d047114e-3921-5203-8b39-71a53b857171","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--45f8e39a-7893-5d43-869d-fbb4bb7afaeb"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--b485bf66-6030-534d-aeea-5a3608b47ab8","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1560: ARCHIVE COLLECTED DATA","external_references":[{"source_name":"mitre-attack","external_id":"T1560: ARCHIVE COLLECTED DATA","url":"https://attack.mitre.org/techniques/T1560: ARCHIVE COLLECTED DATA"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--6db3ee50-8ec4-576a-8e97-736f5acd3692","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--b485bf66-6030-534d-aeea-5a3608b47ab8"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--580bc8de-0ac8-5e2a-a567-dd9a6c209ba7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1561: DISK WIPE","external_references":[{"source_name":"mitre-attack","external_id":"T1561: DISK WIPE","url":"https://attack.mitre.org/techniques/T1561: DISK WIPE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--cbeba708-8b4f-56d8-a3ec-fc9aba3b2281","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--580bc8de-0ac8-5e2a-a567-dd9a6c209ba7"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--e751f9c2-5a26-59b5-9026-93f3388e1eb0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1562: IMPAIR DEFENSES","external_references":[{"source_name":"mitre-attack","external_id":"T1562: IMPAIR DEFENSES","url":"https://attack.mitre.org/techniques/T1562: IMPAIR DEFENSES"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--b6bb0f32-8e26-5705-bc4c-3f9781e16e2b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--e751f9c2-5a26-59b5-9026-93f3388e1eb0"},{"type":"relationship","spec_version":"2.1","id":"relationship--fb227347-f85b-57a4-b48b-0d811c567f59","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--c9cc51ed-479d-50de-ac46-cd01fca2fd48","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1563: REMOTE SERVICE SESSION HIJACKING","external_references":[{"source_name":"mitre-attack","external_id":"T1563: REMOTE SERVICE SESSION HIJACKING","url":"https://attack.mitre.org/techniques/T1563: REMOTE SERVICE SESSION HIJACKING"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--bd0076bd-ee7e-5581-86a5-abd5d268b6ee","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--c9cc51ed-479d-50de-ac46-cd01fca2fd48"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--58b4b351-ca39-5b79-a24f-3a70e8a0a2e3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1564: HIDE ARTIFACTS","external_references":[{"source_name":"mitre-attack","external_id":"T1564: HIDE ARTIFACTS","url":"https://attack.mitre.org/techniques/T1564: HIDE ARTIFACTS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--f2c05310-ed18-5615-8967-42f26193c59c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--58b4b351-ca39-5b79-a24f-3a70e8a0a2e3"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--768dadc6-cfd8-5e43-95df-9dc4a3d5159a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1565: DATA MANIPULATION","external_references":[{"source_name":"mitre-attack","external_id":"T1565: DATA MANIPULATION","url":"https://attack.mitre.org/techniques/T1565: DATA MANIPULATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--0d0062d7-03ce-5dae-864f-31c895562834","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--768dadc6-cfd8-5e43-95df-9dc4a3d5159a"},{"type":"relationship","spec_version":"2.1","id":"relationship--32a3134d-28d1-529b-8145-71898576f058","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--a4dc579d-d897-5219-bc30-fe3cd6d4e17d"},{"type":"relationship","spec_version":"2.1","id":"relationship--d11604f0-b886-5c01-bdec-23b1498fe6ef","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--c936ce1b-2bbf-59ed-ae9e-2897cc1129e5"},{"type":"relationship","spec_version":"2.1","id":"relationship--8bf8eb73-2af2-546d-a14d-ca098f679ab0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--82419d22-299b-57e8-8782-819a702f7468"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--ba27e8be-6542-5f9e-bc63-d8af9cb5c7ea","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1568: DYNAMIC RESOLUTION","external_references":[{"source_name":"mitre-attack","external_id":"T1568: DYNAMIC RESOLUTION","url":"https://attack.mitre.org/techniques/T1568: DYNAMIC RESOLUTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--01eceb1a-9b4f-57f6-8c84-0832411554cc","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--ba27e8be-6542-5f9e-bc63-d8af9cb5c7ea"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--dd3e06d4-c7fc-5ab7-b3d9-bfcd413a13c8","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1569: SYSTEM SERVICES","external_references":[{"source_name":"mitre-attack","external_id":"T1569: SYSTEM SERVICES","url":"https://attack.mitre.org/techniques/T1569: SYSTEM SERVICES"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--730922c8-8ace-5cf0-a742-4124aacb8788","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--dd3e06d4-c7fc-5ab7-b3d9-bfcd413a13c8"},{"type":"relationship","spec_version":"2.1","id":"relationship--eac6c2c4-c801-57b0-9c6b-f3c6771a2126","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--005b7141-741d-5927-bd5b-253aec9d3477"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--759f0b9e-21ac-5dcb-8ec6-cf4bc88f2c55","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1573: ENCRYPTED CHANNEL","external_references":[{"source_name":"mitre-attack","external_id":"T1573: ENCRYPTED CHANNEL","url":"https://attack.mitre.org/techniques/T1573: ENCRYPTED CHANNEL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--b3fb76f1-a97c-5eb9-bfbd-c5468e1f75c0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--759f0b9e-21ac-5dcb-8ec6-cf4bc88f2c55"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--7301479b-4c0b-52fc-a0d4-72c3effb573f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1574: HIJACK EXECUTION FLOW","external_references":[{"source_name":"mitre-attack","external_id":"T1574: HIJACK EXECUTION FLOW","url":"https://attack.mitre.org/techniques/T1574: HIJACK EXECUTION FLOW"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--b65f1954-e951-538b-bd0a-5579ee92d2e2","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--7301479b-4c0b-52fc-a0d4-72c3effb573f"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--d6e10875-0831-5923-a69f-6ae32ae1d6ef","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1578: MODIFY CLOUD COMPUTE INFRASTRUCTURE","external_references":[{"source_name":"mitre-attack","external_id":"T1578: MODIFY CLOUD COMPUTE INFRASTRUCTURE","url":"https://attack.mitre.org/techniques/T1578: MODIFY CLOUD COMPUTE INFRASTRUCTURE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--6ef16fbc-5c5f-5876-a2e9-a6b351375b6d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--d6e10875-0831-5923-a69f-6ae32ae1d6ef"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--d9910828-2382-5b82-9670-c99e5acec561","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1583: ACQUIRE INFRASTRUCTURE","external_references":[{"source_name":"mitre-attack","external_id":"T1583: ACQUIRE INFRASTRUCTURE","url":"https://attack.mitre.org/techniques/T1583: ACQUIRE INFRASTRUCTURE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--78601b8c-14a4-5a2d-804e-a4c0912b3f34","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--d9910828-2382-5b82-9670-c99e5acec561"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--b6e45937-43eb-591e-809d-f988ddb8bd2a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1584: COMPROMISE INFRASTRUCTURE","external_references":[{"source_name":"mitre-attack","external_id":"T1584: COMPROMISE INFRASTRUCTURE","url":"https://attack.mitre.org/techniques/T1584: COMPROMISE INFRASTRUCTURE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--9bb63875-4970-5976-b4ac-7f418f83fff8","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--b6e45937-43eb-591e-809d-f988ddb8bd2a"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--50a80372-d423-57a8-a8c4-6e6c5e026b4c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1585: ESTABLISH ACCOUNTS","external_references":[{"source_name":"mitre-attack","external_id":"T1585: ESTABLISH ACCOUNTS","url":"https://attack.mitre.org/techniques/T1585: ESTABLISH ACCOUNTS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--b904f663-e74b-5f24-b7aa-1d308c84cc3d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--50a80372-d423-57a8-a8c4-6e6c5e026b4c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--a000cb4e-852c-57a2-afa2-fd71054de939","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1586: COMPROMISE ACCOUNTS","external_references":[{"source_name":"mitre-attack","external_id":"T1586: COMPROMISE ACCOUNTS","url":"https://attack.mitre.org/techniques/T1586: COMPROMISE ACCOUNTS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--79a61d94-a5d3-5aa4-8d91-2d9d1e469cc5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--a000cb4e-852c-57a2-afa2-fd71054de939"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--0a08aeec-6645-5d83-b5a6-7acfebbb0ba5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1587: DEVELOP CAPABILITIES","external_references":[{"source_name":"mitre-attack","external_id":"T1587: DEVELOP CAPABILITIES","url":"https://attack.mitre.org/techniques/T1587: DEVELOP CAPABILITIES"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--1f333391-6555-529f-a754-730be26abc9a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--0a08aeec-6645-5d83-b5a6-7acfebbb0ba5"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--88f4f24f-b7f7-580f-8a10-6fa044d6f5e2","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1588: OBTAIN CAPABILITIES","external_references":[{"source_name":"mitre-attack","external_id":"T1588: OBTAIN CAPABILITIES","url":"https://attack.mitre.org/techniques/T1588: OBTAIN CAPABILITIES"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--6fddc071-84f1-5db0-8715-fa4be3bd9b6c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--88f4f24f-b7f7-580f-8a10-6fa044d6f5e2"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--285a5826-3a70-5f0c-86be-dc2d7de14f9d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1589: GATHER VICTIM IDENTITY INFORMATION","external_references":[{"source_name":"mitre-attack","external_id":"T1589: GATHER VICTIM IDENTITY INFORMATION","url":"https://attack.mitre.org/techniques/T1589: GATHER VICTIM IDENTITY INFORMATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--8468ba86-d8fe-595d-8f5c-330977a3de47","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--285a5826-3a70-5f0c-86be-dc2d7de14f9d"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--431ae0e0-1abf-538b-9568-0243a6e2e60e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1590: GATHER VICTIM NETWORK INFORMATION","external_references":[{"source_name":"mitre-attack","external_id":"T1590: GATHER VICTIM NETWORK INFORMATION","url":"https://attack.mitre.org/techniques/T1590: GATHER VICTIM NETWORK INFORMATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--9d477a13-d7b6-5727-a675-26a5e49aa8f7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--431ae0e0-1abf-538b-9568-0243a6e2e60e"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--a8e2c2f5-a927-5ae3-b542-62e3a8443fc6","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1591: GATHER VICTIM ORG INFORMATION","external_references":[{"source_name":"mitre-attack","external_id":"T1591: GATHER VICTIM ORG INFORMATION","url":"https://attack.mitre.org/techniques/T1591: GATHER VICTIM ORG INFORMATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--33923425-a883-5b95-8688-5ccd3bf0fb8d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--a8e2c2f5-a927-5ae3-b542-62e3a8443fc6"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--fac495ce-2ff8-59b8-80b6-e24f94f0923a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1592: GATHER VICTIM HOST INFORMATION","external_references":[{"source_name":"mitre-attack","external_id":"T1592: GATHER VICTIM HOST INFORMATION","url":"https://attack.mitre.org/techniques/T1592: GATHER VICTIM HOST INFORMATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--72494f8a-a66e-54f8-b00d-8e9835c1d9f9","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--fac495ce-2ff8-59b8-80b6-e24f94f0923a"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--da8ed6a0-0fbc-5601-a55b-1d73e47b1b2d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1593: SEARCH OPEN WEBSITES/DOMAINS","external_references":[{"source_name":"mitre-attack","external_id":"T1593: SEARCH OPEN WEBSITES/DOMAINS","url":"https://attack.mitre.org/techniques/T1593: SEARCH OPEN WEBSITES/DOMAINS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--2ac84d1d-c653-52c5-a25e-010a47211900","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--da8ed6a0-0fbc-5601-a55b-1d73e47b1b2d"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--0175c09d-8dab-53ac-ae00-33ca24641ed6","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1595: ACTIVE SCANNING","external_references":[{"source_name":"mitre-attack","external_id":"T1595: ACTIVE SCANNING","url":"https://attack.mitre.org/techniques/T1595: ACTIVE SCANNING"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--cb5ee88a-111f-5ebc-bec6-f07bdbf84cf7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--0175c09d-8dab-53ac-ae00-33ca24641ed6"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--a2fd4cd2-4d74-5ff3-9e42-005228c823d3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1596: SEARCH OPEN TECHNICAL DATABASES","external_references":[{"source_name":"mitre-attack","external_id":"T1596: SEARCH OPEN TECHNICAL DATABASES","url":"https://attack.mitre.org/techniques/T1596: SEARCH OPEN TECHNICAL DATABASES"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--3da185af-fbba-5611-aa35-70c3c4f2f115","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--a2fd4cd2-4d74-5ff3-9e42-005228c823d3"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--cd25a5ac-f623-5c5d-bf52-b64398af7017","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1597: SEARCH CLOSED SOURCES","external_references":[{"source_name":"mitre-attack","external_id":"T1597: SEARCH CLOSED SOURCES","url":"https://attack.mitre.org/techniques/T1597: SEARCH CLOSED SOURCES"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--6ba11fe0-88d7-5458-bcca-b5a9178f3065","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--cd25a5ac-f623-5c5d-bf52-b64398af7017"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--65360e11-67d1-589d-869b-d41cf2064bb1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1598: PHISHING FOR INFORMATION","external_references":[{"source_name":"mitre-attack","external_id":"T1598: PHISHING FOR INFORMATION","url":"https://attack.mitre.org/techniques/T1598: PHISHING FOR INFORMATION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--11209348-9b9a-593f-9bb6-baf9a85f304f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--65360e11-67d1-589d-869b-d41cf2064bb1"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--64b6d8da-5b6f-5134-8979-596176d57a0e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1599: NETWORK BOUNDARY BRIDGING","external_references":[{"source_name":"mitre-attack","external_id":"T1599: NETWORK BOUNDARY BRIDGING","url":"https://attack.mitre.org/techniques/T1599: NETWORK BOUNDARY BRIDGING"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--6596a866-bea1-55e9-921d-f5e3a4eab6be","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--64b6d8da-5b6f-5134-8979-596176d57a0e"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--6ea4d288-2d7e-54de-b401-049fd2baf123","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1600: WEAKEN ENCRYPTION","external_references":[{"source_name":"mitre-attack","external_id":"T1600: WEAKEN ENCRYPTION","url":"https://attack.mitre.org/techniques/T1600: WEAKEN ENCRYPTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--ef5d4222-be48-57fc-a327-b3dbd31e17ae","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--6ea4d288-2d7e-54de-b401-049fd2baf123"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--6b5ba833-a06f-54f4-a81c-0613e6401f62","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1601: MODIFY SYSTEM IMAGE","external_references":[{"source_name":"mitre-attack","external_id":"T1601: MODIFY SYSTEM IMAGE","url":"https://attack.mitre.org/techniques/T1601: MODIFY SYSTEM IMAGE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--0ef71263-9019-50d4-8ef5-8a061e1ec484","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--6b5ba833-a06f-54f4-a81c-0613e6401f62"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--a27444d9-0234-53ae-ab9c-a99125b91279","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1602: DATA FROM CONFIGURATION REPOSITORY","external_references":[{"source_name":"mitre-attack","external_id":"T1602: DATA FROM CONFIGURATION REPOSITORY","url":"https://attack.mitre.org/techniques/T1602: DATA FROM CONFIGURATION REPOSITORY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--1fd79406-cf28-54b7-a032-5b8f7984a0f3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--a27444d9-0234-53ae-ab9c-a99125b91279"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--712404bb-651d-5d40-8b27-d5e97661a3ca","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1606: FORGE WEB CREDENTIALS","external_references":[{"source_name":"mitre-attack","external_id":"T1606: FORGE WEB CREDENTIALS","url":"https://attack.mitre.org/techniques/T1606: FORGE WEB CREDENTIALS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--3b8191e0-f279-57e1-ac0f-39da1cc849d9","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--712404bb-651d-5d40-8b27-d5e97661a3ca"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--2c3c1db1-d6e7-57b5-8dca-a3d9ba643808","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1608: STAGE CAPABILITIES","external_references":[{"source_name":"mitre-attack","external_id":"T1608: STAGE CAPABILITIES","url":"https://attack.mitre.org/techniques/T1608: STAGE CAPABILITIES"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--8ef14371-7f01-574c-815e-c380b13eda0b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--2c3c1db1-d6e7-57b5-8dca-a3d9ba643808"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--af52e0a4-82c6-5b9c-832b-1a012c19bbb2","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1614: SYSTEM LOCATION DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1614: SYSTEM LOCATION DISCOVERY","url":"https://attack.mitre.org/techniques/T1614: SYSTEM LOCATION DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--388f7a25-4736-53ed-811e-e0f3c474c23c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--c9a02d16-9f87-58dd-9389-3b8042675ea7","target_ref":"attack-pattern--af52e0a4-82c6-5b9c-832b-1a012c19bbb2"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--4269ae1d-4bd1-5851-8214-c3dc1401e9b6","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Coinbasecartel","description":"Ransomware cartel / extortion group 'coinbasecartel' monitored by CTI.FYI.","aliases":["coinbasecartel"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/coinbasecartel.html","description":"CTI.FYI Dossier for coinbasecartel"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--866481e8-e36b-5f03-bfe6-d72ad7a6a9be","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Contfr","description":"Launched around September 2024, ContFR is a French-speaking RaaS that uses a Tor-hosted platform to provide ransomware embedded in PDF files (targeting both Windows and macOS). The group offers a tiered subscription model—“TEST,” “BASIC,” and “ELITE”—allowing affiliates varying degrees of customization, offline capability, and support based on the package purchased. As of the latest reporting, no victims are publicly listed, though data leak publications likely require a subscription to access. The operation suggests an organized, business‑like structure, distinct from opportunistic one‑off strains.","aliases":["ContFR"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/contfr.html","description":"CTI.FYI Dossier for ContFR"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--37a0430f-48f9-5d1e-969c-9be97b913c97","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Conti","description":"Emerging in May 2020 as the successor to Ryuk from the Russia-nexus Wizard Spider cybercrime syndicate, Conti was one of the most prolific and aggressive Ransomware-as-a-Service operations in history until its dissolution in mid-2022. The malware featured an advanced multithreaded C/C++ architecture utilizing Windows I/O Completion Ports (IOCP) for rapid concurrent encryption using AES-256 and RSA-4096 across Windows and Linux/ESXi hypervisors. Conti gained initial access through TrickBot and BazarLoader botnets, BazarCall social engineering, and public-facing vulnerabilities (such as Log4Shell and ProxyShell), executing ruthless double extortion against healthcare, government, and commercial sectors globally.","aliases":["conti","Wizard Spider","Gold Ulrick","Trickbot Group","Conti Ransomware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/conti.html","description":"CTI.FYI Dossier for conti"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--73761255-a486-5b9c-80d8-84049fd1bb9d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--37a0430f-48f9-5d1e-969c-9be97b913c97","target_ref":"attack-pattern--c936ce1b-2bbf-59ed-ae9e-2897cc1129e5"},{"type":"relationship","spec_version":"2.1","id":"relationship--6cc6e406-618b-5b3c-9923-5d3dbee2b89b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--37a0430f-48f9-5d1e-969c-9be97b913c97","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--43fcd35a-09c7-5595-87fe-6a6bd79c88ed","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--37a0430f-48f9-5d1e-969c-9be97b913c97","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--36ad1f82-ab4f-5b05-a374-d5a7218f5268","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--37a0430f-48f9-5d1e-969c-9be97b913c97","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--7ec28093-5ebf-518d-8728-1ba6d03709c5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--37a0430f-48f9-5d1e-969c-9be97b913c97","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"relationship","spec_version":"2.1","id":"relationship--6760bbbc-e549-52d4-92ab-e5bbb00afed9","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--37a0430f-48f9-5d1e-969c-9be97b913c97","target_ref":"attack-pattern--abf9da00-5965-549c-b277-81f9ff9940d1"},{"type":"relationship","spec_version":"2.1","id":"relationship--44ab242f-9f67-5df7-93a7-78053132aa70","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--37a0430f-48f9-5d1e-969c-9be97b913c97","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--56761939-92a0-5df5-91da-7a404f200391","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--37a0430f-48f9-5d1e-969c-9be97b913c97","target_ref":"attack-pattern--ccc64fc9-8795-5bef-9a32-389a5239333d"},{"type":"relationship","spec_version":"2.1","id":"relationship--a897e966-f37c-5ca7-b3cb-bcaa68ad1631","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--37a0430f-48f9-5d1e-969c-9be97b913c97","target_ref":"attack-pattern--2fa3d470-1027-52ef-910e-02e00b738c0b"},{"type":"relationship","spec_version":"2.1","id":"relationship--d2250d00-656d-5501-bb32-50cb5df6b03b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--37a0430f-48f9-5d1e-969c-9be97b913c97","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--27d7d788-e022-5f6e-ac5d-e330612c849a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--37a0430f-48f9-5d1e-969c-9be97b913c97","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--c3155fb1-55de-5d31-8dfc-7db1dc441ab9","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--37a0430f-48f9-5d1e-969c-9be97b913c97","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--0cca8f63-d9b0-550a-8efd-f075d86466f6","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Cooming","description":"Ransomware cartel / extortion group 'cooming' monitored by CTI.FYI.","aliases":["cooming"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/cooming.html","description":"CTI.FYI Dossier for cooming"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--736aff2a-fada-5a0d-a2e1-582046d7239f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Crazyhunter","description":"Ransomware cartel / extortion group 'crazyhunter' monitored by CTI.FYI.","aliases":["crazyhunter"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/crazyhunter.html","description":"CTI.FYI Dossier for crazyhunter"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--11a11dd6-e34c-58b4-af2b-1b4237a6ce95","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Crosslock","description":"Ransomware cartel / extortion group 'crosslock' monitored by CTI.FYI.","aliases":["crosslock"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/crosslock.html","description":"CTI.FYI Dossier for crosslock"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--0a344a34-892b-53a8-895f-d5be299e5a2e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Cry0","description":"Ransomware Identifies victim locations w/Google Maps API","aliases":["cry0","CryLocker","Cry","CSTO","Central Security Treatment Organization"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/cry0.html","description":"CTI.FYI Dossier for cry0"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--1dff63c7-8047-560f-8647-6c9fffe87e24","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Crylock","description":"Ransomware cartel / extortion group 'crylock' monitored by CTI.FYI.","aliases":["crylock"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/crylock.html","description":"CTI.FYI Dossier for crylock"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--6013de53-d516-5964-b848-1c2a41e7255d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Cryp70N1C0D3","description":"Ransomware cartel / extortion group 'cryp70n1c0d3' monitored by CTI.FYI.","aliases":["cryp70n1c0d3"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/cryp70n1c0d3.html","description":"CTI.FYI Dossier for cryp70n1c0d3"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--341517a3-4b31-561c-82ef-3cbf9152ede0","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Cryptbb","description":"Ransomware cartel / extortion group 'cryptbb' monitored by CTI.FYI.","aliases":["cryptbb"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/cryptbb.html","description":"CTI.FYI Dossier for cryptbb"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--5da1df83-9a3a-54a5-9298-4224d95d2849","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Cryptnet","description":"Ransomware cartel / extortion group 'cryptnet' monitored by CTI.FYI.","aliases":["cryptnet"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/cryptnet.html","description":"CTI.FYI Dossier for cryptnet"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--ccd6f0b5-74ce-5992-a508-c56e599de8ad","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Crypto24","description":"aka  Public Data Storage","aliases":["crypto24"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/crypto24.html","description":"CTI.FYI Dossier for crypto24"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--797303f4-25ea-5cf2-9cd2-6164f8080f75","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Cuba","description":"Ransomware cartel / extortion group 'cuba' monitored by CTI.FYI.","aliases":["cuba"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/cuba.html","description":"CTI.FYI Dossier for cuba"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--16cd46aa-8ca1-5126-a176-c0023df23392","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Cyclops","description":"Ransomware cartel / extortion group 'cyclops' monitored by CTI.FYI.","aliases":["cyclops"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/cyclops.html","description":"CTI.FYI Dossier for cyclops"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--831769c3-40dc-5955-9047-772d6cd8c257","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"D4Rk4Rmy","description":"Ransomware cartel / extortion group 'd4rk4rmy' monitored by CTI.FYI.","aliases":["d4rk4rmy"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/d4rk4rmy.html","description":"CTI.FYI Dossier for d4rk4rmy"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d4974ec1-d365-5b87-9e52-fbc611645b75","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Dagonlocker","description":"Ransomware cartel / extortion group 'dagonlocker' monitored by CTI.FYI.","aliases":["dagonlocker"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/dagonlocker.html","description":"CTI.FYI Dossier for dagonlocker"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--bea22d38-edcd-5400-90cb-4e7242884fd9","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Daixin","description":"Daixin Team is a ransomware and data extortion group active since at least June 2022, known for targeting the healthcare sector, including hospitals, clinics, and related service providers. The group employs a double-extortion model—exfiltrating sensitive data before encrypting systems—and has leaked protected health information (PHI) to pressure victims. Intrusions often involve exploiting VPN vulnerabilities (notably in Fortinet FortiOS) and using compromised credentials for initial access. The ransomware uses AES for file encryption with RSA to protect the keys, and ransom notes direct victims to a Tor-based portal. The U.S. CISA, FBI, and HHS have issued joint advisories warning of the group’s impact on healthcare delivery and patient safety","aliases":["daixin"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/daixin.html","description":"CTI.FYI Dossier for daixin"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--4de98e6c-1239-5b45-a4c0-2aa8c6d00943","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Dan0N","description":"Ransomware cartel / extortion group 'dAn0n' monitored by CTI.FYI.","aliases":["dAn0n"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/dan0n.html","description":"CTI.FYI Dossier for dAn0n"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--02a7f15b-b581-5c19-a86d-2c12c072f06b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Darkangels","description":"Ransomware cartel / extortion group 'darkangels' monitored by CTI.FYI.","aliases":["darkangels"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/darkangels.html","description":"CTI.FYI Dossier for darkangels"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--9816571c-39de-5e03-a0b8-3dee3b849e45","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Darkbit","description":"Ransomware cartel / extortion group 'darkbit' monitored by CTI.FYI.","aliases":["darkbit"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/darkbit.html","description":"CTI.FYI Dossier for darkbit"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--306824ea-4d25-5e0c-9e32-341b40cd9892","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Darkleakmarket","description":"Ransomware cartel / extortion group 'darkleakmarket' monitored by CTI.FYI.","aliases":["darkleakmarket"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/darkleakmarket.html","description":"CTI.FYI Dossier for darkleakmarket"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--fddb356a-5ca2-579a-ad48-2937940838cf","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Darkpower","description":"Ransomware cartel / extortion group 'darkpower' monitored by CTI.FYI.","aliases":["darkpower"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/darkpower.html","description":"CTI.FYI Dossier for darkpower"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--24f25493-ae78-5dfc-b848-68008db8d1b3","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Darkrace","description":"Ransomware cartel / extortion group 'darkrace' monitored by CTI.FYI.","aliases":["darkrace"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/darkrace.html","description":"CTI.FYI Dossier for darkrace"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--77667e6d-5ee6-5e89-a51c-35701fcc16a5","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Darkside","description":"Ransomware cartel / extortion group 'darkside' monitored by CTI.FYI.","aliases":["darkside"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/darkside.html","description":"CTI.FYI Dossier for darkside"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--44827b8e-b261-59d2-9a9e-2e6e7c94559d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Darkvault","description":"Ransomware cartel / extortion group 'darkvault' monitored by CTI.FYI.","aliases":["darkvault"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/darkvault.html","description":"CTI.FYI Dossier for darkvault"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--be2d2cce-72fe-5c93-aaf1-8e251281c393","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Datacarry","description":"Ransomware cartel / extortion group 'datacarry' monitored by CTI.FYI.","aliases":["datacarry"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/datacarry.html","description":"CTI.FYI Dossier for datacarry"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--fc8e4fa9-7f28-5484-8787-a0b0bc3501d6","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Datakeeper","description":"Ransomware","aliases":["datakeeper"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/datakeeper.html","description":"CTI.FYI Dossier for datakeeper"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3f31779f-f29a-5bda-aa76-4e30f26d781b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Dataleak","description":"Ransomware cartel / extortion group 'dataleak' monitored by CTI.FYI.","aliases":["dataleak"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/dataleak.html","description":"CTI.FYI Dossier for dataleak"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--92232b96-f8e4-5e18-b239-6e14ce2cc0a3","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Desolator","description":"Ransomware cartel / extortion group 'desolator' monitored by CTI.FYI.","aliases":["desolator"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/desolator.html","description":"CTI.FYI Dossier for desolator"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d93b1fff-9f1f-5cc0-9e82-3b235a098206","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Devman","description":"Ransomware cartel / extortion group 'devman' monitored by CTI.FYI.","aliases":["devman"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/devman.html","description":"CTI.FYI Dossier for devman"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--f7ceb9c6-40fe-5bfd-91ec-573b082e3eb1","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Diavol","description":"Ransomware cartel / extortion group 'diavol' monitored by CTI.FYI.","aliases":["diavol"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/diavol.html","description":"CTI.FYI Dossier for diavol"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b44af868-d196-5794-a16b-52cc0ee555be","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Direwolf","description":"Ransomware cartel / extortion group 'direwolf' monitored by CTI.FYI.","aliases":["direwolf"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/direwolf.html","description":"CTI.FYI Dossier for direwolf"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--934471c8-6a45-5c3a-8f8f-4a297f27528d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Dispossessor","description":"Emerging in August 2023 under the leadership of an operator known as 'Brain', Dispossessor (also operating as Radar) was an aggressive Ransomware-as-a-Service syndicate that targeted small-to-mid-sized enterprises before its infrastructure was seized by international law enforcement in August 2024. The syndicate deployed customized C/C++ encryptors derived from the leaked LockBit 3.0 builder alongside custom data exfiltration tools against Windows networks. Operating a predatory extortion model, Dispossessor not only encrypted and extorted its own victims but also scavenged and re-extorted companies whose data had been previously dumped by LockBit, Cl0p, and 8base.","aliases":["dispossessor","Radar","Radar Ransomware","Dispossessor Ransomware","Brain"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/dispossessor.html","description":"CTI.FYI Dossier for dispossessor"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--211869c2-be50-52a8-90bd-9545b91448f7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--934471c8-6a45-5c3a-8f8f-4a297f27528d","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--16dc8966-e455-5eb4-9f92-98bafa0e8c94","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--934471c8-6a45-5c3a-8f8f-4a297f27528d","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--d0e8c0e2-a171-5252-93f9-7b3e2da9df35","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--934471c8-6a45-5c3a-8f8f-4a297f27528d","target_ref":"attack-pattern--fe655efc-5db9-576e-972c-8915b320608c"},{"type":"relationship","spec_version":"2.1","id":"relationship--2262a80a-7df1-584f-b2d8-d7baba4eff05","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--934471c8-6a45-5c3a-8f8f-4a297f27528d","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--47f5f168-cff9-5405-af9f-9a6545c11593","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--934471c8-6a45-5c3a-8f8f-4a297f27528d","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"relationship","spec_version":"2.1","id":"relationship--75384859-687b-5f2c-9366-d7737dfb137b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--934471c8-6a45-5c3a-8f8f-4a297f27528d","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--9116fd6e-781f-5ac3-b4af-d86f40a37e50","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--934471c8-6a45-5c3a-8f8f-4a297f27528d","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--464cad91-c87d-5334-9908-f5053a21d3ba","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--934471c8-6a45-5c3a-8f8f-4a297f27528d","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--30ff08e6-8ad3-5723-a6e3-0262c9e2c8aa","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--934471c8-6a45-5c3a-8f8f-4a297f27528d","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--57e3e80e-0f39-5ef3-8a50-0ff02d5c9b4a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--934471c8-6a45-5c3a-8f8f-4a297f27528d","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--2c6be97f-6edd-553b-86ca-047d72ff5483","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Donex","description":"Ransomware cartel / extortion group 'donex' monitored by CTI.FYI.","aliases":["donex"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/donex.html","description":"CTI.FYI Dossier for donex"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3e034970-f30b-525d-a028-954b43fc4bd6","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Donutleaks","description":"Ransomware cartel / extortion group 'donutleaks' monitored by CTI.FYI.","aliases":["donutleaks"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/donutleaks.html","description":"CTI.FYI Dossier for donutleaks"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c1d521a5-398d-52a2-aa58-523af92a3a62","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Doppelpaymer","description":"Ransomware cartel / extortion group 'doppelpaymer' monitored by CTI.FYI.","aliases":["doppelpaymer"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/doppelpaymer.html","description":"CTI.FYI Dossier for doppelpaymer"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--6d35c979-6c3c-5b4a-8861-8ea4e2322054","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Dragonforce","description":"Research on the operators of the DragonForce ransomware was conducted, and it was identified that the group emerged around mid-November 2023. They employ the same method as many other ransomware groups, using double extortion in their attacks, i.e., data encryption and extortion for the publication of the attacks.\n\nInitially, according to research, it was identified that another hacktivist group, also named DragonForce and based in Malaysia, conducted several campaigns in 2021 and 2022 against various government organizations and agencies across the Middle East and Asia. Additionally, the hacktivist group announced in 2022 its intention to initiate ransomware attacks. However, due to the limitation and difficulty in obtaining substantial information, no direct link could be established.\n\nThe activities of the DragonForce ransomware group were identified in November 2023 through a clandestine forum, where they announced their victims via data leaks.\n\nSome samples related to the DragonForce ransomware group were obtained, and it was concluded that the group uses a binary (ransomware) based on LockBit Black. In other words, this threat group took advantage of the previously leaked builder from another ransomware group, LockBit, and incorporated these samples into their attacks to encrypt data.\n\nThe company Cyble published an analysis indicating that the ransomware used by DragonForce has a 99% similarity to the LockBit Black ransomware, suggesting the use of the leaked builder.\n\nIt is worth noting that the ransomware performs the entire operational routine, terminating processes, encrypting specific files, and subsequently creating a ransom note for the victim.","aliases":["dragonforce"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/dragonforce.html","description":"CTI.FYI Dossier for dragonforce"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--fb88eb9d-d476-5c7c-8dcd-ffb1a1424d29","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--6d35c979-6c3c-5b4a-8861-8ea4e2322054","target_ref":"attack-pattern--39642967-0c38-51e6-9d15-8c7f4d6a4007"},{"type":"relationship","spec_version":"2.1","id":"relationship--0e174265-957e-5c09-8690-201bc3a75a67","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--6d35c979-6c3c-5b4a-8861-8ea4e2322054","target_ref":"attack-pattern--d6072347-6a27-513e-aa9a-e3ced566f6bb"},{"type":"relationship","spec_version":"2.1","id":"relationship--3dc0f925-18eb-522e-bfcd-fc942f18acb5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--6d35c979-6c3c-5b4a-8861-8ea4e2322054","target_ref":"attack-pattern--6585ebda-91ae-5337-aa38-94a195d85fb7"},{"type":"relationship","spec_version":"2.1","id":"relationship--50a43905-d1a9-50e7-bfe0-df610c145bbd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--6d35c979-6c3c-5b4a-8861-8ea4e2322054","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--ff0fdcb3-be25-53d3-a285-eaecfd0c6bb9","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--6d35c979-6c3c-5b4a-8861-8ea4e2322054","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c899ef10-dca7-5039-a2ee-773cea690345","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Dragonransomware","description":"Ransomware cartel / extortion group 'dragonransomware' monitored by CTI.FYI.","aliases":["dragonransomware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/dragonransomware.html","description":"CTI.FYI Dossier for dragonransomware"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--5f4bf176-b068-5dfa-846f-943205871b76","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Dunghill","description":"Ransomware cartel / extortion group 'dunghill' monitored by CTI.FYI.","aliases":["dunghill"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/dunghill.html","description":"CTI.FYI Dossier for dunghill"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--70f3d1b5-e88a-5f8b-b6b2-af9fb1319e21","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ech0Raix","description":"Ransomware cartel / extortion group 'ech0raix' monitored by CTI.FYI.","aliases":["ech0raix"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ech0raix.html","description":"CTI.FYI Dossier for ech0raix"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--60013504-ee21-5922-b69d-32371bcc55ac","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Eldorado","description":"Ransomware cartel / extortion group 'ElDorado' monitored by CTI.FYI.","aliases":["ElDorado"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/eldorado.html","description":"CTI.FYI Dossier for ElDorado"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--6bce26cb-49bf-51aa-91fb-19e714f73dc4","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Embargo","description":"Ransomware cartel / extortion group 'embargo' monitored by CTI.FYI.","aliases":["embargo"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/embargo.html","description":"CTI.FYI Dossier for embargo"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--37d16d73-4bd3-55d0-85be-fd6fbe617e39","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Entropy","description":"Ransomware cartel / extortion group 'entropy' monitored by CTI.FYI.","aliases":["entropy"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/entropy.html","description":"CTI.FYI Dossier for entropy"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c00047ff-63a4-52e1-a47b-161b521484c2","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ep918","description":"Ransomware cartel / extortion group 'ep918' monitored by CTI.FYI.","aliases":["ep918"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ep918.html","description":"CTI.FYI Dossier for ep918"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b33216fd-f676-5ab6-b355-f2d783392cf8","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Everest","description":"Active since late 2020, Everest is a cyber-extortion group that operates both as a double-extortion ransomware actor and as an Initial Access Broker (IAB). The syndicate deploys .NET-based encryptors obfuscated with ConfuserEx (historically linked to EverBe 2.0 and BlackByte variants) alongside PowerShell and living-off-the-land utilities. Everest targets critical infrastructure, government agencies, aviation, healthcare, and telecommunications organizations across North America and Europe via phishing, exposed RDP, and unpatched public-facing vulnerabilities, often selling unauthorized corporate network footholds to other threat groups.","aliases":["everest","Everest Team","Everest Ransomware","Everest Ransom Team","EverBe 2.0"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/everest.html","description":"CTI.FYI Dossier for everest"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--a78919ee-c9f0-51b3-96b9-205a4ac48814","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b33216fd-f676-5ab6-b355-f2d783392cf8","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--88ad386b-6822-5d5f-bb1e-e46082b1a0d7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b33216fd-f676-5ab6-b355-f2d783392cf8","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--5824d608-dea2-52ce-83a8-fe8a122b56c0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b33216fd-f676-5ab6-b355-f2d783392cf8","target_ref":"attack-pattern--a4dc579d-d897-5219-bc30-fe3cd6d4e17d"},{"type":"relationship","spec_version":"2.1","id":"relationship--70f39466-bebe-51d4-a9db-400e45acb9b4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b33216fd-f676-5ab6-b355-f2d783392cf8","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--1144cc6b-8b30-597d-9d54-bbd000f773bd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b33216fd-f676-5ab6-b355-f2d783392cf8","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--94257b3c-81c7-58c6-96c8-aac0895870dc","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b33216fd-f676-5ab6-b355-f2d783392cf8","target_ref":"attack-pattern--2fa3d470-1027-52ef-910e-02e00b738c0b"},{"type":"relationship","spec_version":"2.1","id":"relationship--5ce14858-16cc-523b-ac5a-c13df469ed74","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b33216fd-f676-5ab6-b355-f2d783392cf8","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--c197cc4f-7b5c-5cc2-b722-9bc263ea693d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b33216fd-f676-5ab6-b355-f2d783392cf8","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--f0eccbf4-3509-5271-acec-e6e109f94b2e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b33216fd-f676-5ab6-b355-f2d783392cf8","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--11195b87-996f-53d1-a928-d366ebf3e2b4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b33216fd-f676-5ab6-b355-f2d783392cf8","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"relationship","spec_version":"2.1","id":"relationship--14a6b914-33a4-551c-8dfb-134458b51547","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b33216fd-f676-5ab6-b355-f2d783392cf8","target_ref":"attack-pattern--31af36a7-3964-5a70-9498-d8ab3d0c507c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--91555584-5eac-50f7-abff-12dac97ab4ac","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Exitium","description":"Ransomware cartel / extortion group 'exitium' monitored by CTI.FYI.","aliases":["exitium"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/exitium.html","description":"CTI.FYI Dossier for exitium"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--74302da7-a322-526d-a236-73c05fa3e9be","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Exorcist","description":"Ransomware cartel / extortion group 'exorcist' monitored by CTI.FYI.","aliases":["exorcist"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/exorcist.html","description":"CTI.FYI Dossier for exorcist"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--57beecc9-150a-59fe-800f-daac1741e618","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Fletchen","description":"Ransomware cartel / extortion group 'fletchen' monitored by CTI.FYI.","aliases":["fletchen"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/fletchen.html","description":"CTI.FYI Dossier for fletchen"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--06edb75d-850e-549f-92eb-3a9c5bae5b6c","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Flocker","description":"Ransomware cartel / extortion group 'flocker' monitored by CTI.FYI.","aliases":["flocker"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/flocker.html","description":"CTI.FYI Dossier for flocker"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--03a7d8e2-038e-5495-bbff-2824af806373","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"FOG","description":"Ransomware cartel / extortion group 'fog' monitored by CTI.FYI.","aliases":["fog"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/fog.html","description":"CTI.FYI Dossier for fog"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--891a14b7-d5e6-5159-b04a-9bc7e5e56f97","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Frag","description":"Ransomware cartel / extortion group 'frag' monitored by CTI.FYI.","aliases":["frag"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/frag.html","description":"CTI.FYI Dossier for frag"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--a131adb0-7d7d-5138-840e-d58683128b1f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Freecivilian","description":"Ransomware cartel / extortion group 'freecivilian' monitored by CTI.FYI.","aliases":["freecivilian"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/freecivilian.html","description":"CTI.FYI Dossier for freecivilian"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--5db8955d-4f51-5aa8-998a-70987ba91d8e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Fsteam","description":"Ransomware cartel / extortion group 'fsteam' monitored by CTI.FYI.","aliases":["fsteam"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/fsteam.html","description":"CTI.FYI Dossier for fsteam"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--834a9e49-a1cf-5412-912a-f41517a126da","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Funksec","description":"Ransomware cartel / extortion group 'funksec' monitored by CTI.FYI.","aliases":["funksec"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/funksec.html","description":"CTI.FYI Dossier for funksec"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--8ab0d41c-4519-51dd-b811-13ca65af7a0d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Gdlockersec","description":"Ransomware cartel / extortion group 'GDLockerSec' monitored by CTI.FYI.","aliases":["GDLockerSec"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/gdlockersec.html","description":"CTI.FYI Dossier for GDLockerSec"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--89da45ec-b6a4-59de-855a-fda31451cf60","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Genesis","description":"Financial interests only.\r<br/>    We do not provide or work with affiliate programs, no collaborations either.\r<br/>    The requested payment must be made within a specified time frame, otherwise the price may be increased, we will begin to publish the data we have about your company and notify the company's customers and suppliers.\r<br/>    Charitable, non-profit, and medical institutions are only hacked if they have reputation gaps known from open sources or discovered in company data. However, this is only data extraction; live support systems are not affected.\r<br/>    Data is always destroyed after payment; we do not attack the same company twice.\r<br/>    Interesting fact: once, the total amount of claims against a breached company exceeded its entire capitalization. We know how to create trouble, though it is in our mutual interest to avoid it.\r<br/>    To make the data leak more valuable, the most important information is published in a separate folder for each company called “parsed” and is also published on darkweb forums.","aliases":["genesis"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/genesis.html","description":"CTI.FYI Dossier for genesis"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--5b39c531-9201-5686-92cc-8011ab7c7c01","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Global","description":"Not a RaaS yet.","aliases":["global"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/global.html","description":"CTI.FYI Dossier for global"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--954c7433-50cd-53af-8959-422ae60de49c","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Grief","description":"Ransomware cartel / extortion group 'grief' monitored by CTI.FYI.","aliases":["grief"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/grief.html","description":"CTI.FYI Dossier for grief"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--1c8348bc-c07f-562b-8182-694ae916bf7e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Groove","description":"Ransomware cartel / extortion group 'groove' monitored by CTI.FYI.","aliases":["groove"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/groove.html","description":"CTI.FYI Dossier for groove"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--39f5a625-c778-56fc-810a-ba8faf547501","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Gunra","description":"Ransomware cartel / extortion group 'gunra' monitored by CTI.FYI.","aliases":["gunra"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/gunra.html","description":"CTI.FYI Dossier for gunra"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3958f7d1-ec70-520f-98cb-d4112dcaff8a","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Hades","description":"Ransomware cartel / extortion group 'hades' monitored by CTI.FYI.","aliases":["hades"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/hades.html","description":"CTI.FYI Dossier for hades"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--cfa67505-00eb-5e96-9075-b01732341671","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Handala","description":"Emerging in late 2023 as an Iranian state-sponsored cyber operation tied to the Ministry of Intelligence and Security (MOIS), Handala operates under a pro-Palestinian hacktivist front (tracked by researchers as Void Manticore). The group specializes in politically motivated hack-and-leak, pseudo-ransomware, and destructive cyber sabotage targeting critical infrastructure, medical technology, and defense sectors in Israel and Western countries. Initial compromise is executed via spearphishing and credential theft, followed by living-off-the-cloud techniques—such as weaponizing Microsoft Intune to trigger mass remote device wipes—alongside custom .NET and AutoIT wiper payloads.","aliases":["handala","Handala Hack","Handala Hack Team","Void Manticore","BANISHED KITTEN","Storm-0842"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/handala.html","description":"CTI.FYI Dossier for handala"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--150ba4c3-0969-5758-aa66-4a1bb5cfef3a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--cfa67505-00eb-5e96-9075-b01732341671","target_ref":"attack-pattern--68b26d47-453b-58f8-b1a1-bb41b1969bed"},{"type":"relationship","spec_version":"2.1","id":"relationship--cf0f8533-2557-5a90-ac5a-c5c7f9eafc66","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--cfa67505-00eb-5e96-9075-b01732341671","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--8c9066a7-12be-56d6-b525-e31af742419e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--cfa67505-00eb-5e96-9075-b01732341671","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--e3c04982-72c2-5f9e-99c4-9ae62b96f451","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--cfa67505-00eb-5e96-9075-b01732341671","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--6bcbeb7d-049d-5bd4-a487-fe11f7fff435","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--cfa67505-00eb-5e96-9075-b01732341671","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"relationship","spec_version":"2.1","id":"relationship--943114cd-bd70-54e5-8d55-8b51d5706255","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--cfa67505-00eb-5e96-9075-b01732341671","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--36231ea5-483d-5a36-9c7f-bab9ef0dae70","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1485: DATA DESTRUCTION","external_references":[{"source_name":"mitre-attack","external_id":"T1485: DATA DESTRUCTION","url":"https://attack.mitre.org/techniques/T1485: DATA DESTRUCTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--64fd9171-c92f-5230-8b0a-d68c68ce8f7c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--cfa67505-00eb-5e96-9075-b01732341671","target_ref":"attack-pattern--36231ea5-483d-5a36-9c7f-bab9ef0dae70"},{"type":"relationship","spec_version":"2.1","id":"relationship--9a321087-600d-518a-ac8b-a66af6ab511e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--cfa67505-00eb-5e96-9075-b01732341671","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--feb83dad-0c0d-53bd-909e-f4f4659b68b0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--cfa67505-00eb-5e96-9075-b01732341671","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--377c9dfd-3982-56e7-9a95-48a7584fa14c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--cfa67505-00eb-5e96-9075-b01732341671","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"relationship","spec_version":"2.1","id":"relationship--912042b0-5f8c-531e-a61e-feb4a6adc3ba","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--cfa67505-00eb-5e96-9075-b01732341671","target_ref":"attack-pattern--31af36a7-3964-5a70-9498-d8ab3d0c507c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--2a9c5e4d-02eb-5f41-bdf7-bc79c08cc399","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Haron","description":"Ransomware cartel / extortion group 'haron' monitored by CTI.FYI.","aliases":["haron"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/haron.html","description":"CTI.FYI Dossier for haron"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b6129fe3-c317-5747-b6b6-df89fca10054","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Hellcat","description":"Ransomware cartel / extortion group 'hellcat' monitored by CTI.FYI.","aliases":["hellcat"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/hellcat.html","description":"CTI.FYI Dossier for hellcat"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--9d0c80e5-8375-5553-a438-319f50e77a56","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Helldown","description":"Ransomware cartel / extortion group 'helldown' monitored by CTI.FYI.","aliases":["helldown"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/helldown.html","description":"CTI.FYI Dossier for helldown"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e00a730c-c6f2-5f44-9520-e5a35e043496","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Hellogookie","description":"Ransomware cartel / extortion group 'hellogookie' monitored by CTI.FYI.","aliases":["hellogookie"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/hellogookie.html","description":"CTI.FYI Dossier for hellogookie"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b07ded8c-d237-5371-aa9f-a9516496622d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Hellokitty","description":"Ransomware cartel / extortion group 'hellokitty' monitored by CTI.FYI.","aliases":["hellokitty"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/hellokitty.html","description":"CTI.FYI Dossier for hellokitty"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d6ffea9e-0460-565f-9dd9-38c6ea822dec","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Hive","description":"Ransomware cartel / extortion group 'hive' monitored by CTI.FYI.","aliases":["hive"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/hive.html","description":"CTI.FYI Dossier for hive"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b28bb3e6-9475-51e6-a9fa-36b5a72ab684","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Holyghost","description":"Ransomware cartel / extortion group 'holyghost' monitored by CTI.FYI.","aliases":["holyghost"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/holyghost.html","description":"CTI.FYI Dossier for holyghost"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--346d932d-70d8-5dd0-b446-c1a4224ffce0","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Hotarus","description":"Ransomware cartel / extortion group 'hotarus' monitored by CTI.FYI.","aliases":["hotarus"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/hotarus.html","description":"CTI.FYI Dossier for hotarus"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--2184447f-9438-5b1f-8ff4-79be9125b098","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Hunters","description":"Emerging in October 2023 following law enforcement disruption of Hive, Hunters International operated as a high-velocity Ransomware-as-a-Service (RaaS) syndicate before shutting down in July 2025. The group engineered a sophisticated, cross-platform encryptor rewritten in Rust that targeted Windows, Linux, and VMware ESXi environments with partial AES/RSA encryption and .LOCKED extensions. Hunters International primarily gained initial access via compromised corporate credentials, exposed RDP endpoints, and vulnerable remote access appliances, executing aggressive double extortion before pivoting toward pure data extortion prior to its exit.","aliases":["hunters","Hunters International","Hive","Hunters International Ransomware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/hunters.html","description":"CTI.FYI Dossier for hunters"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--730667c4-9ff5-505b-9efa-6f09e0927bb5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2184447f-9438-5b1f-8ff4-79be9125b098","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--0f555f07-ab14-56a4-a383-08ff16eb1f6d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2184447f-9438-5b1f-8ff4-79be9125b098","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--4a02b279-7e15-53d3-829c-52a816c19a42","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2184447f-9438-5b1f-8ff4-79be9125b098","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--f49301b8-33e8-5d3f-a3f1-a61f56cb9a9e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2184447f-9438-5b1f-8ff4-79be9125b098","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--9f6cfaac-1404-52fc-83e5-4edeeeb3c964","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2184447f-9438-5b1f-8ff4-79be9125b098","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"relationship","spec_version":"2.1","id":"relationship--4ba0c6f9-59e5-5c86-8b4e-078e61a4c817","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2184447f-9438-5b1f-8ff4-79be9125b098","target_ref":"attack-pattern--d6072347-6a27-513e-aa9a-e3ced566f6bb"},{"type":"relationship","spec_version":"2.1","id":"relationship--4af2ebbd-b4b4-5ed2-a91d-5850c21521c8","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2184447f-9438-5b1f-8ff4-79be9125b098","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--6b961676-3a99-55b4-81aa-178592210273","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2184447f-9438-5b1f-8ff4-79be9125b098","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--284f00e3-8bb4-5e69-a0f5-55863e26bacc","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2184447f-9438-5b1f-8ff4-79be9125b098","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--685c437f-eb30-5dea-ad95-78b9372b63cf","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--2184447f-9438-5b1f-8ff4-79be9125b098","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--78c7256e-7655-5ecd-94cd-be2cb7918adf","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Icefire","description":"Ransomware cartel / extortion group 'icefire' monitored by CTI.FYI.","aliases":["icefire"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/icefire.html","description":"CTI.FYI Dossier for icefire"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e7bcc066-4cdb-542a-83bb-eaafa5503a30","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Imncrew","description":"Ransomware cartel / extortion group 'IMNCrew' monitored by CTI.FYI.","aliases":["IMNCrew"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/imncrew.html","description":"CTI.FYI Dossier for IMNCrew"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Incransom","description":"First observed in July 2023, INC Ransom operates as an exclusive extortion operation deploying custom C/C++ binaries targeting both Windows servers and Linux/VMware ESXi virtualization hosts. The group targets mid-to-large enterprises across healthcare, education, critical manufacturing, and public sector organizations throughout North America and Europe. Initial intrusion is characterized by the exploitation of edge network devices (specifically Citrix Bleed CVE-2023-4966) and spearphishing, followed by double extortion where exfiltrated corporate files are weaponized on a dedicated leak site.","aliases":["incransom","INC Ransom"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/incransom.html","description":"CTI.FYI Dossier for incransom"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--03ff8ebe-4ca3-5fb5-a473-4bf7cf9f5fff","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--c26b2b78-a2a3-51e7-a1e1-486c7a4c1ab3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--d880751d-ba42-511f-8c03-da8dd5c9c0d2","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"attack-pattern--d5b15a6d-b955-5900-9821-562e75b89c99"},{"type":"relationship","spec_version":"2.1","id":"relationship--e126b4cb-acaf-5fd7-b9c3-ccb76b4132e6","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--17fa1743-6169-522d-9cdd-bec1ba6cd540","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--3e14b60a-2899-560d-8ed8-6f14fcf1f983","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"attack-pattern--ccc64fc9-8795-5bef-9a32-389a5239333d"},{"type":"relationship","spec_version":"2.1","id":"relationship--4d8510d3-a913-53ce-8793-b6a39362ed6b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--1bed6839-cc6b-52ad-88c3-d78b938f31ad","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--85e59c7a-12bf-5431-8bd7-0b586994fc50","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--e106f666-41cd-5458-8470-ab01d021d370","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--642d27bd-0f93-5bec-894d-adc252209659","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Insane","description":"Ransomware cartel / extortion group 'insane' monitored by CTI.FYI.","aliases":["insane"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/insane.html","description":"CTI.FYI Dossier for insane"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--58ae04ee-1548-51b0-92fb-a0e26342796e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Insomnia","description":"Ransomware cartel / extortion group 'insomnia' monitored by CTI.FYI.","aliases":["insomnia"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/insomnia.html","description":"CTI.FYI Dossier for insomnia"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--6adf22bd-d344-5610-8727-61d8b6488ac9","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Interlock","description":"Ransomware cartel / extortion group 'interlock' monitored by CTI.FYI.","aliases":["interlock"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/interlock.html","description":"CTI.FYI Dossier for interlock"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--2cb7a5c6-41a4-5f94-b761-a9692dd50238","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"J","description":"Ransomware cartel / extortion group 'J' monitored by CTI.FYI.","aliases":["J"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/j.html","description":"CTI.FYI Dossier for J"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--00795ca5-982e-5b8f-980f-534064e71325","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Kairos","description":"Ransomware cartel / extortion group 'kairos' monitored by CTI.FYI.","aliases":["kairos"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/kairos.html","description":"CTI.FYI Dossier for kairos"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3098d8fe-8ec6-5bad-a4c3-84f919102209","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Karakurt","description":"Ransomware","aliases":["karakurt"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/karakurt.html","description":"CTI.FYI Dossier for karakurt"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--7e3fc7d1-7e55-5116-b4db-66edc0b65646","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Karma","description":"Ransomware.","aliases":["karma"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/karma.html","description":"CTI.FYI Dossier for karma"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--dcddb387-56d5-5bfd-87af-ea98232e9d34","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Kawa4096","description":"Ransomware cartel / extortion group 'kawa4096' monitored by CTI.FYI.","aliases":["kawa4096"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/kawa4096.html","description":"CTI.FYI Dossier for kawa4096"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d6720056-f212-5b39-bee2-ee9ed5eced25","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Kazu","description":"Ransomware cartel / extortion group 'kazu' monitored by CTI.FYI.","aliases":["kazu"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/kazu.html","description":"CTI.FYI Dossier for kazu"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--969baba1-daf6-51a7-8d4a-3278790fd20d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Kelvinsecurity","description":"Ransomware cartel / extortion group 'kelvinsecurity' monitored by CTI.FYI.","aliases":["kelvinsecurity"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/kelvinsecurity.html","description":"CTI.FYI Dossier for kelvinsecurity"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--df9bb3fe-3395-52b2-b337-1f816e83e2fe","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Killsec","description":"Emerging in late 2023 initially as a hacktivist outfit before transforming in 2024 into a financially driven Ransomware-as-a-Service (RaaS) syndicate, KillSec targeted healthcare, government, and financial entities globally. The group developed C++ encryptors designed for both Windows and VMware ESXi environments, engaging in double extortion by demanding cryptocurrency ransoms and leaking sensitive stolen files on a dark web blog. In September 2026, international law enforcement dismantled the entire operation under 'Operation KillSwitch,' arresting the group's key operators and seizing its central server infrastructure.","aliases":["killsec","Kill Security","k1llsec","KillSec Ransomware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/killsec.html","description":"CTI.FYI Dossier for killsec"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--b8fe52ad-0dd9-5f3d-b127-d5cd0303495a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--df9bb3fe-3395-52b2-b337-1f816e83e2fe","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--e5ad3eeb-47ed-5480-a76d-ecd560cf845f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--df9bb3fe-3395-52b2-b337-1f816e83e2fe","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--d277a30e-f833-5641-b2aa-a46b0d1ded47","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--df9bb3fe-3395-52b2-b337-1f816e83e2fe","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--3e91c92a-bd46-5cfc-a4b2-e5334ce5293b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--df9bb3fe-3395-52b2-b337-1f816e83e2fe","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"relationship","spec_version":"2.1","id":"relationship--1e6f8fae-b92c-5323-b622-e3f39ee47999","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--df9bb3fe-3395-52b2-b337-1f816e83e2fe","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--56abb652-606a-5201-a298-8a4ba95df06e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--df9bb3fe-3395-52b2-b337-1f816e83e2fe","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--aebfa8b8-4c2a-5934-b5d2-4aa6ac046b2d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--df9bb3fe-3395-52b2-b337-1f816e83e2fe","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--4cdc40ce-9483-5ce8-9735-45c5b5b5d33f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--df9bb3fe-3395-52b2-b337-1f816e83e2fe","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--8d2d5d32-327e-51bc-b821-f1efbaca59d1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--df9bb3fe-3395-52b2-b337-1f816e83e2fe","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"relationship","spec_version":"2.1","id":"relationship--4489061b-ccc8-52cb-9348-11fd16015e0f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--df9bb3fe-3395-52b2-b337-1f816e83e2fe","target_ref":"attack-pattern--31af36a7-3964-5a70-9498-d8ab3d0c507c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c13efa4c-02d8-5371-a590-ccedfb9935ac","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Kittykatkrew","description":"Ransomware cartel / extortion group 'kittykatkrew' monitored by CTI.FYI.","aliases":["kittykatkrew"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/kittykatkrew.html","description":"CTI.FYI Dossier for kittykatkrew"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--ce779418-cf93-5d30-86a2-e68fd442b868","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Knight","description":"Ransomware cartel / extortion group 'knight' monitored by CTI.FYI.","aliases":["knight"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/knight.html","description":"CTI.FYI Dossier for knight"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--9e425bff-02dd-56d2-a6e9-408f4c15113d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Kraken","description":"Ransomware cartel / extortion group 'kraken' monitored by CTI.FYI.","aliases":["kraken"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/kraken.html","description":"CTI.FYI Dossier for kraken"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--ac232da7-443d-5e0c-833f-4219bc2476a6","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Kryptos","description":"Ransomware cartel / extortion group 'kryptos' monitored by CTI.FYI.","aliases":["kryptos"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/kryptos.html","description":"CTI.FYI Dossier for kryptos"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--86cda0ad-8ba1-5f3e-b312-eaae2f2b9b2b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Kyber","description":"Ransomware cartel / extortion group 'kyber' monitored by CTI.FYI.","aliases":["kyber"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/kyber.html","description":"CTI.FYI Dossier for kyber"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--a4aa789e-860e-5cff-b7b1-97f2d868f998","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"La_Piovra","description":"Ransomware cartel / extortion group 'la_piovra' monitored by CTI.FYI.","aliases":["la_piovra"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/la_piovra.html","description":"CTI.FYI Dossier for la_piovra"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c4e7862c-acd5-55e1-b25c-6bcb9e8df905","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Lapsus$","description":"Lapsus$ is a cyber extortion group first observed in late 2021, known for high-profile breaches and data theft campaigns against major global companies rather than traditional ransomware encryption. The group primarily focuses on data exfiltration and public leak threats without encrypting victim systems. Lapsus$ uses a combination of social engineering, SIM swapping, MFA fatigue attacks, and purchasing access from insiders or access brokers to infiltrate corporate networks. Their victim list includes Microsoft, Okta, NVIDIA, Samsung, Uber, and telecom operators, with operations targeting multiple regions worldwide. Once inside, Lapsus$ actors exfiltrate source code, proprietary data, and customer information, often leaking samples to pressure victims into negotiation. The group is known for a brash and public-facing style, communicating directly with followers on Telegram channels and occasionally mocking victims. Several members, including minors, have been arrested in the UK, but the group’s activities have persisted in some form.","aliases":["lapsus$"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/lapsus$.html","description":"CTI.FYI Dossier for lapsus$"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--58027424-d5d0-58c9-91d6-3057295d311b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Leaktheanalyst","description":"Ransomware cartel / extortion group 'leaktheanalyst' monitored by CTI.FYI.","aliases":["leaktheanalyst"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/leaktheanalyst.html","description":"CTI.FYI Dossier for leaktheanalyst"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--9ce717ea-b9c9-58c7-9b44-433ae2cdcde4","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Lilith","description":"Ransomware cartel / extortion group 'lilith' monitored by CTI.FYI.","aliases":["lilith"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/lilith.html","description":"CTI.FYI Dossier for lilith"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c3aedc32-4a1f-5391-b16a-dbe0ecc05595","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Linkc","description":"Ransomware cartel / extortion group 'linkc' monitored by CTI.FYI.","aliases":["linkc"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/linkc.html","description":"CTI.FYI Dossier for linkc"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--9796306f-1b24-547a-8447-f46c53244e1d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Lockbit","description":"Ransomware cartel / extortion group 'lockbit' monitored by CTI.FYI.","aliases":["lockbit"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/lockbit.html","description":"CTI.FYI Dossier for lockbit"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--971c220e-b590-53d2-9db3-bc19df3fefa2","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Lockbit2","description":"Launched in June 2021 as a major evolution of the LockBit RaaS operation, LockBit 2.0 featured an ultrafast multithreaded C/C++ encryption binary engineered to automate self-propagation across Windows domains via Active Directory Group Policy Objects (GPOs). The group targeted commercial enterprises, manufacturing, and healthcare worldwide using the StealBit exfiltration engine while maintaining strict rules against targeting CIS nations. Affiliates established entry by exploiting perimeter vulnerabilities in Fortinet and Pulse Secure devices, purchasing broker access, and brute-forcing remote access ports.","aliases":["lockbit2","LockBit 2.0","LockBit Red","ABCD Ransomware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/lockbit2.html","description":"CTI.FYI Dossier for lockbit2"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--4c0c32ba-8818-5891-ab79-f5a5c9ea8af7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--971c220e-b590-53d2-9db3-bc19df3fefa2","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--b32dcb77-9254-5c87-85c3-67c08413135f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--971c220e-b590-53d2-9db3-bc19df3fefa2","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--480b847c-b762-5aab-8aa3-207aed93f08e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--971c220e-b590-53d2-9db3-bc19df3fefa2","target_ref":"attack-pattern--fe655efc-5db9-576e-972c-8915b320608c"},{"type":"relationship","spec_version":"2.1","id":"relationship--2c1b5d7a-cb01-5fa6-bde8-87b2d9bb5b2d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--971c220e-b590-53d2-9db3-bc19df3fefa2","target_ref":"attack-pattern--be6b8a06-2195-5310-83d2-d0e2405a0a58"},{"type":"relationship","spec_version":"2.1","id":"relationship--47ddf28b-0cee-5d70-b15d-c0dcd948f07a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--971c220e-b590-53d2-9db3-bc19df3fefa2","target_ref":"attack-pattern--ccc64fc9-8795-5bef-9a32-389a5239333d"},{"type":"relationship","spec_version":"2.1","id":"relationship--e2b37082-95cf-57be-9b51-e44f87453d0b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--971c220e-b590-53d2-9db3-bc19df3fefa2","target_ref":"attack-pattern--abf9da00-5965-549c-b277-81f9ff9940d1"},{"type":"relationship","spec_version":"2.1","id":"relationship--101a3e51-ee56-5794-b332-f2986b5f5b73","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--971c220e-b590-53d2-9db3-bc19df3fefa2","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"relationship","spec_version":"2.1","id":"relationship--0a6127a9-fdba-5ea3-a77a-644516c2567d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--971c220e-b590-53d2-9db3-bc19df3fefa2","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--6f00b0e7-2a9f-56a3-8fda-a84af37c436b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--971c220e-b590-53d2-9db3-bc19df3fefa2","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--a8181506-aac9-5789-a618-25ffffccdfa7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--971c220e-b590-53d2-9db3-bc19df3fefa2","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--abdd7504-aba1-54a2-89de-1e16aa2e6a3b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1041: EXFILTRATION OVER C2 CHANNEL","external_references":[{"source_name":"mitre-attack","external_id":"T1041: EXFILTRATION OVER C2 CHANNEL","url":"https://attack.mitre.org/techniques/T1041: EXFILTRATION OVER C2 CHANNEL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--f6022dd7-1c99-5dcd-9e87-9c1d3dadd942","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--971c220e-b590-53d2-9db3-bc19df3fefa2","target_ref":"attack-pattern--abdd7504-aba1-54a2-89de-1e16aa2e6a3b"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Lockbit3","description":"LockBit operators tend to be very indiscriminate and opportunistic in their targeting. Actors behind this attack will use a variety of methods to gain initial access, up to and including basic methods such as brute force.\nAfter gaining initial access the actor follows a fairly typical escalation, lateral movement and ransomware execution playbook. LockBit operators tend to have a very brief dwell time, executing the final ransomware payload as quickly as they are able to.  LockBit ransomware has the built-in lateral movement features; given adequate permissions throughout the targeted environment.","aliases":["lockbit3","LockBit","ABCD ransomware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/lockbit3.html","description":"CTI.FYI Dossier for lockbit3"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--84223b6d-5e22-5f4b-ad2e-965c1d45d807","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--2fa3d470-1027-52ef-910e-02e00b738c0b"},{"type":"relationship","spec_version":"2.1","id":"relationship--908e70d7-dc75-5913-a39b-53b63fe2f8ab","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--815dad65-a680-5efd-8c47-bbadc55751a9"},{"type":"relationship","spec_version":"2.1","id":"relationship--7b0104b2-efab-5aba-a743-32ce9a39e3a1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--f31ce0c3-69e7-5473-9503-19a901f7f784","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--ccc64fc9-8795-5bef-9a32-389a5239333d"},{"type":"relationship","spec_version":"2.1","id":"relationship--11b91f75-93c5-5b02-8e0e-2977dad9ceb8","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--20b4c69e-828e-550a-831b-65b7241fd338"},{"type":"relationship","spec_version":"2.1","id":"relationship--206b603e-640c-5cc2-904d-cf2e51425d40","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--ff1278ea-83eb-5923-ad16-5af81522e5e3"},{"type":"relationship","spec_version":"2.1","id":"relationship--103a41e1-c507-5945-81f0-c04230bf9e5d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--abdd7504-aba1-54a2-89de-1e16aa2e6a3b"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--c15529b4-e9ab-5817-b5f8-78da1cd813d5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1046: NETWORK SERVICE DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1046: NETWORK SERVICE DISCOVERY","url":"https://attack.mitre.org/techniques/T1046: NETWORK SERVICE DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--afc81b0a-e074-5ac6-a09d-1b0ff6055770","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--c15529b4-e9ab-5817-b5f8-78da1cd813d5"},{"type":"relationship","spec_version":"2.1","id":"relationship--0590d036-3d1e-5d38-9939-ae410bd4b26e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--abf9da00-5965-549c-b277-81f9ff9940d1"},{"type":"relationship","spec_version":"2.1","id":"relationship--0dd0be67-de34-5075-9232-04cce1b5c38e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--ab4983d8-060c-5016-a682-64ed7b711d8f"},{"type":"relationship","spec_version":"2.1","id":"relationship--ed2f5274-2c8e-5441-9dc5-2c4f0ede3ace","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"relationship","spec_version":"2.1","id":"relationship--05cc333d-d053-50f4-a91d-42a450858383","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--3e3ccae6-7ca3-5682-9d01-d364e8be12d1"},{"type":"relationship","spec_version":"2.1","id":"relationship--48e2d6fd-8c68-59c8-9c4b-d768a63d8cc1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--39642967-0c38-51e6-9d15-8c7f4d6a4007"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--8eb387ee-3dde-5e5c-9afc-ec7e324aadc3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1071.001: WEB PROTOCOLS","external_references":[{"source_name":"mitre-attack","external_id":"T1071.001: WEB PROTOCOLS","url":"https://attack.mitre.org/techniques/T1071.001: WEB PROTOCOLS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--62ca939f-e0e7-5146-95af-eb5523928536","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--8eb387ee-3dde-5e5c-9afc-ec7e324aadc3"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--9a85b90b-b96f-5740-befa-1a5bcc132429","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1071.002: FILE TRANSFER PROTOCOLS","external_references":[{"source_name":"mitre-attack","external_id":"T1071.002: FILE TRANSFER PROTOCOLS","url":"https://attack.mitre.org/techniques/T1071.002: FILE TRANSFER PROTOCOLS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--0f3ceb62-0fa1-5a04-b64e-9404c3e93ecc","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--9a85b90b-b96f-5740-befa-1a5bcc132429"},{"type":"relationship","spec_version":"2.1","id":"relationship--62262bd9-6dc9-5c4b-8e7b-1c0b53cba4d0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--7d14d34e-4fed-5688-8e3b-71e639598599"},{"type":"relationship","spec_version":"2.1","id":"relationship--46974f56-b9d9-52ed-abf7-cd6071a0ecba","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--273ed5c0-ff37-5e07-b70e-47d1417e6e4d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1078.001: DEFAULT ACCOUNTS","external_references":[{"source_name":"mitre-attack","external_id":"T1078.001: DEFAULT ACCOUNTS","url":"https://attack.mitre.org/techniques/T1078.001: DEFAULT ACCOUNTS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--f712573d-242e-55af-9f8a-f3f8499b1b14","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--273ed5c0-ff37-5e07-b70e-47d1417e6e4d"},{"type":"relationship","spec_version":"2.1","id":"relationship--3c4a9827-24d8-5b87-913f-28aa1459e710","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--31af36a7-3964-5a70-9498-d8ab3d0c507c"},{"type":"relationship","spec_version":"2.1","id":"relationship--0da47752-f731-5f56-92bd-320a118f614a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--d6072347-6a27-513e-aa9a-e3ced566f6bb"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--f4fbf4dc-b67c-525f-9c3a-ed9c7ddf4dfe","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1095: NON-APPLICATION LAYER PROTOCOL","external_references":[{"source_name":"mitre-attack","external_id":"T1095: NON-APPLICATION LAYER PROTOCOL","url":"https://attack.mitre.org/techniques/T1095: NON-APPLICATION LAYER PROTOCOL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--7eb1cf57-ade7-5625-ac19-d7c73c1a6332","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--f4fbf4dc-b67c-525f-9c3a-ed9c7ddf4dfe"},{"type":"relationship","spec_version":"2.1","id":"relationship--1e4c0bfd-1daf-5387-9ece-243c74e8c318","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--86ea6e1e-4e94-5a99-8299-3cff4343ce8d"},{"type":"relationship","spec_version":"2.1","id":"relationship--d7c1f758-d510-590b-9893-23b900d95043","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--fe655efc-5db9-576e-972c-8915b320608c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--0bf4b11a-4dd3-5d1a-8637-58c2d7b96f17","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1120: PERIPHERAL DEVICE DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1120: PERIPHERAL DEVICE DISCOVERY","url":"https://attack.mitre.org/techniques/T1120: PERIPHERAL DEVICE DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--dbae3207-2abe-532e-8654-03e74b37d40c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--0bf4b11a-4dd3-5d1a-8637-58c2d7b96f17"},{"type":"relationship","spec_version":"2.1","id":"relationship--a865aaf3-6707-5e23-b7a3-ad5b696b8f3a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--3c56009c-3d1f-5821-8c89-4ca4a0996ee2"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--c659297d-2d68-5cf2-9db8-13d120f3d2b0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1134.001: TOKEN IMPERSONATION/THEFT","external_references":[{"source_name":"mitre-attack","external_id":"T1134.001: TOKEN IMPERSONATION/THEFT","url":"https://attack.mitre.org/techniques/T1134.001: TOKEN IMPERSONATION/THEFT"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--9d758b6c-efb3-55b7-9bc0-4ffca9e6251c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--c659297d-2d68-5cf2-9db8-13d120f3d2b0"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--39ae0e3b-6efb-53c5-b20a-a3e9df17792e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1135: NETWORK SHARE DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1135: NETWORK SHARE DISCOVERY","url":"https://attack.mitre.org/techniques/T1135: NETWORK SHARE DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--7b560bd6-5a37-5266-ba10-2be2fecc61f5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--39ae0e3b-6efb-53c5-b20a-a3e9df17792e"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--6597ba15-a21c-53f6-9b3b-80e149e05374","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1189: DRIVE-BY COMPROMISE","external_references":[{"source_name":"mitre-attack","external_id":"T1189: DRIVE-BY COMPROMISE","url":"https://attack.mitre.org/techniques/T1189: DRIVE-BY COMPROMISE"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--b3c85fcf-6dcb-5976-824c-1058d53f3e9c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--6597ba15-a21c-53f6-9b3b-80e149e05374"},{"type":"relationship","spec_version":"2.1","id":"relationship--0d1a1b21-0b5c-5a8c-a96b-195ed5e4a83b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--87c67795-94be-5d3e-a137-3a909d5f7ea5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--d5b15a6d-b955-5900-9821-562e75b89c99"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--68a91ca4-363b-59e3-96ec-f227ff407e3a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1480.001: ENVIRONMENTAL KEYING","external_references":[{"source_name":"mitre-attack","external_id":"T1480.001: ENVIRONMENTAL KEYING","url":"https://attack.mitre.org/techniques/T1480.001: ENVIRONMENTAL KEYING"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--f7de7c3a-4c90-5f85-9fd9-fc404d6c4889","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--68a91ca4-363b-59e3-96ec-f227ff407e3a"},{"type":"relationship","spec_version":"2.1","id":"relationship--9df3bb0d-1915-5402-ba2f-561be2cc0669","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--be6b8a06-2195-5310-83d2-d0e2405a0a58"},{"type":"relationship","spec_version":"2.1","id":"relationship--04b00aea-5832-5ef7-931b-3a0118952453","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--36231ea5-483d-5a36-9c7f-bab9ef0dae70"},{"type":"relationship","spec_version":"2.1","id":"relationship--1c9ec276-97e7-5cf7-8977-bc4132731c48","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--2e0624f8-c68c-5d56-8fa1-cd171d851475","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--f21341c3-6e57-539d-a223-9f2170b14fc6"},{"type":"relationship","spec_version":"2.1","id":"relationship--9361c8ec-69c0-5a58-999f-1bf7f24531fd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--879ff58b-236b-5930-8c1b-55d2650ab607","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1491.001: INTERNAL DEFACEMENT","external_references":[{"source_name":"mitre-attack","external_id":"T1491.001: INTERNAL DEFACEMENT","url":"https://attack.mitre.org/techniques/T1491.001: INTERNAL DEFACEMENT"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--fa18f192-7b98-5848-8048-099a55b353f1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--879ff58b-236b-5930-8c1b-55d2650ab607"},{"type":"relationship","spec_version":"2.1","id":"relationship--c66d6f5c-f9cf-55be-8930-bebb28bf7b31","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--6e0a2375-3334-5dc0-9ff4-399ffbdffa57"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--2dd2031d-5f1c-5ca7-8f54-c3cd62236484","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1547.001: REGISTRY RUN KEYS / STARTUP FOLDER","external_references":[{"source_name":"mitre-attack","external_id":"T1547.001: REGISTRY RUN KEYS / STARTUP FOLDER","url":"https://attack.mitre.org/techniques/T1547.001: REGISTRY RUN KEYS / STARTUP FOLDER"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--6015e791-3740-58e9-be7e-f6d33ea28665","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--2dd2031d-5f1c-5ca7-8f54-c3cd62236484"},{"type":"relationship","spec_version":"2.1","id":"relationship--d44ccedc-2ce4-5a24-9521-77fd51b95f12","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--2cbad7b1-08d1-5336-9fc5-2a6978834913"},{"type":"relationship","spec_version":"2.1","id":"relationship--dcdfc068-ac39-5aeb-8af7-d084ff8ddc25","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--05cf6c8e-7525-505d-8407-f66e24e7e584"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--8db55adf-6550-59e2-8153-252278a3b2e8","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1559.001: COMPONENT OBJECT MODEL","external_references":[{"source_name":"mitre-attack","external_id":"T1559.001: COMPONENT OBJECT MODEL","url":"https://attack.mitre.org/techniques/T1559.001: COMPONENT OBJECT MODEL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--2a6991c5-4c5b-5455-8a21-fde6a21f79d0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--8db55adf-6550-59e2-8153-252278a3b2e8"},{"type":"relationship","spec_version":"2.1","id":"relationship--e73dcb90-c2f7-567d-ba3c-a9b70af6c7bf","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--ff17dd9a-2362-5b5c-bc25-ba0a884b580f"},{"type":"relationship","spec_version":"2.1","id":"relationship--591f8b92-98eb-5b58-9675-bd39d3714c52","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--40ec06ec-1fae-5b40-8072-ed71c1058cb2","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--26a065fd-80e9-54d1-8b71-7ab01689ab7f"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--87842883-03c2-5bb1-bfc4-569f6b43b7ff","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1562.004: DISABLE OR MODIFY SYSTEM FIREWALL","external_references":[{"source_name":"mitre-attack","external_id":"T1562.004: DISABLE OR MODIFY SYSTEM FIREWALL","url":"https://attack.mitre.org/techniques/T1562.004: DISABLE OR MODIFY SYSTEM FIREWALL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--cf3136e4-94b8-5222-940c-81404c5e234d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--87842883-03c2-5bb1-bfc4-569f6b43b7ff"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--0d309d70-8d97-5cc5-9e09-7d518a8f8a3c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1562.009: SAFE MODE BOOT","external_references":[{"source_name":"mitre-attack","external_id":"T1562.009: SAFE MODE BOOT","url":"https://attack.mitre.org/techniques/T1562.009: SAFE MODE BOOT"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--80fd500f-7c18-5b3f-989c-d43bf6295031","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--0d309d70-8d97-5cc5-9e09-7d518a8f8a3c"},{"type":"relationship","spec_version":"2.1","id":"relationship--0e50ece6-7e01-5311-aa48-66974e2d5542","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--a4dc579d-d897-5219-bc30-fe3cd6d4e17d"},{"type":"relationship","spec_version":"2.1","id":"relationship--aeefe960-251e-5fcd-b705-2d23f5f3c56a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--82419d22-299b-57e8-8782-819a702f7468"},{"type":"relationship","spec_version":"2.1","id":"relationship--4b1923b5-b889-5b69-8664-0d816fda80e3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--abf2c921-a7fd-54b2-9d66-1eda76161836","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1569.002: SERVICE EXECUTION","external_references":[{"source_name":"mitre-attack","external_id":"T1569.002: SERVICE EXECUTION","url":"https://attack.mitre.org/techniques/T1569.002: SERVICE EXECUTION"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--06b4fc9f-71b8-5ef4-84dc-06bb2c4e2421","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--abf2c921-a7fd-54b2-9d66-1eda76161836"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--f704c415-bf1b-556d-9e56-81774e4a187f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1572: PROTOCOL TUNNELING","external_references":[{"source_name":"mitre-attack","external_id":"T1572: PROTOCOL TUNNELING","url":"https://attack.mitre.org/techniques/T1572: PROTOCOL TUNNELING"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--91ae9a80-7edc-559d-afd1-6d3daef207b7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--f704c415-bf1b-556d-9e56-81774e4a187f"},{"type":"relationship","spec_version":"2.1","id":"relationship--6c347654-8b24-592f-b78f-202d6c45092a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--759f0b9e-21ac-5dcb-8ec6-cf4bc88f2c55"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--16e50a71-4e31-5a9a-b4ea-05814bc65dfa","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1614.001: SYSTEM LANGUAGE DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1614.001: SYSTEM LANGUAGE DISCOVERY","url":"https://attack.mitre.org/techniques/T1614.001: SYSTEM LANGUAGE DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--a2780264-4f58-569f-b343-3969fc78421a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"attack-pattern--16e50a71-4e31-5a9a-b4ea-05814bc65dfa"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--814b6d23-e09c-57c4-9a40-3a3f2f714ffa","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Lockbit3_Fs","description":"Ransomware cartel / extortion group 'lockbit3_fs' monitored by CTI.FYI.","aliases":["lockbit3_fs","Lockbit3"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/lockbit3_fs.html","description":"CTI.FYI Dossier for lockbit3_fs"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c27f51a6-6982-53ea-a2b1-d667c2d538cb","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Lockdata","description":"Ransomware cartel / extortion group 'lockdata' monitored by CTI.FYI.","aliases":["lockdata"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/lockdata.html","description":"CTI.FYI Dossier for lockdata"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--a7e50f2b-007a-577f-ac0c-820fd224df0d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Lolnek","description":"Ransomware cartel / extortion group 'lolnek' monitored by CTI.FYI.","aliases":["lolnek"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/lolnek.html","description":"CTI.FYI Dossier for lolnek"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--7f0734c4-aed6-5f55-a581-58d28f6b1715","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Lorenz","description":"Ransomware cartel / extortion group 'lorenz' monitored by CTI.FYI.","aliases":["lorenz"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/lorenz.html","description":"CTI.FYI Dossier for lorenz"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--7dc0aedf-a6ad-5127-a29e-91c81923935e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Losttrust","description":"Ransomware cartel / extortion group 'losttrust' monitored by CTI.FYI.","aliases":["losttrust"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/losttrust.html","description":"CTI.FYI Dossier for losttrust"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--717f6b8f-3bb9-5f68-b4ea-f4d590a9f275","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Lunalock","description":"Ransomware cartel / extortion group 'lunalock' monitored by CTI.FYI.","aliases":["lunalock"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/lunalock.html","description":"CTI.FYI Dossier for lunalock"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--9260c334-e8cf-5c36-bbff-09c06ebff45f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"LV","description":"Ransomware cartel / extortion group 'lv' monitored by CTI.FYI.","aliases":["lv"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/lv.html","description":"CTI.FYI Dossier for lv"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--aa0d4edc-be0f-51d7-b259-e1f5e445dbbf","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Lynx","description":"Emerging in July 2024, Lynx is a double-extortion Ransomware-as-a-Service (RaaS) operation that functions as a direct successor and rebrand of the INC Ransom syndicate. Built with a C/C++ architecture targeting Windows and Linux/ESXi systems using AES-128-CTR and Curve25519 encryption, the group compromises targets primarily through spearphishing and exploiting edge network appliances such as Fortinet FortiGate firewalls. Lynx extorts victims across the manufacturing, healthcare, technology, and energy sectors globally by threatening to publish exfiltrated proprietary data on its dark web leak portal.","aliases":["lynx","INC Ransom","INC Ransomware","Lynx Ransomware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/lynx.html","description":"CTI.FYI Dossier for lynx"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--b5243030-5aca-5f19-8790-ec2663c99a83","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aa0d4edc-be0f-51d7-b259-e1f5e445dbbf","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--fb930b47-eb16-52eb-ba86-74334ec0e726","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aa0d4edc-be0f-51d7-b259-e1f5e445dbbf","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--a4b355c2-e62d-5d54-80fe-f4fa36063082","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aa0d4edc-be0f-51d7-b259-e1f5e445dbbf","target_ref":"attack-pattern--c936ce1b-2bbf-59ed-ae9e-2897cc1129e5"},{"type":"relationship","spec_version":"2.1","id":"relationship--bbfe7eab-a7bc-50dc-a6d2-53510aab4413","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aa0d4edc-be0f-51d7-b259-e1f5e445dbbf","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--d75d7c1b-071f-5f32-988f-5b0e0bc60fe1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aa0d4edc-be0f-51d7-b259-e1f5e445dbbf","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"relationship","spec_version":"2.1","id":"relationship--06d34245-5c2b-5735-ac26-4553a732e60b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aa0d4edc-be0f-51d7-b259-e1f5e445dbbf","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--88c44f81-817f-54cb-89d4-a9316bebb79b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aa0d4edc-be0f-51d7-b259-e1f5e445dbbf","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--9fc22f79-d06b-55b6-b06f-4f384da07e79","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aa0d4edc-be0f-51d7-b259-e1f5e445dbbf","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--8fc776b8-166d-5a01-9f80-01788dab0e72","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aa0d4edc-be0f-51d7-b259-e1f5e445dbbf","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--18ccadcc-13a8-5dfd-94e6-4fee6f9f1ac4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--aa0d4edc-be0f-51d7-b259-e1f5e445dbbf","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--8f66d394-4c80-5368-9fa5-fa42a6b3c158","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Madcat","description":"Ransomware cartel / extortion group 'madcat' monitored by CTI.FYI.","aliases":["madcat"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/madcat.html","description":"CTI.FYI Dossier for madcat"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--63400bbb-54dd-5313-924c-eee11fe3736b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Madliberator","description":"Ransomware cartel / extortion group 'madliberator' monitored by CTI.FYI.","aliases":["madliberator"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/madliberator.html","description":"CTI.FYI Dossier for madliberator"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--ae06e0cd-39c2-5d52-b0b6-659bd8e6270e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Malas","description":"Ransomware cartel / extortion group 'malas' monitored by CTI.FYI.","aliases":["malas"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/malas.html","description":"CTI.FYI Dossier for malas"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3d5b286f-518f-529f-b707-27e500f42deb","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Malekteam","description":"Ransomware cartel / extortion group 'malekteam' monitored by CTI.FYI.","aliases":["malekteam","malek team"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/malekteam.html","description":"CTI.FYI Dossier for malekteam"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--5df240e3-4251-5d5c-b8a4-95fd427016b3","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Mallox","description":"Ransomware cartel / extortion group 'mallox' monitored by CTI.FYI.","aliases":["mallox"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/mallox.html","description":"CTI.FYI Dossier for mallox"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e71c0ee3-8ef5-558e-96de-4aaf751bd8ac","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Mamona","description":"Ransomware cartel / extortion group 'mamona' monitored by CTI.FYI.","aliases":["mamona"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/mamona.html","description":"CTI.FYI Dossier for mamona"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--daddddbb-c4a5-5350-9fb7-bcf939847753","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Marketo","description":"Ransomware cartel / extortion group 'marketo' monitored by CTI.FYI.","aliases":["marketo"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/marketo.html","description":"CTI.FYI Dossier for marketo"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--ffce4e31-b595-576e-b72c-c45383c533e5","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Maze","description":"Ransomware cartel / extortion group 'maze' monitored by CTI.FYI.","aliases":["maze"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/maze.html","description":"CTI.FYI Dossier for maze"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d7ae0cf2-529c-5043-8fca-d8dc6087fda2","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"MBC","description":"Ransomware cartel / extortion group 'mbc' monitored by CTI.FYI.","aliases":["mbc"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/mbc.html","description":"CTI.FYI Dossier for mbc"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--bb5bfa0a-f605-5b9d-80f3-3e7c83b92d31","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Medusa","description":"Operating prominently since late 2022, Medusa is an aggressive RaaS enterprise distinct from earlier MedusaLocker variants that deploys robust C/C++ payloads against corporate networks. The group strikes healthcare, educational institutions, manufacturing, and public sector targets across North America, Europe, and Asia. Initial compromise occurs via unpatched internet-facing appliances and compromised remote services, with extortion driven by an active 'Medusa Blog' and Telegram channels that auction victim data or offer fee-based countdown extensions.","aliases":["medusa","Medusa Ransomware","Medusa Team"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/medusa.html","description":"CTI.FYI Dossier for medusa"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--60599496-505b-51c9-80b3-46fcb82c16f3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--bb5bfa0a-f605-5b9d-80f3-3e7c83b92d31","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--a3a04fb7-7672-54a6-8094-8d22ac5b658c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--bb5bfa0a-f605-5b9d-80f3-3e7c83b92d31","target_ref":"attack-pattern--3c56009c-3d1f-5821-8c89-4ca4a0996ee2"},{"type":"relationship","spec_version":"2.1","id":"relationship--040ed598-fd62-56b2-bc9e-3043fa41d962","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--bb5bfa0a-f605-5b9d-80f3-3e7c83b92d31","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--3d8a9adf-a3de-58bd-89fb-6c122631696f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--bb5bfa0a-f605-5b9d-80f3-3e7c83b92d31","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"relationship","spec_version":"2.1","id":"relationship--95a734c5-a12a-5a15-9035-7f9f1ac86f3d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--bb5bfa0a-f605-5b9d-80f3-3e7c83b92d31","target_ref":"attack-pattern--abf9da00-5965-549c-b277-81f9ff9940d1"},{"type":"relationship","spec_version":"2.1","id":"relationship--f907bde3-59b2-5fb6-aff3-809e9a8cad24","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--bb5bfa0a-f605-5b9d-80f3-3e7c83b92d31","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--6f2c8670-371e-5a2b-a587-32ce0a98e4ae","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--bb5bfa0a-f605-5b9d-80f3-3e7c83b92d31","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--a733f88a-ee53-5e7b-8f68-a2af94b5b6fd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--bb5bfa0a-f605-5b9d-80f3-3e7c83b92d31","target_ref":"attack-pattern--f21341c3-6e57-539d-a223-9f2170b14fc6"},{"type":"relationship","spec_version":"2.1","id":"relationship--cbc40d3e-6085-5106-86e0-078368fb4aa4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--bb5bfa0a-f605-5b9d-80f3-3e7c83b92d31","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--154cb8ee-5a1f-5629-909a-6d21e613b1ec","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--bb5bfa0a-f605-5b9d-80f3-3e7c83b92d31","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--cd231c07-ec0f-5de5-b5bd-5c6a82fce169","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Medusalocker","description":"Ransomware cartel / extortion group 'medusalocker' monitored by CTI.FYI.","aliases":["medusalocker"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/medusalocker.html","description":"CTI.FYI Dossier for medusalocker"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--352ed760-51bc-596b-824f-aff9c74295c1","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Meow","description":"Ransomware cartel / extortion group 'meow' monitored by CTI.FYI.","aliases":["meow"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/meow.html","description":"CTI.FYI Dossier for meow"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--0f561605-d0e6-5975-ad7f-5e36cbcebb8e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Metaencryptor","description":"Ransomware cartel / extortion group 'metaencryptor' monitored by CTI.FYI.","aliases":["metaencryptor"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/metaencryptor.html","description":"CTI.FYI Dossier for metaencryptor"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3f96c7f8-7d3a-5f6a-96d0-b567db6fefc8","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Midas","description":"Ransomware cartel / extortion group 'midas' monitored by CTI.FYI.","aliases":["midas"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/midas.html","description":"CTI.FYI Dossier for midas"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--1a201591-392f-51ba-9230-4e5433392235","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Mindware","description":"Ransomware cartel / extortion group 'mindware' monitored by CTI.FYI.","aliases":["mindware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/mindware.html","description":"CTI.FYI Dossier for mindware"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--64ca4963-92f1-5c0a-9af5-322ece169919","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Minteye","description":"Ransomware cartel / extortion group 'minteye' monitored by CTI.FYI.","aliases":["minteye"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/minteye.html","description":"CTI.FYI Dossier for minteye"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--953db7d7-cba6-59c7-a551-5451effec93f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Mogilevich","description":"Ransomware cartel / extortion group 'mogilevich' monitored by CTI.FYI.","aliases":["mogilevich"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/mogilevich.html","description":"CTI.FYI Dossier for mogilevich"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--44a3b88c-bf89-5427-aec6-013e5f7886cc","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Moneymessage","description":"Ransomware cartel / extortion group 'moneymessage' monitored by CTI.FYI.","aliases":["moneymessage","money message"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/moneymessage.html","description":"CTI.FYI Dossier for moneymessage"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c53af3f6-b61b-5c64-95e5-9ea64fe7bc65","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Monti","description":"Ransomware cartel / extortion group 'monti' monitored by CTI.FYI.","aliases":["monti"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/monti.html","description":"CTI.FYI Dossier for monti"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--061c07b0-2f0d-56ed-a513-25c3c67789a8","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Morpheus","description":"Ransomware cartel / extortion group 'morpheus' monitored by CTI.FYI.","aliases":["morpheus"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/morpheus.html","description":"CTI.FYI Dossier for morpheus"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--450346f5-4e32-500d-9941-aaa0f65cc4de","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Mosesstaff","description":"Ransomware cartel / extortion group 'mosesstaff' monitored by CTI.FYI.","aliases":["mosesstaff"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/mosesstaff.html","description":"CTI.FYI Dossier for mosesstaff"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--8a2c8fbc-aa71-5305-970a-a28ca0d69377","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Mountlocker","description":"Ransomware cartel / extortion group 'mountlocker' monitored by CTI.FYI.","aliases":["mountlocker"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/mountlocker.html","description":"CTI.FYI Dossier for mountlocker"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--8a8045c6-0a05-505d-b157-64664b946c2f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ms13089","description":"Ransomware cartel / extortion group 'ms13089' monitored by CTI.FYI.","aliases":["ms13089"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ms13089.html","description":"CTI.FYI Dossier for ms13089"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--68f2c157-58e8-5ac8-96e2-a9cc83880439","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Mydecryptor","description":"Ransomware cartel / extortion group 'mydecryptor' monitored by CTI.FYI.","aliases":["mydecryptor"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/mydecryptor.html","description":"CTI.FYI Dossier for mydecryptor"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--ce54e1fc-bbdc-505b-be37-7bbda792ba4e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"N3Tworm","description":"Ransomware cartel / extortion group 'n3tworm' monitored by CTI.FYI.","aliases":["n3tworm"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/n3tworm.html","description":"CTI.FYI Dossier for n3tworm"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--6f9c725a-2fb4-559d-9021-9b069e1bd35f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Nasirsecurity","description":"Ransomware cartel / extortion group 'nasirsecurity' monitored by CTI.FYI.","aliases":["nasirsecurity"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/nasirsecurity.html","description":"CTI.FYI Dossier for nasirsecurity"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--f1182700-032a-59ec-b562-105c8fc17180","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Nefilim","description":"Ransomware cartel / extortion group 'nefilim' monitored by CTI.FYI.","aliases":["nefilim"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/nefilim.html","description":"CTI.FYI Dossier for nefilim"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--bb4ed50e-66db-5657-b00e-58f4236c0c68","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Nemty","description":"Ransomware cartel / extortion group 'nemty' monitored by CTI.FYI.","aliases":["nemty"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/nemty.html","description":"CTI.FYI Dossier for nemty"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d5b5446d-7827-52b3-b1a3-95114d059a2b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Netwalker","description":"Ransomware cartel / extortion group 'netwalker' monitored by CTI.FYI.","aliases":["netwalker"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/netwalker.html","description":"CTI.FYI Dossier for netwalker"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--8de91146-7862-53f6-b0e1-7d03c9f4c552","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Nevada","description":"Ransomware cartel / extortion group 'nevada' monitored by CTI.FYI.","aliases":["nevada"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/nevada.html","description":"CTI.FYI Dossier for nevada"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e87ead53-d45f-58d7-a4cf-09c2073fa634","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Nightsky","description":"Ransomware cartel / extortion group 'nightsky' monitored by CTI.FYI.","aliases":["nightsky"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/nightsky.html","description":"CTI.FYI Dossier for nightsky"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e6acb436-7c12-573c-8995-541d5e783c0b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Nightspire","description":"Emerging in early 2025 as an apparent successor to the Rbfs operation, NightSpire is a double-extortion ransomware threat targeting enterprises across manufacturing, professional services, healthcare, and education. Developed in Go (Golang) and appending the .nspire extension, the malware employs living-off-the-land techniques using utilities such as Everything for file discovery, 7-Zip for compression, and MEGAsync for high-volume data exfiltration. The syndicate gains initial compromise primarily through edge infrastructure exploits—specifically Fortinet FortiOS/FortiProxy devices (such as CVE-2024-55591)—and exposed Remote Desktop Protocol (RDP) access.","aliases":["nightspire","Rbfs","RBFS Ransomware","NightSpire Ransomware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/nightspire.html","description":"CTI.FYI Dossier for nightspire"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--b908e3dc-dc3d-50b3-a134-87cf007ae18f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--e6acb436-7c12-573c-8995-541d5e783c0b","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--9def5437-705c-532e-88e6-f26ef9488467","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--e6acb436-7c12-573c-8995-541d5e783c0b","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--9e681145-e9b1-52dc-a4d9-c4696c671abb","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--e6acb436-7c12-573c-8995-541d5e783c0b","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--d27f8789-d187-58f2-9699-bfc23b0f2618","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--e6acb436-7c12-573c-8995-541d5e783c0b","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--2f6cdd6f-c0c4-598c-bde1-be4ba1d837d1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--e6acb436-7c12-573c-8995-541d5e783c0b","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"relationship","spec_version":"2.1","id":"relationship--f0ef205f-7210-5b41-bc18-29e6ea51599b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--e6acb436-7c12-573c-8995-541d5e783c0b","target_ref":"attack-pattern--d6072347-6a27-513e-aa9a-e3ced566f6bb"},{"type":"relationship","spec_version":"2.1","id":"relationship--f652460b-c50c-52cf-aa62-9eeea6aa7cb9","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--e6acb436-7c12-573c-8995-541d5e783c0b","target_ref":"attack-pattern--ff17dd9a-2362-5b5c-bc25-ba0a884b580f"},{"type":"relationship","spec_version":"2.1","id":"relationship--8bfbb3c0-9611-55d6-9fa4-f25d5d1b9338","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--e6acb436-7c12-573c-8995-541d5e783c0b","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--931566c1-b477-5b15-ad34-1c882e40afb7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--e6acb436-7c12-573c-8995-541d5e783c0b","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--a26dbe50-4510-53a6-96c2-603ad0660c7e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--e6acb436-7c12-573c-8995-541d5e783c0b","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--cb13811f-f847-56d4-8b6b-c17aa4ace442","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Nitrogen","description":"Ransomware cartel / extortion group 'nitrogen' monitored by CTI.FYI.","aliases":["nitrogen"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/nitrogen.html","description":"CTI.FYI Dossier for nitrogen"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--7074cdb5-dde0-5889-ac30-a6d79ce27ae7","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Noescape","description":"Ransomware cartel / extortion group 'noescape' monitored by CTI.FYI.","aliases":["noescape"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/noescape.html","description":"CTI.FYI Dossier for noescape"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--0c6e1806-bd4f-567d-b7fc-68d8a9fd3eb4","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Nokoyawa","description":"Ransomware cartel / extortion group 'nokoyawa' monitored by CTI.FYI.","aliases":["nokoyawa"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/nokoyawa.html","description":"CTI.FYI Dossier for nokoyawa"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--eed6d4c4-46cd-5f4c-bb0c-3e0c42106dd3","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Noname","description":"Ransomware cartel / extortion group 'noname' monitored by CTI.FYI.","aliases":["noname"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/noname.html","description":"CTI.FYI Dossier for noname"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--1271d2c6-ff6e-57ea-84b0-7d693f8a680d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Nova","description":"Rebrand of RALord","aliases":["nova"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/nova.html","description":"CTI.FYI Dossier for nova"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--bba24ec3-5577-5156-8853-e70871353009","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Obscura","description":"Ransomware cartel / extortion group 'obscura' monitored by CTI.FYI.","aliases":["obscura"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/obscura.html","description":"CTI.FYI Dossier for obscura"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--1f116b07-41ed-579e-8545-1c62c04e7b8d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Onepercent","description":"Ransomware cartel / extortion group 'onepercent' monitored by CTI.FYI.","aliases":["onepercent"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/onepercent.html","description":"CTI.FYI Dossier for onepercent"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b1be4755-4691-5787-9abd-71d25ed7c87a","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Onyx","description":"Ransomware cartel / extortion group 'onyx' monitored by CTI.FYI.","aliases":["onyx"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/onyx.html","description":"CTI.FYI Dossier for onyx"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--6abd29cf-64bb-507b-87ed-8e25fefdd734","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Orca","description":"Ransomware cartel / extortion group 'orca' monitored by CTI.FYI.","aliases":["orca"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/orca.html","description":"CTI.FYI Dossier for orca"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--bf8f1379-dc1a-50c8-aa5f-82ab5c4e0cde","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Orion","description":"Jan13, 2026: We believe the group might be related to Babuk-Bjorka.","aliases":["orion"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/orion.html","description":"CTI.FYI Dossier for orion"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--78b2ddcb-e9da-5d33-846c-0048c6dd9c59","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Osiris","description":"Ransomware cartel / extortion group 'osiris' monitored by CTI.FYI.","aliases":["osiris"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/osiris.html","description":"CTI.FYI Dossier for osiris"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--2d28646e-1013-500f-9d16-6526d9517bd1","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Pandora","description":"Ransomware cartel / extortion group 'pandora' monitored by CTI.FYI.","aliases":["pandora"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/pandora.html","description":"CTI.FYI Dossier for pandora"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--6e74c020-157a-5f2f-b1bf-4e3d2be00389","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Pay2Key","description":"Ransomware cartel / extortion group 'pay2key' monitored by CTI.FYI.","aliases":["pay2key"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/pay2key.html","description":"CTI.FYI Dossier for pay2key"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--816ec3bb-947d-5cd6-8b0c-7c4ef9dde175","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Payload","description":"Ransomware cartel / extortion group 'payload' monitored by CTI.FYI.","aliases":["payload"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/payload.html","description":"CTI.FYI Dossier for payload"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c16142bf-bcb0-503b-94cc-4f24af208d72","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Payloadbin","description":"Ransomware cartel / extortion group 'payloadbin' monitored by CTI.FYI.","aliases":["payloadbin"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/payloadbin.html","description":"CTI.FYI Dossier for payloadbin"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--bcce27bc-f8fe-57c8-ae97-804f08299e85","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Payoutsking","description":"Ransomware cartel / extortion group 'payoutsking' monitored by CTI.FYI.","aliases":["payoutsking"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/payoutsking.html","description":"CTI.FYI Dossier for payoutsking"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--0a52fb9e-d1d9-522a-805a-d9c430437c81","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Pear","description":"ABOUT US:\r<br/>\r<br/>\"Pure Extraction And Ransom (PEAR) Team is the community of highly responsible and strictly disciplined members. We are a private team and have nothing common with any other threat actors. We've been monitoring this field for a long-long time. So, we understand all the processes and know well how it all works.\"","aliases":["pear"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/pear.html","description":"CTI.FYI Dossier for pear"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Play","description":"Identified in June 2022, Play is a closed ransomware syndicate operating high-impact double extortion campaigns against businesses and municipal governments across North America, Europe, and Latin America. Built in C/C++, the payload is paired with bespoke .NET discovery tools like Grixba to enumerate network targets and AlphaVSS scripts to manipulate Volume Shadow Copies. Operators frequently bypass security perimeters by exploiting Microsoft Exchange vulnerabilities (ProxyNotShell/OWASSRF), Fortinet firewalls, and exposed Remote Desktop Protocol instances.","aliases":["play","PlayCrypt","Play Ransomware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/play.html","description":"CTI.FYI Dossier for play"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--d1ba1f69-089f-5f6f-b6f2-079b3f8fbaec","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--8924dc60-2f35-52ef-ac70-5890e43e4a5a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"attack-pattern--3c56009c-3d1f-5821-8c89-4ca4a0996ee2"},{"type":"relationship","spec_version":"2.1","id":"relationship--e8b9c061-a39f-5790-bf0b-a2bc48645eee","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--2f831bc6-a9e4-512d-a101-18610ced1a62","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"relationship","spec_version":"2.1","id":"relationship--8edf1a0b-f18a-563b-9732-d3b74199a52e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"attack-pattern--abf9da00-5965-549c-b277-81f9ff9940d1"},{"type":"relationship","spec_version":"2.1","id":"relationship--a8cd350d-2d44-5635-9fa3-8822cf5eb9de","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--216757a2-1803-5a80-bd8b-70de65edc59a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"attack-pattern--ccc64fc9-8795-5bef-9a32-389a5239333d"},{"type":"relationship","spec_version":"2.1","id":"relationship--c5559480-dca7-5454-8bc8-50b51aac8f7f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--9580afd3-3d2a-5e59-b00a-32af37dc5f1b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--9e559353-d7a2-576d-a340-c3fea6cbbdec","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--5b063102-481b-574f-8afc-2e168f3964ba","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Playboy","description":"Ransomware cartel / extortion group 'playboy' monitored by CTI.FYI.","aliases":["playboy"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/playboy.html","description":"CTI.FYI Dossier for playboy"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--749ac9b1-bf98-56e4-a6c2-917295c541a2","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Projectrelic","description":"Ransomware cartel / extortion group 'projectrelic' monitored by CTI.FYI.","aliases":["projectrelic"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/projectrelic.html","description":"CTI.FYI Dossier for projectrelic"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--4d8c2b5f-e580-5387-9195-49fabe0733f3","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Prolock","description":"Ransomware cartel / extortion group 'prolock' monitored by CTI.FYI.","aliases":["prolock"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/prolock.html","description":"CTI.FYI Dossier for prolock"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--bb1c40c1-4da8-596e-bf7e-8ddb46d9eff0","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Prometheus","description":"Ransomware cartel / extortion group 'prometheus' monitored by CTI.FYI.","aliases":["prometheus"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/prometheus.html","description":"CTI.FYI Dossier for prometheus"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--15cbe463-a64f-5e96-a30f-9e45ec55518a","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Promptlock","description":"Ransomware cartel / extortion group 'promptlock' monitored by CTI.FYI.","aliases":["promptlock"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/promptlock.html","description":"CTI.FYI Dossier for promptlock"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--7bc01605-5a9c-5e8b-94b2-55c2e3a18d1e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Pysa","description":"Emerging in late 2019 as Mespinoza before rebranding to PYSA ('Protect Your System Amigo'), this syndicate was a prolific double-extortion threat that targeted organizations globally until ceasing operations in early 2022. The ransomware payload was developed in C++ (with supporting Go backdoors such as ChaChi and Gasket) utilizing AES-CBC and RSA algorithms to encrypt Windows and Linux systems. Initial access was systematically achieved through brute-forcing exposed Remote Desktop Protocol (RDP) connections and phishing lures, with attacks disproportionately targeting higher education, healthcare, and public sector organizations.","aliases":["pysa","Mespinoza","Pysa Ransomware","Mespinoza Ransomware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/pysa.html","description":"CTI.FYI Dossier for pysa"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--a3c33fc1-0547-5c98-bd82-a7d4b758a96e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7bc01605-5a9c-5e8b-94b2-55c2e3a18d1e","target_ref":"attack-pattern--fe655efc-5db9-576e-972c-8915b320608c"},{"type":"relationship","spec_version":"2.1","id":"relationship--291d30cf-116c-53b6-b02f-2ff8b313ec50","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7bc01605-5a9c-5e8b-94b2-55c2e3a18d1e","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--a9fc64f4-9786-5c67-8d9f-e7cc98e6d6e4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7bc01605-5a9c-5e8b-94b2-55c2e3a18d1e","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--ad0f635a-5e31-5546-9865-43393ff991db","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7bc01605-5a9c-5e8b-94b2-55c2e3a18d1e","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--6983a9b1-07a7-518f-99a4-d235495665a5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7bc01605-5a9c-5e8b-94b2-55c2e3a18d1e","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"relationship","spec_version":"2.1","id":"relationship--87321cd1-8e56-551a-b477-e3c056951b40","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7bc01605-5a9c-5e8b-94b2-55c2e3a18d1e","target_ref":"attack-pattern--2fa3d470-1027-52ef-910e-02e00b738c0b"},{"type":"relationship","spec_version":"2.1","id":"relationship--2702668a-2ad5-59cd-baec-c10ec38ca766","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7bc01605-5a9c-5e8b-94b2-55c2e3a18d1e","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--2b7e7477-576f-57ce-8b77-d7acd2000cf1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7bc01605-5a9c-5e8b-94b2-55c2e3a18d1e","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--8e02b2cc-2a80-5556-a3b5-a2da2d6a5ff6","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7bc01605-5a9c-5e8b-94b2-55c2e3a18d1e","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--de962b40-de99-56ed-87fc-3168796d000e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--7bc01605-5a9c-5e8b-94b2-55c2e3a18d1e","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Qilin","description":"Emerging in July 2022 under the name Agenda before rebranding in September 2022, Qilin is an aggressive Ransomware-as-a-Service operation that migrated from Go to a modular Rust-based architecture (Qilin.B). The group opportunistically targets critical infrastructure, education, and healthcare worldwide—notably executing the catastrophic 2024 attack against UK healthcare pathology provider Synnovis. Threat actors gain initial access through phishing lures, exposed Citrix/VPN appliances, and compromised credentials, practicing ruthless double extortion with customizable data leak thresholds.","aliases":["qilin","Agenda","Agenda Ransomware","Qilin.B"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/qilin.html","description":"CTI.FYI Dossier for qilin"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--b8de6f62-9b84-5801-b40e-0b7e7c60f52b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--15d1997b-8f7f-594f-a7be-3979f61548b3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"attack-pattern--c936ce1b-2bbf-59ed-ae9e-2897cc1129e5"},{"type":"relationship","spec_version":"2.1","id":"relationship--e5ea9f9b-2af1-5161-8858-bf6033d1a562","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--4bfb37ad-e120-59c1-9a51-6e3346a350a5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--a582402c-f6e0-5602-a728-e0b4b02b0d88","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"attack-pattern--ccc64fc9-8795-5bef-9a32-389a5239333d"},{"type":"relationship","spec_version":"2.1","id":"relationship--58bae38b-49d0-5615-9add-5a0681fc3582","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"attack-pattern--abf9da00-5965-549c-b277-81f9ff9940d1"},{"type":"relationship","spec_version":"2.1","id":"relationship--38b462a3-9d12-5d60-8d17-76a66289d166","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--ef14cc4d-80f9-57a0-9772-f8f12a07ce37","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--132bbfbf-6abf-5c89-92b2-777ec91675c8","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--a19de7f3-2924-5668-8d66-61376cc02c1c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d1983fa3-1c31-5cd3-8dc5-1b1749fcc2b2","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Qiulong","description":"Ransomware cartel / extortion group 'qiulong' monitored by CTI.FYI.","aliases":["qiulong"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/qiulong.html","description":"CTI.FYI Dossier for qiulong"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--94852f1a-5a8d-5f0a-a30e-e884e7695568","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Qlocker","description":"Ransomware cartel / extortion group 'qlocker' monitored by CTI.FYI.","aliases":["qlocker"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/qlocker.html","description":"CTI.FYI Dossier for qlocker"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--60fafea1-3097-57be-9326-28bdac844147","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Quantum","description":"Ransomware cartel / extortion group 'quantum' monitored by CTI.FYI.","aliases":["quantum"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/quantum.html","description":"CTI.FYI Dossier for quantum"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--0239eeff-ea42-5112-aee6-fbcfc085cff3","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Rabbithole","description":"Ransomware cartel / extortion group 'rabbithole' monitored by CTI.FYI.","aliases":["rabbithole"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/rabbithole.html","description":"CTI.FYI Dossier for rabbithole"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--5b2cc0e2-6c7e-56ff-b3d4-04ac47e56eff","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Radar","description":"Ransomware cartel / extortion group 'radar' monitored by CTI.FYI.","aliases":["radar"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/radar.html","description":"CTI.FYI Dossier for radar"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--7966ff59-8f25-59eb-822c-e9777ad2c818","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Radiant","description":"Ransomware cartel / extortion group 'radiant' monitored by CTI.FYI.","aliases":["radiant"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/radiant.html","description":"CTI.FYI Dossier for radiant"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--65fa5d84-44d4-517e-b4b5-7faa71eb0bb6","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ragnarlocker","description":"Ransomware cartel / extortion group 'ragnarlocker' monitored by CTI.FYI.","aliases":["ragnarlocker"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ragnarlocker.html","description":"CTI.FYI Dossier for ragnarlocker"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c72dbdeb-282f-510b-ad58-bfe2ebe6c8ef","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ragnarok","description":"Ransomware cartel / extortion group 'ragnarok' monitored by CTI.FYI.","aliases":["ragnarok"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ragnarok.html","description":"CTI.FYI Dossier for ragnarok"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d68d3800-d48a-53bb-84c5-dacc80cafa3b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ralord","description":"Ransomware cartel / extortion group 'ralord' monitored by CTI.FYI.","aliases":["ralord"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ralord.html","description":"CTI.FYI Dossier for ralord"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b4129f0c-eee4-5671-b48d-86b32282ee7d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ramp","description":"Ransomware cartel / extortion group 'ramp' monitored by CTI.FYI.","aliases":["ramp"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ramp.html","description":"CTI.FYI Dossier for ramp"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--19ceace4-3c93-5063-975c-4c41c650a679","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Rancoz","description":"Ransomware cartel / extortion group 'rancoz' monitored by CTI.FYI.","aliases":["rancoz"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/rancoz.html","description":"CTI.FYI Dossier for rancoz"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--cd45d84d-a836-55d6-bd9f-2e03b0ec8372","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ranion","description":"Ransomware cartel / extortion group 'ranion' monitored by CTI.FYI.","aliases":["ranion"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ranion.html","description":"CTI.FYI Dossier for ranion"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--20638f75-dcf4-59fd-b121-9b8448f48f46","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ransombay","description":"Ransomware cartel / extortion group 'ransombay' monitored by CTI.FYI.","aliases":["ransombay"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ransombay.html","description":"CTI.FYI Dossier for ransombay"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--9c6c445c-bf60-5ae2-91bb-93a97c97c697","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ransomcartel","description":"Ransomware cartel / extortion group 'ransomcartel' monitored by CTI.FYI.","aliases":["ransomcartel"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ransomcartel.html","description":"CTI.FYI Dossier for ransomcartel"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--62e3f738-c022-5a5f-b8a3-06fcb6bda359","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ransomcortex","description":"Ransomware cartel / extortion group 'ransomcortex' monitored by CTI.FYI.","aliases":["ransomcortex"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ransomcortex.html","description":"CTI.FYI Dossier for ransomcortex"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3252288f-b8fb-5513-824e-042ded53b35c","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ransomed","description":"Ransomware cartel / extortion group 'ransomed' monitored by CTI.FYI.","aliases":["ransomed"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ransomed.html","description":"CTI.FYI Dossier for ransomed"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--ddc883c3-9fce-5ec3-9a98-e806f2e18067","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ransomexx","description":"We recently discovered a new file-encrypting Trojan built as an ELF executable and intended to encrypt data on machines controlled by Linux-based operating systems.\nAfter the initial analysis we noticed similarities in the code of the Trojan, the text of the ransom notes and the general approach to extortion, which suggested that we had in fact encountered a Linux build of the previously known ransomware family RansomEXX. This malware is notorious for attacking large organizations and was most active earlier this year.\nRansomEXX is a highly targeted Trojan. Each sample of the malware contains a hardcoded name of the victim organization. Moreover, both the encrypted file extension and the email address for contacting the extortionists make use of the victim’s name.","aliases":["ransomexx","Ransom X","Defray777","Defray-777","Defray 2018"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ransomexx.html","description":"CTI.FYI Dossier for ransomexx"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--897c7c26-a99f-522d-ab4c-847efdd8ed82","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ransomhouse","description":"Ransomware cartel / extortion group 'ransomhouse' monitored by CTI.FYI.","aliases":["ransomhouse"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ransomhouse.html","description":"CTI.FYI Dossier for ransomhouse"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--59d6d850-2d9e-5649-a481-c6053e6924a3","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ransomhub","description":"Surfacing in February 2024, RansomHub quickly grew into a dominant cyber extortion syndicate by absorbing veteran affiliates from disrupted cartels like ALPHV/BlackCat and LockBit. The ransomware is compiled in Go and C++ with multi-platform support covering Windows, Linux, and ESXi, frequently leveraging specialized defense-evasion tooling such as the EDR-KillShifter driver to suppress endpoint protections. Operating across global commercial, healthcare, and critical infrastructure sectors, affiliates gain access via perimeter flaws (e.g. Citrix Bleed, FortiOS) and conduct high-pressure double extortion with a generous 90% payout model.","aliases":["ransomhub","Knight"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ransomhub.html","description":"CTI.FYI Dossier for ransomhub"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--40f5c3da-d6a8-55cc-b7f7-82e98ab46cfe","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--59d6d850-2d9e-5649-a481-c6053e6924a3","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--18cb9ca9-4420-51e7-b428-64e4ac28d8e6","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--59d6d850-2d9e-5649-a481-c6053e6924a3","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--f5d90ef9-3554-54cb-90ff-6261ec2182fc","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--59d6d850-2d9e-5649-a481-c6053e6924a3","target_ref":"attack-pattern--0304e34b-0acb-5752-ac30-154066831be9"},{"type":"relationship","spec_version":"2.1","id":"relationship--fa123542-7598-5ba8-b079-fc01864d127d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--59d6d850-2d9e-5649-a481-c6053e6924a3","target_ref":"attack-pattern--e26e7e43-391b-549e-a43b-9dbb452e182a"},{"type":"relationship","spec_version":"2.1","id":"relationship--4f5c51bc-d8f0-5f2b-a9b4-e509c1fb32c3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--59d6d850-2d9e-5649-a481-c6053e6924a3","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--e301d793-aaa9-540e-b881-6e96d1e256ed","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--59d6d850-2d9e-5649-a481-c6053e6924a3","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--9125371c-3d63-57fe-b2ee-b889d55a3828","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--59d6d850-2d9e-5649-a481-c6053e6924a3","target_ref":"attack-pattern--ccc64fc9-8795-5bef-9a32-389a5239333d"},{"type":"relationship","spec_version":"2.1","id":"relationship--7070947f-0ed2-58a8-95a8-8de9e106dc0b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--59d6d850-2d9e-5649-a481-c6053e6924a3","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--53303428-1361-5507-afa4-9663fd0977f6","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--59d6d850-2d9e-5649-a481-c6053e6924a3","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--994c8874-bb26-569a-ad29-406bf1ef263c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--59d6d850-2d9e-5649-a481-c6053e6924a3","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--70f80f2c-fbca-53a0-a230-227d60e7b027","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ranstreet","description":"Ransomware cartel / extortion group 'ranstreet' monitored by CTI.FYI.","aliases":["ranstreet"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ranstreet.html","description":"CTI.FYI Dossier for ranstreet"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c303e277-7128-5a45-ae3b-d97decdc296b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ranzy","description":"Ransomware cartel / extortion group 'ranzy' monitored by CTI.FYI.","aliases":["ranzy"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ranzy.html","description":"CTI.FYI Dossier for ranzy"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d0aab607-f0f6-516b-afc4-e25b19a16dd7","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Raworld","description":"Ransomware cartel / extortion group 'raworld' monitored by CTI.FYI.","aliases":["raworld"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/raworld.html","description":"CTI.FYI Dossier for raworld"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c040cf6b-3bac-51cb-b70f-988315ea1940","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Raznatovic","description":"Ransomware cartel / extortion group 'raznatovic' monitored by CTI.FYI.","aliases":["raznatovic"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/raznatovic.html","description":"CTI.FYI Dossier for raznatovic"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--cd430361-5949-55eb-8d8c-0259ab91f348","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Rebornvc","description":"Ransomware cartel / extortion group 'rebornvc' monitored by CTI.FYI.","aliases":["rebornvc"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/rebornvc.html","description":"CTI.FYI Dossier for rebornvc"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--cf19b53d-ca47-55e8-be39-6ec801d3f049","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Redalert","description":"Ransomware cartel / extortion group 'redalert' monitored by CTI.FYI.","aliases":["redalert"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/redalert.html","description":"CTI.FYI Dossier for redalert"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--53da745c-daf4-5435-8cb7-79d6322b373a","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Redransomware","description":"Ransomware cartel / extortion group 'redransomware' monitored by CTI.FYI.","aliases":["redransomware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/redransomware.html","description":"CTI.FYI Dossier for redransomware"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--4e2e569e-8e93-5a14-bb3c-378b8623758e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Revil","description":"Ransomware cartel / extortion group 'revil' monitored by CTI.FYI.","aliases":["revil"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/revil.html","description":"CTI.FYI Dossier for revil"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--1eb67302-8609-5e45-97ad-dfeffd084f44","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Reynolds","description":"Ransomware cartel / extortion group 'reynolds' monitored by CTI.FYI.","aliases":["reynolds"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/reynolds.html","description":"CTI.FYI Dossier for reynolds"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Rhysida","description":"Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads.\n\nThe group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development.\n\nThe ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin.\n\nAfter encryption, the ransomware appends the extension \".ryshida\" to encrypted files.\n\nFor encryption purposes, Trend Micro published an analysis stating that the ransomware uses a 4096-bit RSA key and AES-CTR for encryption.\n\nIn addition to the encryption method, Trend Micro published an analysis of the Ryshida Ransomware attack chain.\n\nFinally, the group has a website on the Tor network hosting the companies that have been breached.","aliases":["rhysida"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/rhysida.html","description":"CTI.FYI Dossier for rhysida"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--0e350af1-a6ed-58a9-a1d5-a0f4e8d35e42","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--ba6b20a4-a59f-5097-bad1-868c4fe6dcbb"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--9b10a081-3f4f-5922-9b7b-dde5d16b1195","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1010: APPLICATION WINDOW DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1010: APPLICATION WINDOW DISCOVERY","url":"https://attack.mitre.org/techniques/T1010: APPLICATION WINDOW DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--bf864597-f376-546d-93bb-d151fb002666","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--9b10a081-3f4f-5922-9b7b-dde5d16b1195"},{"type":"relationship","spec_version":"2.1","id":"relationship--99509d19-0650-59be-b953-806654dd41fd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--20b4c69e-828e-550a-831b-65b7241fd338"},{"type":"relationship","spec_version":"2.1","id":"relationship--3fd36cca-ef60-5f40-9cd1-585cb7b03cc0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--bfe60fdc-5873-50ec-8687-264ad08a1cf3"},{"type":"relationship","spec_version":"2.1","id":"relationship--0c2e12a9-8cbe-51e6-a0ab-1d274749c5a4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--abdd7504-aba1-54a2-89de-1e16aa2e6a3b"},{"type":"relationship","spec_version":"2.1","id":"relationship--e5a43f83-6220-5b9b-bf03-142dbfeb281a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--4778b433-8059-5770-a57e-a4d25252c9ae"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--22631bff-a188-591b-8b71-80d68e3211b4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1055.003: THREAD EXECUTION HIJACKING","external_references":[{"source_name":"mitre-attack","external_id":"T1055.003: THREAD EXECUTION HIJACKING","url":"https://attack.mitre.org/techniques/T1055.003: THREAD EXECUTION HIJACKING"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--be2aba00-31f3-588f-abfa-dbc600388615","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--22631bff-a188-591b-8b71-80d68e3211b4"},{"type":"relationship","spec_version":"2.1","id":"relationship--c72f8317-1589-59a3-a83f-3e4bf003e525","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--ab4983d8-060c-5016-a682-64ed7b711d8f"},{"type":"relationship","spec_version":"2.1","id":"relationship--9c80adfa-228d-5a13-9046-1cc147a5df2e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--d78f58be-e555-58ca-ae58-9b3f1c84e3ac"},{"type":"relationship","spec_version":"2.1","id":"relationship--1aa5d633-e0db-5e50-b079-35b6718c9803","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--67fc5ffb-8f7e-5afa-b98e-f3aab69449ad"},{"type":"relationship","spec_version":"2.1","id":"relationship--aca98aee-6d13-5ce7-a42a-ef57cb024a92","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--8eb387ee-3dde-5e5c-9afc-ec7e324aadc3"},{"type":"relationship","spec_version":"2.1","id":"relationship--eb714e1b-ed55-5848-b4d8-a0a35b39673e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--31af36a7-3964-5a70-9498-d8ab3d0c507c"},{"type":"relationship","spec_version":"2.1","id":"relationship--9efa92a4-4cf3-5c94-90fe-ccf8136142d8","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--d6072347-6a27-513e-aa9a-e3ced566f6bb"},{"type":"relationship","spec_version":"2.1","id":"relationship--0608f5e8-f6ec-58b2-aade-eb4da6d38cd5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--2c46deba-d61b-5e30-baec-1d375ab04052"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--019ec94d-c007-5a4f-92f8-8179223ccac7","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1129: SHARED MODULES","external_references":[{"source_name":"mitre-attack","external_id":"T1129: SHARED MODULES","url":"https://attack.mitre.org/techniques/T1129: SHARED MODULES"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--6e9483ad-ac25-5eeb-bb69-4e57e9ebe964","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--019ec94d-c007-5a4f-92f8-8179223ccac7"},{"type":"relationship","spec_version":"2.1","id":"relationship--6e8d8f90-8911-5d4a-8737-9058b512cf0f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--572dc9eb-448c-5bec-9720-b51d5288e0f4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--4dd3d1b6-1125-5d55-a4bc-4e8c44733286"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--7774dd53-fde0-5b90-b8f5-2af8dbdbd5f1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1518.001: SECURITY SOFTWARE DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1518.001: SECURITY SOFTWARE DISCOVERY","url":"https://attack.mitre.org/techniques/T1518.001: SECURITY SOFTWARE DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--49e8cd80-7d38-5305-afbc-b207a60adb3f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--7774dd53-fde0-5b90-b8f5-2af8dbdbd5f1"},{"type":"relationship","spec_version":"2.1","id":"relationship--433e03d7-b1d2-5948-8689-8f8a56129a94","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--2dd2031d-5f1c-5ca7-8f54-c3cd62236484"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--cfae6187-441d-57db-a9c4-394e534fbb9b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1548.002: BYPASS USER ACCOUNT CONTROL","external_references":[{"source_name":"mitre-attack","external_id":"T1548.002: BYPASS USER ACCOUNT CONTROL","url":"https://attack.mitre.org/techniques/T1548.002: BYPASS USER ACCOUNT CONTROL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--f0a7443a-35ec-58c7-9e72-a5e6999af186","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--cfae6187-441d-57db-a9c4-394e534fbb9b"},{"type":"relationship","spec_version":"2.1","id":"relationship--ca57cf47-0162-5690-b06d-7fd8325dff3a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--58b4b351-ca39-5b79-a24f-3a70e8a0a2e3"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--c4f9b92e-958e-55fa-afdf-92e844b93bdc","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1564.004: NTFS FILE ATTRIBUTES","external_references":[{"source_name":"mitre-attack","external_id":"T1564.004: NTFS FILE ATTRIBUTES","url":"https://attack.mitre.org/techniques/T1564.004: NTFS FILE ATTRIBUTES"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--8104133f-2f40-5fda-9c18-b164736663d9","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--c4f9b92e-958e-55fa-afdf-92e844b93bdc"},{"type":"relationship","spec_version":"2.1","id":"relationship--2bb27923-02a9-51df-ae0d-32ec484fb9d0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--a4dc579d-d897-5219-bc30-fe3cd6d4e17d"},{"type":"relationship","spec_version":"2.1","id":"relationship--b472270f-fad2-5f21-adca-743eda57a000","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--d9910828-2382-5b82-9670-c99e5acec561"},{"type":"relationship","spec_version":"2.1","id":"relationship--5046cf44-911b-5ce9-bf48-707ca4121c20","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--0a08aeec-6645-5d83-b5a6-7acfebbb0ba5"},{"type":"relationship","spec_version":"2.1","id":"relationship--383294b8-2903-5a05-898b-bab9222740d1","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--0175c09d-8dab-53ac-ae00-33ca24641ed6"},{"type":"relationship","spec_version":"2.1","id":"relationship--87bc794c-f7ed-5d29-9696-b96859ff0dcd","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--65360e11-67d1-589d-869b-d41cf2064bb1"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--03dccb1f-806f-5396-b05b-9a517c0739c8","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1620: REFLECTIVE CODE LOADING","external_references":[{"source_name":"mitre-attack","external_id":"T1620: REFLECTIVE CODE LOADING","url":"https://attack.mitre.org/techniques/T1620: REFLECTIVE CODE LOADING"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--6acaaf67-b407-5cd3-9e74-520dcac7149a","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--9f41ac76-0534-5d05-9600-d379e92a0b52","target_ref":"attack-pattern--03dccb1f-806f-5396-b05b-9a517c0739c8"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--9ded4110-b60c-5b7d-acce-f4b0cacb986f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Robinhood","description":"Detected in April 2019. Known for paralyzing the cities of Baltimore and Greenville. Probably also exfiltrate data","aliases":["robinhood","HelpYemen"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/robinhood.html","description":"CTI.FYI Dossier for robinhood"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c76943d0-b211-5b42-a98b-36144d656718","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Rook","description":"Ransomware cartel / extortion group 'rook' monitored by CTI.FYI.","aliases":["rook"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/rook.html","description":"CTI.FYI Dossier for rook"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--13b46949-c6e6-5733-ba67-f86f9d25a850","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Royal","description":"Active from September 2022 to mid-2023 before rebranding into BlackSuit, Royal was an elite private cyber syndicate launched by veteran operators from the Conti ransomware group (initially tracked as DEV-0569 and Team9). The 64-bit C++ encryptor utilized partial encryption routines via OpenSSL (AES-256 or ChaCha20) across Windows and VMware ESXi systems to significantly evade endpoint detection and increase encryption velocity. The group pioneered massive callback phishing campaigns (vishing), leveraged malvertising/Google Ads deploying malicious loaders, and weaponized compromised remote access credentials against large enterprise organizations globally.","aliases":["royal","DEV-0569","Team9","Royal Ransomware","BlackSuit"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/royal.html","description":"CTI.FYI Dossier for royal"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--9cda42b8-80e7-55d7-90c1-b10f43d8d6bb","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--13b46949-c6e6-5733-ba67-f86f9d25a850","target_ref":"attack-pattern--c936ce1b-2bbf-59ed-ae9e-2897cc1129e5"},{"type":"relationship","spec_version":"2.1","id":"relationship--e722ecd6-e7d3-5e9e-b2d4-f724dab3206e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--13b46949-c6e6-5733-ba67-f86f9d25a850","target_ref":"attack-pattern--68b26d47-453b-58f8-b1a1-bb41b1969bed"},{"type":"relationship","spec_version":"2.1","id":"relationship--ec714234-532f-5cbf-b1b3-d6456be0739e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--13b46949-c6e6-5733-ba67-f86f9d25a850","target_ref":"attack-pattern--9a2dd01d-993f-5226-88ca-68ce55bdc06e"},{"type":"relationship","spec_version":"2.1","id":"relationship--abb352ea-9a3e-5fa4-9145-09619baf4510","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--13b46949-c6e6-5733-ba67-f86f9d25a850","target_ref":"attack-pattern--2a1e2b7a-e31e-50fb-a3ee-df5223651560"},{"type":"relationship","spec_version":"2.1","id":"relationship--2f2fe2a7-03d4-5ccd-a21b-d4eca610d476","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--13b46949-c6e6-5733-ba67-f86f9d25a850","target_ref":"attack-pattern--3db5ebcb-deb1-5a35-89d5-d3d507f17089"},{"type":"relationship","spec_version":"2.1","id":"relationship--960a3e20-9e13-5ab1-a2eb-a080dcc8d73b","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--13b46949-c6e6-5733-ba67-f86f9d25a850","target_ref":"attack-pattern--32948ce8-fac7-50b3-8c32-ca2b88a8e72c"},{"type":"relationship","spec_version":"2.1","id":"relationship--684fd48a-7471-520f-8ca8-724bc1c82d46","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--13b46949-c6e6-5733-ba67-f86f9d25a850","target_ref":"attack-pattern--abf9da00-5965-549c-b277-81f9ff9940d1"},{"type":"relationship","spec_version":"2.1","id":"relationship--d7a870cc-e40e-5ab4-999f-406742259989","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--13b46949-c6e6-5733-ba67-f86f9d25a850","target_ref":"attack-pattern--9e0ee78d-9478-5c05-8e5a-840c8fce888c"},{"type":"relationship","spec_version":"2.1","id":"relationship--cb6b61dc-b325-5ae8-bcff-f944b76a1e4c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--13b46949-c6e6-5733-ba67-f86f9d25a850","target_ref":"attack-pattern--ccc64fc9-8795-5bef-9a32-389a5239333d"},{"type":"relationship","spec_version":"2.1","id":"relationship--223b679e-89fe-5920-b36d-d1674ffd9ec5","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--13b46949-c6e6-5733-ba67-f86f9d25a850","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--83f4e644-829d-5037-ae1b-0be8599e17ae","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--13b46949-c6e6-5733-ba67-f86f9d25a850","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--510c5d42-aade-5433-99e7-ba20d27e15f0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--13b46949-c6e6-5733-ba67-f86f9d25a850","target_ref":"attack-pattern--e1306e48-8f13-5d56-bd97-169124a5841c"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e088bf35-58bb-59b3-b9e0-2275e8856682","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Rransom","description":"Ransomware cartel / extortion group 'rransom' monitored by CTI.FYI.","aliases":["rransom"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/rransom.html","description":"CTI.FYI Dossier for rransom"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--60d6083e-e1ca-5a42-b26b-aa91a70320da","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Runsomewares","description":"Ransomware cartel / extortion group 'RunSomeWares' monitored by CTI.FYI.","aliases":["RunSomeWares","run some wares"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/runsomewares.html","description":"CTI.FYI Dossier for RunSomeWares"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--14e41f1b-b770-530f-936b-1169ead9ffff","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Sabbath","description":"Ransomware cartel / extortion group 'sabbath' monitored by CTI.FYI.","aliases":["sabbath"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/sabbath.html","description":"CTI.FYI Dossier for sabbath"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--47c97875-4fb3-5d9f-8e45-ee85b231dd08","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Safepay","description":"SafePay ransomware started in October 2024 as a new ransomware service, using some of the leaked LockBit source code. Soon after launching, the group made a big impact in the ransomware world, hacking at least 33 organizations by December 9.\n\nThe first version of SafePay was created by modifying the LockBit source code. It adds the \".safepay\" extension to files that it encrypts and includes a ransom note called \"readme_safepay.txt.\" This version uses a three-step XOR method with a random single-byte key, making it hard for security researchers to analyse.\n\nThe group's technical infrastructure includes both a dark web blog and a presence on the TON network for victim communications. Their attack methodology follows a double extortion model, combining traditional file encryption with data theft to maximise pressure on victims. SafePay operators typically move from initial access to ransomware deployment in under 24 hours, significantly faster than the industry average. . Among the Tactics, Techniques, and Procedures (TTPs) of the SafePay group, notable characteristics include the use of compromised VPN credentials as an initial access vector, extensive use of living-off-the-land binaries (LOLBins), and sophisticated privilege escalation techniques. The group frequently employs ShareFinder.ps1 for network reconnaissance and uses WinRAR for data archival before exfiltration. Post encryption, SafePay directs victims to their negotiation portal accessible through both Tor and TON networks.\n\nThe group has demonstrated sophisticated operational security measures, including a Cyrillic-language-based killswitch that prevents execution in eastern European countries.","aliases":["safepay"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/safepay.html","description":"CTI.FYI Dossier for safepay"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--0490194e-45bd-540e-9876-9d11b796e351","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--47c97875-4fb3-5d9f-8e45-ee85b231dd08","target_ref":"attack-pattern--e632955e-297b-569e-a458-cab9dbe12bab"},{"type":"relationship","spec_version":"2.1","id":"relationship--64383c3f-8572-5447-8224-893c7f96b796","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--47c97875-4fb3-5d9f-8e45-ee85b231dd08","target_ref":"attack-pattern--0018c874-d41e-53f3-8a5f-018309837885"},{"type":"relationship","spec_version":"2.1","id":"relationship--313f22b4-714b-57c5-9419-a5fc837ff3e6","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--47c97875-4fb3-5d9f-8e45-ee85b231dd08","target_ref":"attack-pattern--d78f58be-e555-58ca-ae58-9b3f1c84e3ac"},{"type":"relationship","spec_version":"2.1","id":"relationship--0c3b21bf-62c3-5be2-a9f1-bf30de992587","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--47c97875-4fb3-5d9f-8e45-ee85b231dd08","target_ref":"attack-pattern--67fc5ffb-8f7e-5afa-b98e-f3aab69449ad"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--1d7aa5ef-a6bd-525e-84f4-6ad90234aef3","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1076: REMOTE DESKTOP PROTOCOL","external_references":[{"source_name":"mitre-attack","external_id":"T1076: REMOTE DESKTOP PROTOCOL","url":"https://attack.mitre.org/techniques/T1076: REMOTE DESKTOP PROTOCOL"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--8e75fd57-720c-5938-88d4-90199641f6ba","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--47c97875-4fb3-5d9f-8e45-ee85b231dd08","target_ref":"attack-pattern--1d7aa5ef-a6bd-525e-84f4-6ad90234aef3"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--dbbb68e8-4a5b-56a9-87f1-eb1463844f76","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1089: DISABLING SECURITY TOOLS","external_references":[{"source_name":"mitre-attack","external_id":"T1089: DISABLING SECURITY TOOLS","url":"https://attack.mitre.org/techniques/T1089: DISABLING SECURITY TOOLS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--5e93361a-4b37-523e-901d-6305fbc305f4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--47c97875-4fb3-5d9f-8e45-ee85b231dd08","target_ref":"attack-pattern--dbbb68e8-4a5b-56a9-87f1-eb1463844f76"},{"type":"relationship","spec_version":"2.1","id":"relationship--0e252592-c9a2-5446-bb0e-9d8c08543ea4","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--47c97875-4fb3-5d9f-8e45-ee85b231dd08","target_ref":"attack-pattern--3c56009c-3d1f-5821-8c89-4ca4a0996ee2"},{"type":"relationship","spec_version":"2.1","id":"relationship--4168fec5-bbe0-58a4-97d8-76b598930c94","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--47c97875-4fb3-5d9f-8e45-ee85b231dd08","target_ref":"attack-pattern--39ae0e3b-6efb-53c5-b20a-a3e9df17792e"},{"type":"relationship","spec_version":"2.1","id":"relationship--a5504560-8086-539d-afc3-43de7c152680","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--47c97875-4fb3-5d9f-8e45-ee85b231dd08","target_ref":"attack-pattern--0125e659-5f8e-50b4-959f-e50d53c2404c"},{"type":"relationship","spec_version":"2.1","id":"relationship--b0493890-e767-5f18-a253-577beab7e300","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--47c97875-4fb3-5d9f-8e45-ee85b231dd08","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"relationship","spec_version":"2.1","id":"relationship--341629e0-8f3e-5a20-a39a-639eea5ae6ef","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--47c97875-4fb3-5d9f-8e45-ee85b231dd08","target_ref":"attack-pattern--cfae6187-441d-57db-a9c4-394e534fbb9b"},{"type":"relationship","spec_version":"2.1","id":"relationship--daf55980-acc5-513d-87ae-6267de847538","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--47c97875-4fb3-5d9f-8e45-ee85b231dd08","target_ref":"attack-pattern--ff17dd9a-2362-5b5c-bc25-ba0a884b580f"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--ba07d72f-69d7-543d-9eb9-04fc59dbe784","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1650: ACQUIRE ACCESS","external_references":[{"source_name":"mitre-attack","external_id":"T1650: ACQUIRE ACCESS","url":"https://attack.mitre.org/techniques/T1650: ACQUIRE ACCESS"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--dd5675fe-9270-5587-947a-37fd3bc15a19","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--47c97875-4fb3-5d9f-8e45-ee85b231dd08","target_ref":"attack-pattern--ba07d72f-69d7-543d-9eb9-04fc59dbe784"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--884bdf01-c632-5b4e-a31f-73a16cd1d568","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Sarcoma","description":"Sarcoma is a ransomware group that emerged in October 2024 and has been actively targeting various organizations. Sarcoma's attack methods include phishing campaigns, exploiting n-day vulnerabilities, and supply chain attacks. Once inside a network, they use RDP exploitation, lateral movement, and data exfiltration tactics. Sarcoma has claimed responsibility for attacks against Unimicron, a PCB manufacturer, Kelowna Springs Golf Club, Popular Life Insurance, CP Construplan, ADT Freight Services Australia, Micon National. These attacks have resulted in data exfiltration, with Sarcoma threatening to leak or having already leaked stolen data. Specifically, Sarcoma has exfiltrated 377 GB of SQL files and sensitive documents from Unimicron, 3.8 GB of data from Kelowna Springs, 36 GB of data from Popular Life Insurance, 2 GB of data from ADT Freight Services Australia, and 34 GB of data from Micon National. The group is known for its aggressive tactics against industrial organizations.","aliases":["sarcoma","Sarcoma Ransomware Group"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/sarcoma.html","description":"CTI.FYI Dossier for sarcoma"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--4aa99069-38fe-50c9-af21-a5291e4204d9","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Satanlockv2","description":"Connected to GD Lockersec and Babuk-Bjorka.\r<br/>\r<br/>Group is aka SalanLock (from typo on victim pages).","aliases":["satanlockv2","satanlock"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/satanlockv2.html","description":"CTI.FYI Dossier for satanlockv2"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--ff266653-aecd-50d2-95ca-19a3db4d4532","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Secp0","description":"Ransomware cartel / extortion group 'secp0' monitored by CTI.FYI.","aliases":["secp0"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/secp0.html","description":"CTI.FYI Dossier for secp0"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b1195e5c-cc2c-52a5-a776-6a6c0658ee2a","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Securotrop","description":"Ransomware cartel / extortion group 'securotrop' monitored by CTI.FYI.","aliases":["securotrop"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/securotrop.html","description":"CTI.FYI Dossier for securotrop"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d4c62839-6ba9-5376-96f9-296a2fa60e9b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Sensayq","description":"Ransomware cartel / extortion group 'SenSayQ' monitored by CTI.FYI.","aliases":["SenSayQ"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/sensayq.html","description":"CTI.FYI Dossier for SenSayQ"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--2963a88d-54da-50e1-b5df-0933628ed41b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Shadow","description":"Ransomware cartel / extortion group 'shadow' monitored by CTI.FYI.","aliases":["shadow"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/shadow.html","description":"CTI.FYI Dossier for shadow"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3b5e69ac-27b0-5231-9f16-c940889649b5","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Shadowbyt3$","description":"Ransomware cartel / extortion group 'ShadowByt3$' monitored by CTI.FYI.","aliases":["ShadowByt3$"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/shadowbyt3$.html","description":"CTI.FYI Dossier for ShadowByt3$"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--86df532e-3522-5ef4-b7c5-d58daa48c3cc","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Shaoleaks","description":"Ransomware cartel / extortion group 'shaoleaks' monitored by CTI.FYI.","aliases":["shaoleaks"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/shaoleaks.html","description":"CTI.FYI Dossier for shaoleaks"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--70a77f83-db57-58e0-a44e-b42dc461e076","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Shinyhunters","description":"Ransomware cartel / extortion group 'shinyhunters' monitored by CTI.FYI.","aliases":["shinyhunters"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/shinyhunters.html","description":"CTI.FYI Dossier for shinyhunters"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--eef6e5d2-13ee-5041-baa1-7b0fa20ade6f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Shinysp1D3R","description":"Ransomware cartel / extortion group 'ShinySp1d3r' monitored by CTI.FYI.","aliases":["ShinySp1d3r"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/shinysp1d3r.html","description":"CTI.FYI Dossier for ShinySp1d3r"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--28134eb1-0162-5c5d-a89c-c2bc9ed80e02","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Sicarii","description":"Ransomware cartel / extortion group 'sicarii' monitored by CTI.FYI.","aliases":["sicarii"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/sicarii.html","description":"CTI.FYI Dossier for sicarii"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--65d464a1-b51e-5b82-b5b1-65d98e67a66d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Siegedsec","description":"Ransomware cartel / extortion group 'siegedsec' monitored by CTI.FYI.","aliases":["siegedsec"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/siegedsec.html","description":"CTI.FYI Dossier for siegedsec"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--33dc2037-1321-5e1f-8ddf-eada8edec58b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Silent","description":"Ransomware cartel / extortion group 'silent' monitored by CTI.FYI.","aliases":["silent"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/silent.html","description":"CTI.FYI Dossier for silent"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--bf60f278-0036-5d27-b97f-82426c49dc93","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Silentransomgroup","description":"Ransomware cartel / extortion group 'SilentRansomGroup' monitored by CTI.FYI.","aliases":["SilentRansomGroup","silent ransom"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/silentransomgroup.html","description":"CTI.FYI Dossier for SilentRansomGroup"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--454be1c7-67a7-55be-a3f7-2c306f840ba3","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Sinobi","description":"Ransomware cartel / extortion group 'sinobi' monitored by CTI.FYI.","aliases":["sinobi"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/sinobi.html","description":"CTI.FYI Dossier for sinobi"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--bc1f2c03-b9e8-567a-92e4-b70242958d23","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Skira","description":"Ransomware cartel / extortion group 'skira' monitored by CTI.FYI.","aliases":["skira"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/skira.html","description":"CTI.FYI Dossier for skira"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e79ac716-f4ca-591c-a5b2-56216f4845d9","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Slug","description":"Ransomware cartel / extortion group 'slug' monitored by CTI.FYI.","aliases":["slug"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/slug.html","description":"CTI.FYI Dossier for slug"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d2374637-9edf-5bfa-98b9-4511edb5f59d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Snatch","description":"Ransomware cartel / extortion group 'snatch' monitored by CTI.FYI.","aliases":["snatch"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/snatch.html","description":"CTI.FYI Dossier for snatch"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--6b891a9b-f3b1-50b7-a9d8-3a400b2a1cc4","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Solidbit","description":"Ransomware cartel / extortion group 'solidbit' monitored by CTI.FYI.","aliases":["solidbit"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/solidbit.html","description":"CTI.FYI Dossier for solidbit"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3f7930ac-0e74-5fe8-99d9-c1236dcdc5e7","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Spacebears","description":"Ransomware cartel / extortion group 'spacebears' monitored by CTI.FYI.","aliases":["spacebears","space bears"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/spacebears.html","description":"CTI.FYI Dossier for spacebears"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--17bf710a-c9bd-5d47-8e7c-611089a1afec","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Sparta","description":"Ransomware cartel / extortion group 'sparta' monitored by CTI.FYI.","aliases":["sparta"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/sparta.html","description":"CTI.FYI Dossier for sparta"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--dc3ad307-c7ce-5d80-ad51-4909a27bf93c","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Spook","description":"Ransomware cartel / extortion group 'spook' monitored by CTI.FYI.","aliases":["spook"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/spook.html","description":"CTI.FYI Dossier for spook"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--8be2a8a8-836f-50cc-b459-c06aabb351b4","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Stormous","description":"Ransomware cartel / extortion group 'stormous' monitored by CTI.FYI.","aliases":["stormous"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/stormous.html","description":"CTI.FYI Dossier for stormous"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--2631987d-632e-5a8a-b9e8-3f56c73daef4","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Sugar","description":"Ransomware cartel / extortion group 'sugar' monitored by CTI.FYI.","aliases":["sugar"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/sugar.html","description":"CTI.FYI Dossier for sugar"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e69bee0d-b75c-53da-a6ac-45a0b8c80bc1","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Suncrypt","description":"Ransomware cartel / extortion group 'suncrypt' monitored by CTI.FYI.","aliases":["suncrypt"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/suncrypt.html","description":"CTI.FYI Dossier for suncrypt"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--82857c10-1b7b-55b9-95fa-677e8ab946bf","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Synack","description":"Ransomware cartel / extortion group 'synack' monitored by CTI.FYI.","aliases":["synack"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/synack.html","description":"CTI.FYI Dossier for synack"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--4a703505-f9a5-5a78-a5c3-1f8b149e1d56","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Teamxxx","description":"Ransomware cartel / extortion group 'teamxxx' monitored by CTI.FYI.","aliases":["teamxxx"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/teamxxx.html","description":"CTI.FYI Dossier for teamxxx"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b38fca2a-9928-5899-b26c-1e9eeca3f4b7","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Tengu","description":"Ransomware cartel / extortion group 'tengu' monitored by CTI.FYI.","aliases":["tengu"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/tengu.html","description":"CTI.FYI Dossier for tengu"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--f13f8404-9676-5769-8189-1ce4460c8070","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Termite","description":"Ransomware cartel / extortion group 'termite' monitored by CTI.FYI.","aliases":["termite"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/termite.html","description":"CTI.FYI Dossier for termite"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--4169eb90-df54-5186-994c-9df1fbb9da53","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Thegentlemen","description":"Ransomware cartel / extortion group 'thegentlemen' monitored by CTI.FYI.","aliases":["thegentlemen"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/thegentlemen.html","description":"CTI.FYI Dossier for thegentlemen"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e87b7677-a7f9-520c-ba6e-9771638a1847","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Thegreenbloodgroup","description":"Ransomware cartel / extortion group 'thegreenbloodgroup' monitored by CTI.FYI.","aliases":["thegreenbloodgroup"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/thegreenbloodgroup.html","description":"CTI.FYI Dossier for thegreenbloodgroup"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--615fc1ae-12a0-5ff8-8477-443b6d5c2e34","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Threeam","description":"Ransomware cartel / extortion group 'threeam' monitored by CTI.FYI.","aliases":["threeam","3am"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/threeam.html","description":"CTI.FYI Dossier for threeam"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--4a6f90ba-a6fc-5fa5-ae7a-e977f4b0d16d","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--615fc1ae-12a0-5ff8-8477-443b6d5c2e34","target_ref":"attack-pattern--10fdb2da-2faf-501d-bbf4-f3ba50e7b46c"},{"type":"relationship","spec_version":"2.1","id":"relationship--bd9e21f9-1fde-5b9f-8117-a11e0a7b4e70","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--615fc1ae-12a0-5ff8-8477-443b6d5c2e34","target_ref":"attack-pattern--cfae6187-441d-57db-a9c4-394e534fbb9b"},{"type":"relationship","spec_version":"2.1","id":"relationship--48558541-81fd-5dce-93af-9e0466d21e8e","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--615fc1ae-12a0-5ff8-8477-443b6d5c2e34","target_ref":"attack-pattern--4dfa0133-19d7-558a-9806-291cdc07ec61"},{"type":"relationship","spec_version":"2.1","id":"relationship--b8dcd748-a2ee-5779-b198-c3b74010ef46","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--615fc1ae-12a0-5ff8-8477-443b6d5c2e34","target_ref":"attack-pattern--abf2c921-a7fd-54b2-9d66-1eda76161836"},{"type":"relationship","spec_version":"2.1","id":"relationship--cf5b95f9-1b46-54c5-8090-d40f72a17e57","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--615fc1ae-12a0-5ff8-8477-443b6d5c2e34","target_ref":"attack-pattern--87842883-03c2-5bb1-bfc4-569f6b43b7ff"},{"type":"relationship","spec_version":"2.1","id":"relationship--91d358db-2edc-598e-b44a-fa96ef59450f","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--615fc1ae-12a0-5ff8-8477-443b6d5c2e34","target_ref":"attack-pattern--3e3ccae6-7ca3-5682-9d01-d364e8be12d1"},{"type":"relationship","spec_version":"2.1","id":"relationship--21598977-ed13-5061-9dc7-6c5e653d08a0","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--615fc1ae-12a0-5ff8-8477-443b6d5c2e34","target_ref":"attack-pattern--39ae0e3b-6efb-53c5-b20a-a3e9df17792e"},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--925e3522-2ead-52ba-804e-869011f89358","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","name":"MITRE Technique T1615: GROUP POLICY DISCOVERY","external_references":[{"source_name":"mitre-attack","external_id":"T1615: GROUP POLICY DISCOVERY","url":"https://attack.mitre.org/techniques/T1615: GROUP POLICY DISCOVERY"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--bddf11fd-6e9c-5d27-a0b8-b26586c473a8","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--615fc1ae-12a0-5ff8-8477-443b6d5c2e34","target_ref":"attack-pattern--925e3522-2ead-52ba-804e-869011f89358"},{"type":"relationship","spec_version":"2.1","id":"relationship--17b93228-1a66-535a-a5f8-b367d0928de6","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--615fc1ae-12a0-5ff8-8477-443b6d5c2e34","target_ref":"attack-pattern--815dad65-a680-5efd-8c47-bbadc55751a9"},{"type":"relationship","spec_version":"2.1","id":"relationship--ae0ccb14-07aa-5ed6-b342-9f28e1b5e7ef","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--615fc1ae-12a0-5ff8-8477-443b6d5c2e34","target_ref":"attack-pattern--0018c874-d41e-53f3-8a5f-018309837885"},{"type":"relationship","spec_version":"2.1","id":"relationship--e5d0a0e7-26f9-55ff-bd98-0687e4151f9c","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--615fc1ae-12a0-5ff8-8477-443b6d5c2e34","target_ref":"attack-pattern--588af274-513e-5b1d-beb7-def5ffba4a3e"},{"type":"relationship","spec_version":"2.1","id":"relationship--aafa1b9f-2032-5284-8733-4609e746c5eb","created":"2024-01-01T00:00:00Z","modified":"2024-01-01T00:00:00Z","relationship_type":"uses","source_ref":"threat-actor--615fc1ae-12a0-5ff8-8477-443b6d5c2e34","target_ref":"attack-pattern--bdf5a886-0eec-594a-a43c-32b09b390ccb"},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--1fd44b16-bbb2-56bd-942c-6e9e735ca66e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Toufan","description":"Ransomware cartel / extortion group 'toufan' monitored by CTI.FYI.","aliases":["toufan"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/toufan.html","description":"CTI.FYI Dossier for toufan"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3737abd5-170b-56ee-b051-0b8c58ec255d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Tridentlocker","description":"Ransomware cartel / extortion group 'tridentlocker' monitored by CTI.FYI.","aliases":["tridentlocker"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/tridentlocker.html","description":"CTI.FYI Dossier for tridentlocker"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--9175190d-2368-5b90-97ec-6f75142f271e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Trigona","description":"Ransomware cartel / extortion group 'trigona' monitored by CTI.FYI.","aliases":["trigona"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/trigona.html","description":"CTI.FYI Dossier for trigona"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--9c069a62-8197-5d32-9c4d-e350e11020e0","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Trinity","description":"Ransomware cartel / extortion group 'trinity' monitored by CTI.FYI.","aliases":["trinity"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/trinity.html","description":"CTI.FYI Dossier for trinity"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--f9c096c0-a244-5955-9eae-11f68f33231f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Trisec","description":"Ransomware cartel / extortion group 'trisec' monitored by CTI.FYI.","aliases":["trisec"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/trisec.html","description":"CTI.FYI Dossier for trisec"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--63ce0e93-74a4-5ed3-8200-115283fff4c6","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"U-Bomb","description":"Ransomware cartel / extortion group 'u-bomb' monitored by CTI.FYI.","aliases":["u-bomb"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/u-bomb.html","description":"CTI.FYI Dossier for u-bomb"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b3963682-998c-54f2-aa2c-c7da0bf999a1","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Underground","description":"Ransomware cartel / extortion group 'underground' monitored by CTI.FYI.","aliases":["underground","team underground"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/underground.html","description":"CTI.FYI Dossier for underground"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c85c5f52-de9f-5012-9427-310ee8d9d9e9","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Unknown","description":"Ransomware cartel / extortion group 'unknown' monitored by CTI.FYI.","aliases":["unknown"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/unknown.html","description":"CTI.FYI Dossier for unknown"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--262faa3b-70ae-5a4a-8f69-87db813503eb","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Unsafe","description":"Ransomware cartel / extortion group 'unsafe' monitored by CTI.FYI.","aliases":["unsafe"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/unsafe.html","description":"CTI.FYI Dossier for unsafe"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--df68b3bf-4ccc-5992-94b4-144c397b2601","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Valencialeaks","description":"Ransomware cartel / extortion group 'ValenciaLeaks' monitored by CTI.FYI.","aliases":["ValenciaLeaks"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/valencialeaks.html","description":"CTI.FYI Dossier for ValenciaLeaks"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--f05d9da8-d608-5638-9a19-1f211e00d4c3","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Vanhelsing","description":"Ransomware cartel / extortion group 'VanHelsing' monitored by CTI.FYI.","aliases":["VanHelsing"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/vanhelsing.html","description":"CTI.FYI Dossier for VanHelsing"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--662335b6-3701-58f1-b5b8-b9a073a583ac","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Vanirgroup","description":"Ransomware cartel / extortion group 'vanirgroup' monitored by CTI.FYI.","aliases":["vanirgroup"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/vanirgroup.html","description":"CTI.FYI Dossier for vanirgroup"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c3978f1a-b7ae-5a30-91a7-833199bfa826","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Vect","description":"Ransomware cartel / extortion group 'vect' monitored by CTI.FYI.","aliases":["vect"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/vect.html","description":"CTI.FYI Dossier for vect"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--51a2c332-5da6-5afb-a4e0-e5f1cefc9f11","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Vendetta","description":"Ransomware cartel / extortion group 'vendetta' monitored by CTI.FYI.","aliases":["vendetta"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/vendetta.html","description":"CTI.FYI Dossier for vendetta"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--40862beb-4c6a-5a8c-9150-49aafb0d097d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Vfokx","description":"Ransomware cartel / extortion group 'vfokx' monitored by CTI.FYI.","aliases":["vfokx"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/vfokx.html","description":"CTI.FYI Dossier for vfokx"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--bc1015e2-5f93-5cfc-95e7-6008a85a056a","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Vicesociety","description":"Ransomware cartel / extortion group 'vicesociety' monitored by CTI.FYI.","aliases":["vicesociety"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/vicesociety.html","description":"CTI.FYI Dossier for vicesociety"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e736ae68-326c-545f-8fe3-31a37db2b6e0","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Walocker","description":"Ransomware cartel / extortion group 'walocker' monitored by CTI.FYI.","aliases":["walocker"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/walocker.html","description":"CTI.FYI Dossier for walocker"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--dfde5d4f-0800-587d-bda7-6a38e400c305","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Wannacry","description":"Ransomware cartel / extortion group 'wannacry' monitored by CTI.FYI.","aliases":["wannacry"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/wannacry.html","description":"CTI.FYI Dossier for wannacry"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c49490c4-5942-58b5-a701-721bf6b7a329","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Warlock","description":"Ransomware cartel / extortion group 'warlock' monitored by CTI.FYI.","aliases":["warlock"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/warlock.html","description":"CTI.FYI Dossier for warlock"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--40628ccf-7cc3-5ffb-95c1-321add6c4108","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Werewolves","description":"Ransomware cartel / extortion group 'werewolves' monitored by CTI.FYI.","aliases":["werewolves"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/werewolves.html","description":"CTI.FYI Dossier for werewolves"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--49a344f1-7136-5efa-a76c-80b0d95c3435","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Weyhro","description":"Appears to be a Data Extortion group with no encryption.","aliases":["weyhro"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/weyhro.html","description":"CTI.FYI Dossier for weyhro"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--ad3cbca0-bc2f-5592-840c-e2896445be73","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Worldleaks","description":"Ransomware cartel / extortion group 'worldleaks' monitored by CTI.FYI.","aliases":["worldleaks"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/worldleaks.html","description":"CTI.FYI Dossier for worldleaks"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--4e509e62-0dcd-5cae-982d-bd3d4e224b18","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"X001Xs","description":"Ransomware cartel / extortion group 'x001xs' monitored by CTI.FYI.","aliases":["x001xs"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/x001xs.html","description":"CTI.FYI Dossier for x001xs"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--66c22c66-b13f-5ea2-a36b-5e0a6cc60961","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Xinglocker","description":"Ransomware cartel / extortion group 'xinglocker' monitored by CTI.FYI.","aliases":["xinglocker"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/xinglocker.html","description":"CTI.FYI Dossier for xinglocker"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--142b220f-c6bf-5a60-8453-1f7b780bb8e4","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Xinof","description":"Ransomware cartel / extortion group 'xinof' monitored by CTI.FYI.","aliases":["xinof"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/xinof.html","description":"CTI.FYI Dossier for xinof"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--6e70cb87-68e4-54f5-922a-7c08775ccccf","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Xp95","description":"Ransomware cartel / extortion group 'xp95' monitored by CTI.FYI.","aliases":["xp95"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/xp95.html","description":"CTI.FYI Dossier for xp95"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3c195c60-e5e6-5fd0-b797-7fc685e5ba26","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Yanluowang","description":"Ransomware cartel / extortion group 'yanluowang' monitored by CTI.FYI.","aliases":["yanluowang"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/yanluowang.html","description":"CTI.FYI Dossier for yanluowang"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--5ebf6fd3-7106-59c1-b633-ff1e4c354f16","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Yurei","description":"Ransomware cartel / extortion group 'yurei' monitored by CTI.FYI.","aliases":["yurei"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/yurei.html","description":"CTI.FYI Dossier for yurei"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d6ce5c45-282f-5cbf-be4c-ae892d1049b7","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Zeon","description":"Ransomware cartel / extortion group 'zeon' monitored by CTI.FYI.","aliases":["zeon"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/zeon.html","description":"CTI.FYI Dossier for zeon"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--2124c01d-6887-500e-a0d5-01b3c98b95dd","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Zerolockersec","description":"Ransomware cartel / extortion group 'zerolockersec' monitored by CTI.FYI.","aliases":["zerolockersec"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/zerolockersec.html","description":"CTI.FYI Dossier for zerolockersec"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--1f232713-6e32-57df-8e8a-faf2137c42eb","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Zerotolerance","description":"Ransomware cartel / extortion group 'zerotolerance' monitored by CTI.FYI.","aliases":["zerotolerance"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/zerotolerance.html","description":"CTI.FYI Dossier for zerotolerance"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--afa258d7-5ba4-5181-aabd-fad553c001c4","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Alp-001","description":"Ransomware cartel / extortion group 'ALP-001' monitored by CTI.FYI.","aliases":["ALP-001"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/alp-001.html","description":"CTI.FYI Dossier for ALP-001"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--86bbf804-7819-50bb-ad8f-d95d07f7bd58","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Netrunner","description":"Ransomware cartel / extortion group 'netrunner' monitored by CTI.FYI.","aliases":["netrunner"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/netrunner.html","description":"CTI.FYI Dossier for netrunner"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--2c48fe0d-cdbe-5734-ad62-42ecb3e27627","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Krybit","description":"Ransomware cartel / extortion group 'krybit' monitored by CTI.FYI.","aliases":["krybit"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/krybit.html","description":"CTI.FYI Dossier for krybit"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--cd7ea2bc-26b6-5f74-b5b6-7fc1da4ffd2e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Auditteam","description":"Ransomware cartel / extortion group 'AuditTeam' monitored by CTI.FYI.","aliases":["AuditTeam","audit team"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/auditteam.html","description":"CTI.FYI Dossier for AuditTeam"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--36b5f420-f618-5f34-83ea-bbc5f5b98580","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Timc","description":"Ransomware cartel / extortion group 'TiMc' monitored by CTI.FYI.","aliases":["TiMc"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/timc.html","description":"CTI.FYI Dossier for TiMc"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--40117130-19e2-5314-8d1e-0fa40d5ebab3","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Blackwater","description":"Ransomware cartel / extortion group 'blackwater' monitored by CTI.FYI.","aliases":["blackwater"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/blackwater.html","description":"CTI.FYI Dossier for blackwater"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--28dc1d7b-3642-5616-a66d-9ae228feff58","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Lamashtu","description":"Ransomware cartel / extortion group 'lamashtu' monitored by CTI.FYI.","aliases":["lamashtu"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/lamashtu.html","description":"CTI.FYI Dossier for lamashtu"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--de379f95-049f-5ed2-8050-336de945b066","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"M3Rx","description":"Ransomware cartel / extortion group 'm3rx' monitored by CTI.FYI.","aliases":["m3rx"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/m3rx.html","description":"CTI.FYI Dossier for m3rx"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e6361d0a-0132-5091-8c65-965b024e655f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Aurora","description":"Typical ransom software, Aurora virus plays the role of blackmailing PC operators. It encrypts files and the encryption cipher it uses is pretty strong. After encryption, the virus attaches .aurora at the end of the file names that makes it impossible to open the data. Thereafter, it dispatches the ransom note totaling 6 copies, without any change to the main objective i.e., victims must write an electronic mail addressed to anonimus.mr@yahoo.com while stay connected until the criminals reply telling the ransom amount.","aliases":["aurora","Aurora Ransomware","Zorro Ransomware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/aurora.html","description":"CTI.FYI Dossier for aurora"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--46d831dd-4270-5bcb-ad0f-18be006ddd15","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Cmdorganization","description":"Ransomware cartel / extortion group 'CMDOrganization' monitored by CTI.FYI.","aliases":["CMDOrganization"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/cmdorganization.html","description":"CTI.FYI Dossier for CMDOrganization"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--74265ec1-48c7-577b-aa58-395041480d61","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Fulcrumsec","description":"Ransomware cartel / extortion group 'fulcrumsec' monitored by CTI.FYI.","aliases":["fulcrumsec"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/fulcrumsec.html","description":"CTI.FYI Dossier for fulcrumsec"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--69a58fc5-1975-5880-951e-b7a52d8ac56c","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Mnt6","description":"Ransomware cartel / extortion group 'mnt6' monitored by CTI.FYI.","aliases":["mnt6"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/mnt6.html","description":"CTI.FYI Dossier for mnt6"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--a1aeb35a-9c82-5bca-ad09-73c2f3d6a847","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Loki","description":"Ransomware cartel / extortion group 'Loki' monitored by CTI.FYI.","aliases":["Loki"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/loki.html","description":"CTI.FYI Dossier for Loki"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--1a22c0d1-f040-5f96-8375-28e6348edf58","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Prinzeugen","description":"Ransomware cartel / extortion group 'PrinzEugen' monitored by CTI.FYI.","aliases":["PrinzEugen"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/prinzeugen.html","description":"CTI.FYI Dossier for PrinzEugen"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--6ba2fec7-956d-5eec-9791-232a6d516637","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Esxiargs","description":"Ransomware cartel / extortion group 'esxiargs' monitored by CTI.FYI.","aliases":["esxiargs"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/esxiargs.html","description":"CTI.FYI Dossier for esxiargs"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--7a41aa13-d6aa-57d0-a9a0-8e4e340b1025","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Bavacai","description":"Ransomware cartel / extortion group 'Bavacai' monitored by CTI.FYI.","aliases":["Bavacai"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/bavacai.html","description":"CTI.FYI Dossier for Bavacai"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--fc8a4914-6413-5b97-86bd-1420f148170f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Icarus","description":"Ransomware cartel / extortion group 'Icarus' monitored by CTI.FYI.","aliases":["Icarus"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/icarus.html","description":"CTI.FYI Dossier for Icarus"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--43a564e3-3101-5d16-bddd-48a2867adf4d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Leakbazaar","description":"Ransomware cartel / extortion group 'LeakBazaar' monitored by CTI.FYI.","aliases":["LeakBazaar"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/leakbazaar.html","description":"CTI.FYI Dossier for LeakBazaar"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--107b5853-25eb-5e9b-943f-7717a790af3d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Payday","description":"Ransomware cartel / extortion group 'Payday' monitored by CTI.FYI.","aliases":["Payday"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/payday.html","description":"CTI.FYI Dossier for Payday"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--f4571bca-7859-5eaa-97d9-5f26cce7e718","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"0Day Syndicate","description":"Ransomware cartel / extortion group '0day Syndicate' monitored by CTI.FYI.","aliases":["0day Syndicate"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/0day-syndicate.html","description":"CTI.FYI Dossier for 0day Syndicate"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--41f8c7c6-7ab8-50b4-b7bf-be146adf4214","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Titan","description":"Ransomware cartel / extortion group 'titan' monitored by CTI.FYI.","aliases":["titan"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/titan.html","description":"CTI.FYI Dossier for titan"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--7b0c111e-8b07-5b7e-a0ed-7812c0820bd4","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Black X","description":"Ransomware cartel / extortion group 'Black X' monitored by CTI.FYI.","aliases":["Black X"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/black-x.html","description":"CTI.FYI Dossier for Black X"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--73a9a0d8-e00e-5bf1-8f6c-4b0041ccbd2f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Deadlock","description":"Ransomware cartel / extortion group 'Deadlock' monitored by CTI.FYI.","aliases":["Deadlock"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/deadlock.html","description":"CTI.FYI Dossier for Deadlock"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--a1a33fb2-d6ad-5808-9753-1e1afe9819ea","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Triple X","description":"Ransomware cartel / extortion group 'Triple X' monitored by CTI.FYI.","aliases":["Triple X"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/triple-x.html","description":"CTI.FYI Dossier for Triple X"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--2c865c17-a211-5293-b724-53f0f98e4ba4","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Sevyware","description":"Ransomware cartel / extortion group 'SevyWare' monitored by CTI.FYI.","aliases":["SevyWare"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/sevyware.html","description":"CTI.FYI Dossier for SevyWare"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--8c3a9024-3152-5487-94ee-f1c2d8b7daf7","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Blackfield","description":"Ransomware cartel / extortion group 'Blackfield' monitored by CTI.FYI.","aliases":["Blackfield"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/blackfield.html","description":"CTI.FYI Dossier for Blackfield"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b5b73b38-a5d8-5cd5-811a-089e1a2f829a","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Redact","description":"Ransomware cartel / extortion group 'Redact' monitored by CTI.FYI.","aliases":["Redact"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/redact.html","description":"CTI.FYI Dossier for Redact"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Wallstreet","description":"Ransomware cartel / extortion group 'Wallstreet' monitored by CTI.FYI.","aliases":["Wallstreet"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/wallstreet.html","description":"CTI.FYI Dossier for Wallstreet"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--1161ca7a-51fe-52ea-a6cd-2632455087be","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Settra","description":"Ransomware cartel / extortion group 'settra' monitored by CTI.FYI.","aliases":["settra"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/settra.html","description":"CTI.FYI Dossier for settra"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c83e4a5f-7405-5fe0-829c-9fcd6983d2a1","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Booba Project","description":"Ransomware cartel / extortion group 'Booba Project' monitored by CTI.FYI.","aliases":["Booba Project"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/booba-project.html","description":"CTI.FYI Dossier for Booba Project"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--48d888c6-2d00-5fc4-81b2-99fab543e98f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Doommageddon","description":"Ransomware cartel / extortion group 'Doommageddon' monitored by CTI.FYI.","aliases":["Doommageddon"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/doommageddon.html","description":"CTI.FYI Dossier for Doommageddon"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--4036ae18-a9ae-5617-a2b0-7bdb6304751e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Crpxo","description":"Ransomware cartel / extortion group 'CRPxO' monitored by CTI.FYI.","aliases":["CRPxO"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/crpxo.html","description":"CTI.FYI Dossier for CRPxO"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--6be8bbb3-cf13-5f60-bbf8-2b6eee9dfbd6","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"D1R","description":"Ransomware cartel / extortion group 'D1R' monitored by CTI.FYI.","aliases":["D1R"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/d1r.html","description":"CTI.FYI Dossier for D1R"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--f81e246d-67ea-5dd3-8606-f67ffc3d0293","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"The Syndicate","description":"Ransomware cartel / extortion group 'The Syndicate' monitored by CTI.FYI.","aliases":["The Syndicate"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/the-syndicate.html","description":"CTI.FYI Dossier for The Syndicate"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--80a0f9ba-ea4a-56cb-a0a8-74e37c0a2c6b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"The Green Blood Group","description":"Ransomware cartel / extortion group 'The Green Blood Group' monitored by CTI.FYI.","aliases":["The Green Blood Group"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/the-green-blood-group.html","description":"CTI.FYI Dossier for The Green Blood Group"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--220ed14c-f5cc-5c2e-8869-841226eb32f8","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ulose","description":"Ransomware cartel / extortion group 'ULose' monitored by CTI.FYI.","aliases":["ULose"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ulose.html","description":"CTI.FYI Dossier for ULose"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c7e1965d-8a6a-5fca-b6b2-6b7549cecd84","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Darkmatter","description":"Ransomware cartel / extortion group 'DarkMatter' monitored by CTI.FYI.","aliases":["DarkMatter"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/darkmatter.html","description":"CTI.FYI Dossier for DarkMatter"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--f2bfdfb3-12b1-5023-a8f3-45ed2c1ac31d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Tommyleaks","description":"Ransomware cartel / extortion group 'Tommyleaks' monitored by CTI.FYI.","aliases":["Tommyleaks"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/tommyleaks.html","description":"CTI.FYI Dossier for Tommyleaks"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e2418d97-e8cf-506d-b68b-bb0d7be74970","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Mortar","description":"Ransomware cartel / extortion group 'mortar' monitored by CTI.FYI.","aliases":["mortar"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/mortar.html","description":"CTI.FYI Dossier for mortar"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--fa528e38-1442-591e-86bc-d7173d867119","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Nblock","description":"Ransomware cartel / extortion group 'nblock' monitored by CTI.FYI.","aliases":["nblock"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/nblock.html","description":"CTI.FYI Dossier for nblock"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--20a41410-8341-5da6-beb3-b1ab9d0b7478","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Exfilsquad","description":"Ransomware cartel / extortion group 'ExfilSquad' monitored by CTI.FYI.","aliases":["ExfilSquad"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/exfilsquad.html","description":"CTI.FYI Dossier for ExfilSquad"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b32cb61b-df5e-5e13-a0ef-3ff18cbba65a","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Orova","description":"Ransomware cartel / extortion group 'Orova' monitored by CTI.FYI.","aliases":["Orova"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/orova.html","description":"CTI.FYI Dossier for Orova"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c4ed5008-7494-5b93-b517-8a318b0bf69a","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Global Secret Group","description":"Not a RaaS yet.","aliases":["Global Secret Group","global"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/global-secret-group.html","description":"CTI.FYI Dossier for Global Secret Group"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--cada1c48-3fa7-5b86-8bb2-093be49a850f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Goddamn Ransomwhere","description":"Ransomware cartel / extortion group 'GodDamn ransomwhere' monitored by CTI.FYI.","aliases":["GodDamn ransomwhere"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/goddamn-ransomwhere.html","description":"CTI.FYI Dossier for GodDamn ransomwhere"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--0fa5307d-befa-5b80-8c13-9389beccf2a6","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Section9","description":"Ransomware cartel / extortion group 'Section9' monitored by CTI.FYI.","aliases":["Section9"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/section9.html","description":"CTI.FYI Dossier for Section9"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--6fe97be3-3ebf-5905-b10c-cb0d0ca3f7ea","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Shiba","description":"Ransomware cartel / extortion group 'Shiba' monitored by CTI.FYI.","aliases":["Shiba"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/shiba.html","description":"CTI.FYI Dossier for Shiba"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--319c8477-1fed-55cd-a0e3-dbe9ebd5213b","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Aptlock","description":"Ransomware cartel / extortion group 'Aptlock' monitored by CTI.FYI.","aliases":["Aptlock"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/aptlock.html","description":"CTI.FYI Dossier for Aptlock"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e707ca5f-40d8-5987-bfd7-0e579a8e8cdd","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Notpetya","description":"Ransomware cartel / extortion group 'NotPetya' monitored by CTI.FYI.","aliases":["NotPetya"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/notpetya.html","description":"CTI.FYI Dossier for NotPetya"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--4b0edf93-f829-50a6-b776-47196d23888d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Gammax","description":"Ransomware cartel / extortion group 'Gammax' monitored by CTI.FYI.","aliases":["Gammax"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/gammax.html","description":"CTI.FYI Dossier for Gammax"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--630da242-8e2d-5710-ae7c-407f35619795","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Dark Project","description":"Ransomware cartel / extortion group 'Dark Project' monitored by CTI.FYI.","aliases":["Dark Project"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/dark-project.html","description":"CTI.FYI Dossier for Dark Project"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3ff6da47-936d-50f7-8447-86404d1675be","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Barracuda","description":"Ransomware cartel / extortion group 'Barracuda' monitored by CTI.FYI.","aliases":["Barracuda"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/barracuda.html","description":"CTI.FYI Dossier for Barracuda"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--f96931d8-55f7-5f10-b5ef-5970988835a4","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Helix","description":"Ransomware cartel / extortion group 'Helix' monitored by CTI.FYI.","aliases":["Helix"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/helix.html","description":"CTI.FYI Dossier for Helix"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--04ec87af-e404-56eb-a1b4-4e89b7b472fe","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"L Group","description":"Ransomware cartel / extortion group 'L Group' monitored by CTI.FYI.","aliases":["L Group"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/l-group.html","description":"CTI.FYI Dossier for L Group"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--aa63a7c2-b7a2-53f4-8209-c76e45d1b663","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Panzer","description":"Ransomware cartel / extortion group 'Panzer' monitored by CTI.FYI.","aliases":["Panzer"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/panzer.html","description":"CTI.FYI Dossier for Panzer"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--410ada0c-ff4a-5ab5-8b42-3f1c7c23b6be","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Storm","description":"ransomware","aliases":["Storm"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/storm.html","description":"CTI.FYI Dossier for Storm"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--1c92b990-7d8f-5bd6-85e5-ff5a6c95e076","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Sovcali","description":"Ransomware cartel / extortion group 'Sovcali' monitored by CTI.FYI.","aliases":["Sovcali"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/sovcali.html","description":"CTI.FYI Dossier for Sovcali"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--8363ac67-854b-5be6-975e-0f003b5bbc5e","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Eclipse","description":"Ransomware cartel / extortion group 'Eclipse' monitored by CTI.FYI.","aliases":["Eclipse"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/eclipse.html","description":"CTI.FYI Dossier for Eclipse"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--34221ba3-936e-50ef-a0ee-676bb412a537","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Emperador","description":"Ransomware cartel / extortion group 'Emperador' monitored by CTI.FYI.","aliases":["Emperador"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/emperador.html","description":"CTI.FYI Dossier for Emperador"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--f401fa3e-cb8c-5e1c-a6ce-dc97b4c161ce","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Ethics","description":"Ransomware cartel / extortion group 'Ethics' monitored by CTI.FYI.","aliases":["Ethics"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/ethics.html","description":"CTI.FYI Dossier for Ethics"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b40019d5-9647-5f85-b4f1-100eba32c464","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Majinahanashi","description":"Ransomware cartel / extortion group 'Majinahanashi' monitored by CTI.FYI.","aliases":["Majinahanashi"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/majinahanashi.html","description":"CTI.FYI Dossier for Majinahanashi"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3e4613fb-f491-5d76-8d12-d78c332aab8f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Montage","description":"Ransomware cartel / extortion group 'Montage' monitored by CTI.FYI.","aliases":["Montage"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/montage.html","description":"CTI.FYI Dossier for Montage"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--768a8db7-4147-5bf5-af87-af2646ec2e40","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Bluewhale","description":"Ransomware cartel / extortion group 'BlueWhale' monitored by CTI.FYI.","aliases":["BlueWhale"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/bluewhale.html","description":"CTI.FYI Dossier for BlueWhale"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--224c5a0a-54f1-5bca-890b-a62d11c925f7","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Xpl0Itrs","description":"Ransomware cartel / extortion group 'xpl0itrs' monitored by CTI.FYI.","aliases":["xpl0itrs"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/xpl0itrs.html","description":"CTI.FYI Dossier for xpl0itrs"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--19127818-ff2a-5bef-a11d-1281ad3f56a6","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Dysphor1A","description":"Ransomware cartel / extortion group 'DYSPHOR1A' monitored by CTI.FYI.","aliases":["DYSPHOR1A"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/dysphor1a.html","description":"CTI.FYI Dossier for DYSPHOR1A"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--00cc282b-2f8d-53cf-897c-d80f676577dc","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Iah6477","description":"Ransomware cartel / extortion group 'iah6477' monitored by CTI.FYI.","aliases":["iah6477"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/iah6477.html","description":"CTI.FYI Dossier for iah6477"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--40cb8ce8-659d-5bac-8c40-7513c612f0a2","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Bolt Team","description":"Ransomware cartel / extortion group 'Bolt Team' monitored by CTI.FYI.","aliases":["Bolt Team"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/bolt-team.html","description":"CTI.FYI Dossier for Bolt Team"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--c86f87d3-4236-52f1-b978-39f67116c3f3","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Falcon","description":"Ransomware cartel / extortion group 'Falcon' monitored by CTI.FYI.","aliases":["Falcon"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/falcon.html","description":"CTI.FYI Dossier for Falcon"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--9602bb8b-5949-50f1-81dc-ebbaaf467637","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Meowciety403","description":"Ransomware cartel / extortion group 'Meowciety403' monitored by CTI.FYI.","aliases":["Meowciety403"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/meowciety403.html","description":"CTI.FYI Dossier for Meowciety403"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--a7c2b514-e791-50d9-9089-288e846370ea","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Zawoo","description":"Ransomware cartel / extortion group 'ZaWoo' monitored by CTI.FYI.","aliases":["ZaWoo"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/zawoo.html","description":"CTI.FYI Dossier for ZaWoo"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--11f62186-d1ed-551b-9f18-78fb1193ee72","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Vexy Ransomware","description":"Ransomware cartel / extortion group 'Vexy Ransomware' monitored by CTI.FYI.","aliases":["Vexy Ransomware"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/vexy-ransomware.html","description":"CTI.FYI Dossier for Vexy Ransomware"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--2f052a1b-e94d-5c12-8ce3-e76db32d9d31","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Blacklocks","description":"Ransomware cartel / extortion group 'BlackLocks' monitored by CTI.FYI.","aliases":["BlackLocks"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/blacklocks.html","description":"CTI.FYI Dossier for BlackLocks"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--7de5a2b4-ea7a-51b7-a559-942eae77ce60","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Galago","description":"Ransomware cartel / extortion group 'Galago' monitored by CTI.FYI.","aliases":["Galago"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/galago.html","description":"CTI.FYI Dossier for Galago"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--2bb9fa35-51f7-5cb0-b506-aebb8af2fea1","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Endzone","description":"Ransomware cartel / extortion group 'EndZone' monitored by CTI.FYI.","aliases":["EndZone"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/endzone.html","description":"CTI.FYI Dossier for EndZone"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"N0N","description":"Ransomware cartel / extortion group 'N0n' monitored by CTI.FYI.","aliases":["N0n"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/n0n.html","description":"CTI.FYI Dossier for N0n"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b1c5d1b4-e6ea-57c2-8d44-5a272215270f","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Spirals","description":"Ransomware cartel / extortion group 'Spirals' monitored by CTI.FYI.","aliases":["Spirals"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/spirals.html","description":"CTI.FYI Dossier for Spirals"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--93ffb60b-181a-5584-882a-931f8574e5f1","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Cyberleek","description":"Ransomware cartel / extortion group 'Cyberleek' monitored by CTI.FYI.","aliases":["Cyberleek"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/cyberleek.html","description":"CTI.FYI Dossier for Cyberleek"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--d16987a5-c72d-53a9-882d-24498b09e4b4","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Imnotavillain","description":"Ransomware cartel / extortion group 'ImNotAVillain' monitored by CTI.FYI.","aliases":["ImNotAVillain"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/imnotavillain.html","description":"CTI.FYI Dossier for ImNotAVillain"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--ee685e5d-9779-58cc-a31d-67574c701230","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Владивосток","description":"Ransomware cartel / extortion group 'Владивосток' monitored by CTI.FYI.","aliases":["Владивосток"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/владивосток.html","description":"CTI.FYI Dossier for Владивосток"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--bd7d771f-cda8-530b-8f3f-13709e27fde5","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Byod","description":"Ransomware cartel / extortion group 'BYOD' monitored by CTI.FYI.","aliases":["BYOD"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/byod.html","description":"CTI.FYI Dossier for BYOD"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--09834e7e-84d0-5623-8807-b7436667910d","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Umbra","description":"Ransomware cartel / extortion group 'UmBra' monitored by CTI.FYI.","aliases":["UmBra"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/umbra.html","description":"CTI.FYI Dossier for UmBra"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--b9b00203-b896-59db-9cc4-25fc25b500af","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Vypr","description":"Ransomware cartel / extortion group 'VYPR' monitored by CTI.FYI.","aliases":["VYPR"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/vypr.html","description":"CTI.FYI Dossier for VYPR"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--e97844ec-1e4d-52a2-9046-8568b6c82243","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Scarlettgroup","description":"Ransomware cartel / extortion group 'Scarlettgroup' monitored by CTI.FYI.","aliases":["Scarlettgroup"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/scarlettgroup.html","description":"CTI.FYI Dossier for Scarlettgroup"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--f990530f-0e8a-59f1-9889-fdcb91c25ba9","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"Hyflock","description":"Ransomware cartel / extortion group 'HYFLOCK' monitored by CTI.FYI.","aliases":["HYFLOCK"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/hyflock.html","description":"CTI.FYI Dossier for HYFLOCK"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--74758428-a610-5ce8-a1aa-e76703530381","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"0X00","description":"Ransomware cartel / extortion group '0x00' monitored by CTI.FYI.","aliases":["0x00"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/0x00.html","description":"CTI.FYI Dossier for 0x00"}]},{"type":"threat-actor","spec_version":"2.1","id":"threat-actor--3a23ba01-63db-51bf-bec1-e1ae51a08ed8","created":"2024-01-01T00:00:00Z","modified":"2026-10-18T22:37:16Z","created_by_ref":"identity--abaa06f7-d65e-5896-aadc-34ca42ca5538","name":"The Seven Deadly Sins","description":"Ransomware cartel / extortion group 'THE SEVEN DEADLY SINS' monitored by CTI.FYI.","aliases":["THE SEVEN DEADLY SINS"],"threat_actor_types":["ransomware-operator"],"resource_level":"cartel","primary_motivation":"financial-gain","external_references":[{"source_name":"cti-fyi","url":"https://cti.fyi/groups/the-seven-deadly-sins.html","description":"CTI.FYI Dossier for THE SEVEN DEADLY SINS"}]},{"type":"identity","spec_version":"2.1","id":"identity--2d87aed5-2ccd-53c2-b797-af7ef6c2927e","created":"2026-10-18T22:06:43Z","modified":"2026-10-18T22:06:43Z","name":"Amagi Media Labs","identity_class":"organization","sectors":["media-entertainment"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--ec421f03-92ea-5b23-9631-fee68c9ae2ff","created":"2026-10-18T22:06:43Z","modified":"2026-10-18T22:06:43Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--2d87aed5-2ccd-53c2-b797-af7ef6c2927e","start_time":"2026-10-18T22:06:43Z","description":"Ransomware claim against Amagi Media Labs by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#amagi-media-labs","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--7c51c21f-12a2-5087-b057-feb2f9bc4e4f","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","name":"Troutman Pepper Locke","identity_class":"organization","sectors":["legal"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--1f6b6929-bb8b-5d38-9c76-65e49a9e6ff6","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","relationship_type":"targets","source_ref":"threat-actor--bf60f278-0036-5d27-b97f-82426c49dc93","target_ref":"identity--7c51c21f-12a2-5087-b057-feb2f9bc4e4f","start_time":"2026-10-18T22:05:21Z","description":"Ransomware claim against Troutman Pepper Locke by silentransomgroup.","external_references":[{"source_name":"silentransomgroup","url":"https://business-data-leaks.com/about#leak-troutman-pepper-locke","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--60fd9f25-c62a-59bf-ba0d-e7cac39b5dcc","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","name":"Sheppard, Mullin, Richter & Hampton","identity_class":"organization","sectors":["legal"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--e9567f93-e153-55be-8955-eb6e25dd1cf8","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","relationship_type":"targets","source_ref":"threat-actor--bf60f278-0036-5d27-b97f-82426c49dc93","target_ref":"identity--60fd9f25-c62a-59bf-ba0d-e7cac39b5dcc","start_time":"2026-10-18T22:05:21Z","description":"Ransomware claim against Sheppard, Mullin, Richter & Hampton by silentransomgroup.","external_references":[{"source_name":"silentransomgroup","url":"https://business-data-leaks.com/about#leak-sheppard--mullin--richter---hampton","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--119077b5-9949-5433-9148-7cb2060d2427","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","name":"Riker Danzig Scherer Hyland & Perretti","identity_class":"organization","sectors":["professional-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--9123dfda-b135-5b29-815b-ecea098ab0c9","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","relationship_type":"targets","source_ref":"threat-actor--bf60f278-0036-5d27-b97f-82426c49dc93","target_ref":"identity--119077b5-9949-5433-9148-7cb2060d2427","start_time":"2026-10-18T22:05:21Z","description":"Ransomware claim against Riker Danzig Scherer Hyland & Perretti by silentransomgroup.","external_references":[{"source_name":"silentransomgroup","url":"https://business-data-leaks.com/about#leak-riker-danzig-scherer-hyland---perretti","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--06307df3-ec41-5784-b56f-038420cc2243","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","name":"Reminger Attorneys at Law","identity_class":"organization","sectors":["legal"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--57108b87-ffd7-5aa7-92f0-fc831859fb62","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","relationship_type":"targets","source_ref":"threat-actor--bf60f278-0036-5d27-b97f-82426c49dc93","target_ref":"identity--06307df3-ec41-5784-b56f-038420cc2243","start_time":"2026-10-18T22:05:21Z","description":"Ransomware claim against Reminger Attorneys at Law by silentransomgroup.","external_references":[{"source_name":"silentransomgroup","url":"https://business-data-leaks.com/about#leak-reminger","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--5d68d455-7939-50d7-9341-9bf902352ec9","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","name":"Nelson Mullins Riley & Scarborough","identity_class":"organization","sectors":["professional-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--244d0e06-fc8a-52a8-9383-7921c2543ec0","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","relationship_type":"targets","source_ref":"threat-actor--bf60f278-0036-5d27-b97f-82426c49dc93","target_ref":"identity--5d68d455-7939-50d7-9341-9bf902352ec9","start_time":"2026-10-18T22:05:21Z","description":"Ransomware claim against Nelson Mullins Riley & Scarborough by silentransomgroup.","external_references":[{"source_name":"silentransomgroup","url":"https://business-data-leaks.com/about#leak-nelson-mullins-riley---scarborough","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--4eb3c48a-3b2d-5f55-9b2a-7b0efbf30d19","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","name":"Cozen O'Connor","identity_class":"organization","sectors":["legal"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--cfe39d74-1939-52ac-8806-f4e946a15005","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","relationship_type":"targets","source_ref":"threat-actor--bf60f278-0036-5d27-b97f-82426c49dc93","target_ref":"identity--4eb3c48a-3b2d-5f55-9b2a-7b0efbf30d19","start_time":"2026-10-18T22:05:21Z","description":"Ransomware claim against Cozen O'Connor by silentransomgroup.","external_references":[{"source_name":"silentransomgroup","url":"https://business-data-leaks.com/about#leak-cozen-o-connor","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--0238b1b4-2b8a-535c-9724-6942e4641066","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","name":"Clark Hill","identity_class":"organization","sectors":["professional-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--e98356a5-c3ab-5b9d-b4a0-f10240fe31cf","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","relationship_type":"targets","source_ref":"threat-actor--bf60f278-0036-5d27-b97f-82426c49dc93","target_ref":"identity--0238b1b4-2b8a-535c-9724-6942e4641066","start_time":"2026-10-18T22:05:21Z","description":"Ransomware claim against Clark Hill by silentransomgroup.","external_references":[{"source_name":"silentransomgroup","url":"https://business-data-leaks.com/about#leak-clark-hill","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--8b4b9a3b-1ca1-588a-a516-8cafb0b3a9ac","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","name":"Andersen Group Inc.","identity_class":"organization","sectors":["manufacturing"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--1d311c60-d8bc-58c8-8b74-7548c01ceebb","created":"2026-10-18T22:05:21Z","modified":"2026-10-18T22:05:21Z","relationship_type":"targets","source_ref":"threat-actor--bf60f278-0036-5d27-b97f-82426c49dc93","target_ref":"identity--8b4b9a3b-1ca1-588a-a516-8cafb0b3a9ac","start_time":"2026-10-18T22:05:21Z","description":"Ransomware claim against Andersen Group Inc. by silentransomgroup.","external_references":[{"source_name":"silentransomgroup","url":"https://business-data-leaks.com/about#leak-andersen-group-inc","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--707a3da3-8bee-569a-92c1-732a234c3642","created":"2026-10-18T22:02:16Z","modified":"2026-10-18T22:02:16Z","name":"UNINTER","identity_class":"organization","sectors":["education"]},{"type":"relationship","spec_version":"2.1","id":"relationship--4d8d03ae-3787-5946-9ff5-3cc5f98fe458","created":"2026-10-18T22:02:16Z","modified":"2026-10-18T22:02:16Z","relationship_type":"targets","source_ref":"threat-actor--d6720056-f212-5b39-bee2-ee9ed5eced25","target_ref":"identity--707a3da3-8bee-569a-92c1-732a234c3642","start_time":"2026-10-18T22:02:16Z","description":"Ransomware claim against UNINTER by kazu.","external_references":[{"source_name":"kazu","url":"http://6czlbd2jfiy6765fbnbnzuwuqocg57ebvp3tbm35kib425k4qnmiiiqd.onion/ransom.html#uninter-distance-learning-education-platform","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--bcc8465b-52a5-5533-ba80-2d8f8b381f84","created":"2026-10-18T22:00:32Z","modified":"2026-10-18T22:00:32Z","name":"Thin Line Tech","identity_class":"organization","sectors":["technology"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--97feddf0-5f01-56ce-9991-c8742455bb59","created":"2026-10-18T22:00:32Z","modified":"2026-10-18T22:00:32Z","relationship_type":"targets","source_ref":"threat-actor--8a1e7911-f1cc-5bac-adfa-0b1f77c00b02","target_ref":"identity--bcc8465b-52a5-5533-ba80-2d8f8b381f84","start_time":"2026-10-18T22:00:32Z","description":"Ransomware claim against Thin Line Tech by abyss.","external_references":[{"source_name":"abyss","url":"http://3ev4metjirohtdpshsqlkrqcmxq6zu3d7obrdhglpy5jpbr7whmlfgqd.onion/#card-thinlinetech-com","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--3b7e1371-65b4-5f1d-bccc-6f6312299512","created":"2026-10-18T22:00:32Z","modified":"2026-10-18T22:00:32Z","name":"Technic Inc.","identity_class":"organization","sectors":["manufacturing"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--c342835d-c737-56f7-a0db-15f2f8f7bc14","created":"2026-10-18T22:00:32Z","modified":"2026-10-18T22:00:32Z","relationship_type":"targets","source_ref":"threat-actor--8a1e7911-f1cc-5bac-adfa-0b1f77c00b02","target_ref":"identity--3b7e1371-65b4-5f1d-bccc-6f6312299512","start_time":"2026-10-18T22:00:32Z","description":"Ransomware claim against Technic Inc. by abyss.","external_references":[{"source_name":"abyss","url":"http://3ev4metjirohtdpshsqlkrqcmxq6zu3d7obrdhglpy5jpbr7whmlfgqd.onion/#card-technic-com","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--4e31e8d3-5e96-5e9a-95fc-bafa42e222a8","created":"2026-10-18T22:00:32Z","modified":"2026-10-18T22:00:32Z","name":"Landkreis Limburg-Weilburg","identity_class":"organization","sectors":["government-public-sector"],"country":"DE"},{"type":"relationship","spec_version":"2.1","id":"relationship--a0adb647-8cec-56c7-9181-5b85786285a4","created":"2026-10-18T22:00:32Z","modified":"2026-10-18T22:00:32Z","relationship_type":"targets","source_ref":"threat-actor--8a1e7911-f1cc-5bac-adfa-0b1f77c00b02","target_ref":"identity--4e31e8d3-5e96-5e9a-95fc-bafa42e222a8","start_time":"2026-10-18T22:00:32Z","description":"Ransomware claim against Landkreis Limburg-Weilburg by abyss.","external_references":[{"source_name":"abyss","url":"http://3ev4metjirohtdpshsqlkrqcmxq6zu3d7obrdhglpy5jpbr7whmlfgqd.onion/#card-landkreis-limburg-weilburg-de","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--055a80d0-952f-5c4d-a5e6-f40020d79b90","created":"2026-10-18T20:06:56Z","modified":"2026-10-18T20:06:56Z","name":"Company #92","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--e954985f-3731-54e4-a9cd-218cdb651d90","created":"2026-10-18T20:06:56Z","modified":"2026-10-18T20:06:56Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--055a80d0-952f-5c4d-a5e6-f40020d79b90","start_time":"2026-10-18T20:06:56Z","description":"Ransomware claim against Company #92 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-92","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--89c75a5e-f16b-530e-916f-024f3d298b53","created":"2026-10-18T17:08:37Z","modified":"2026-10-18T17:08:37Z","name":"Telecom Egypt","identity_class":"organization","sectors":["telecommunications"],"country":"EG"},{"type":"relationship","spec_version":"2.1","id":"relationship--9d05b2cc-e7fd-5ef8-8987-bffde395fbd9","created":"2026-10-18T17:08:37Z","modified":"2026-10-18T17:08:37Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--89c75a5e-f16b-530e-916f-024f3d298b53","start_time":"2026-10-18T17:08:37Z","description":"Ransomware claim against Telecom Egypt by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#telecom-egypt","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--bf5e14a2-72d2-5f67-b871-f44e507a7d53","created":"2026-10-18T16:05:52Z","modified":"2026-10-18T16:05:52Z","name":"SMIC US Company","identity_class":"organization","sectors":["technology"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--105e008e-ee40-544d-9010-e76df117a6d1","created":"2026-10-18T16:05:52Z","modified":"2026-10-18T16:05:52Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--bf5e14a2-72d2-5f67-b871-f44e507a7d53","start_time":"2026-10-18T16:05:52Z","description":"Ransomware claim against SMIC US Company by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#smic-us-company-sunnyvale-ca-us-arm-of-semiconductor-manufac","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--de9744cd-b768-5900-bae4-6d47ea60d305","created":"2026-10-18T16:05:52Z","modified":"2026-10-18T16:05:52Z","name":"All Business Technologies (Fox Hill bookkeeping and tax practice)","identity_class":"organization","sectors":["professional-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--f094652d-35f7-53e6-8165-64b03e459a70","created":"2026-10-18T16:05:52Z","modified":"2026-10-18T16:05:52Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--de9744cd-b768-5900-bae4-6d47ea60d305","start_time":"2026-10-18T16:05:52Z","description":"Ransomware claim against All Business Technologies (Fox Hill bookkeeping and tax practice) by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#all-business-technologies-fox-hill-bookkeeping-and-tax-pract","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--1d11fc5b-267d-53f1-bcc7-ed3e2d4d517b","created":"2026-10-18T12:07:54Z","modified":"2026-10-18T12:07:54Z","name":"McKenney's","identity_class":"organization","sectors":["other"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--92506d98-425a-58db-adfc-2d653fe6ea6c","created":"2026-10-18T12:07:54Z","modified":"2026-10-18T12:07:54Z","relationship_type":"targets","source_ref":"threat-actor--00cc282b-2f8d-53cf-897c-d80f676577dc","target_ref":"identity--1d11fc5b-267d-53f1-bcc7-ed3e2d4d517b","start_time":"2026-10-18T12:07:54Z","description":"Ransomware claim against McKenney's by iah6477.","external_references":[{"source_name":"iah6477","url":"http://iah6477wcvisc45wl54u524fbrh4dnmtcctpg2fpe5epf3jbpkiwu4qd.onion/a/mckenneys","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--88913b6a-8de5-539a-92d0-db3ac5bd7126","created":"2026-10-18T08:08:57Z","modified":"2026-10-18T08:08:57Z","name":"Company #91","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--6f8e2568-149b-5e86-be99-9337afa40308","created":"2026-10-18T08:08:57Z","modified":"2026-10-18T08:08:57Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--88913b6a-8de5-539a-92d0-db3ac5bd7126","start_time":"2026-10-18T08:08:57Z","description":"Ransomware claim against Company #91 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-91","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--e27f7aca-12da-5782-9377-aacaf57ec99c","created":"2026-10-18T17:08:05Z","modified":"2026-10-18T17:08:05Z","name":"Luzco Ilumination","identity_class":"organization","sectors":["professional-services"],"country":"ES"},{"type":"relationship","spec_version":"2.1","id":"relationship--6339e401-f0ad-5506-a05c-bc513a035140","created":"2026-10-18T06:40:00Z","modified":"2026-10-18T17:08:05Z","relationship_type":"targets","source_ref":"threat-actor--34221ba3-936e-50ef-a0ee-676bb412a537","target_ref":"identity--e27f7aca-12da-5782-9377-aacaf57ec99c","start_time":"2026-10-18T06:40:00Z","description":"Ransomware claim against Luzco Ilumination by emperador.","external_references":[{"source_name":"emperador","url":"http://emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion/post/luzco-ilumination","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--45731320-1fd0-549f-b878-9fbb61669860","created":"2026-10-18T06:06:42Z","modified":"2026-10-18T06:06:42Z","name":"Company #90","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--a92e4093-ed5f-5b9a-a411-dad2b4c3cfd5","created":"2026-10-18T06:06:42Z","modified":"2026-10-18T06:06:42Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--45731320-1fd0-549f-b878-9fbb61669860","start_time":"2026-10-18T06:06:42Z","description":"Ransomware claim against Company #90 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-90","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--69947a66-bda4-50fa-a5cf-827cced9927d","created":"2026-10-18T05:06:06Z","modified":"2026-10-18T05:06:06Z","name":"Company #89","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--89c92ec5-8cf7-57cc-9697-98cbd08477c0","created":"2026-10-18T05:06:06Z","modified":"2026-10-18T05:06:06Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--69947a66-bda4-50fa-a5cf-827cced9927d","start_time":"2026-10-18T05:06:06Z","description":"Ransomware claim against Company #89 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-89","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--cb2cdf7f-a5aa-5f2e-bf4f-ea375a05a15e","created":"2026-10-11T19:10:54Z","modified":"2026-10-18T05:06:06Z","name":"Company #23 (Pending)","identity_class":"organization","sectors":["professional-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--04b62670-2169-535e-9591-df8724410078","created":"2026-10-18T04:00:00Z","modified":"2026-10-18T05:06:06Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--cb2cdf7f-a5aa-5f2e-bf4f-ea375a05a15e","start_time":"2026-10-18T04:00:00Z","description":"Ransomware claim against Company #23 (Pending) by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-23","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--ffde0053-259f-526c-b0f3-aee82e16b004","created":"2026-10-18T02:06:16Z","modified":"2026-10-18T02:06:16Z","name":"Solid Trading B.V.","identity_class":"organization","sectors":["technology"],"country":"NL"},{"type":"relationship","spec_version":"2.1","id":"relationship--9d467fc0-c3a5-5b62-a02a-bc404ce0b38c","created":"2026-10-18T02:06:16Z","modified":"2026-10-18T02:06:16Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--ffde0053-259f-526c-b0f3-aee82e16b004","start_time":"2026-10-18T02:06:16Z","description":"Ransomware claim against Solid Trading B.V. by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#solid-trading-b-v","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--3c97aacc-34aa-5cfd-aee8-3801216d8e95","created":"2026-10-18T02:06:16Z","modified":"2026-10-18T02:06:16Z","name":"ECO USA","identity_class":"organization","sectors":["manufacturing"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--455de6a0-9945-5501-9b3f-050a46117b06","created":"2026-10-18T02:06:16Z","modified":"2026-10-18T02:06:16Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--3c97aacc-34aa-5cfd-aee8-3801216d8e95","start_time":"2026-10-18T02:06:16Z","description":"Ransomware claim against ECO USA by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#eco-usa","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--e6d86bf0-8005-5471-9f44-d9f722ba7070","created":"2026-10-18T00:06:19Z","modified":"2026-10-18T00:06:19Z","name":"SQA Services Inc","identity_class":"organization","sectors":["technology"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--3602defc-8d32-5700-8422-5131769a1d7d","created":"2026-10-18T00:06:19Z","modified":"2026-10-18T00:06:19Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--e6d86bf0-8005-5471-9f44-d9f722ba7070","start_time":"2026-10-18T00:06:19Z","description":"Ransomware claim against SQA Services Inc by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#sqa-services-inc","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--c25288e3-9f3f-576c-8a30-ff88a01e18b6","created":"2026-10-18T12:04:03Z","modified":"2026-10-18T12:04:03Z","name":"Llano Independent School District","identity_class":"organization","sectors":["education"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--fb819b14-f9c9-5588-939b-118690a5bb00","created":"2026-10-18T00:00:00Z","modified":"2026-10-18T12:04:03Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--c25288e3-9f3f-576c-8a30-ff88a01e18b6","start_time":"2026-10-18T00:00:00Z","description":"Ransomware claim against Llano Independent School District by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=e7770bb5-0317-40ff-8e48-68fb5f38b547","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--239e0c45-9391-5f00-96b1-76abc606528a","created":"2026-10-18T08:05:09Z","modified":"2026-10-18T08:05:09Z","name":"Pengurusan Aset Air Berhad","identity_class":"organization","sectors":["energy-utilities"],"country":"MY"},{"type":"relationship","spec_version":"2.1","id":"relationship--f1195fad-e3e8-5402-9de4-d939a80dc8c8","created":"2026-10-18T00:00:00Z","modified":"2026-10-18T08:05:09Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--239e0c45-9391-5f00-96b1-76abc606528a","start_time":"2026-10-18T00:00:00Z","description":"Ransomware claim against Pengurusan Aset Air Berhad by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=be468e7b-40f2-47dc-a4f8-2b87672a1847","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--72063ff8-ea15-5c05-97b9-c2c1cedb11cb","created":"2026-10-18T08:05:09Z","modified":"2026-10-18T08:05:09Z","name":"Pergande","identity_class":"organization","sectors":["manufacturing"],"country":"IT"},{"type":"relationship","spec_version":"2.1","id":"relationship--c1b93de0-2a2d-5e81-badf-06e34e3fa264","created":"2026-10-18T00:00:00Z","modified":"2026-10-18T08:05:09Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--72063ff8-ea15-5c05-97b9-c2c1cedb11cb","start_time":"2026-10-18T00:00:00Z","description":"Ransomware claim against Pergande by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=8c5605ad-afb1-4675-b776-f21e6c4231ef","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--c3d1b919-054f-5c8b-b333-05046ecd4b44","created":"2026-10-18T08:05:09Z","modified":"2026-10-18T08:05:09Z","name":"Mastelli S.r.l.","identity_class":"organization","sectors":["healthcare"],"country":"IT"},{"type":"relationship","spec_version":"2.1","id":"relationship--6579116e-b542-5bd7-b8eb-456010bf1264","created":"2026-10-18T00:00:00Z","modified":"2026-10-18T08:05:09Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--c3d1b919-054f-5c8b-b333-05046ecd4b44","start_time":"2026-10-18T00:00:00Z","description":"Ransomware claim against Mastelli S.r.l. by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=877fba57-e1f9-4467-b702-c797685e1c8b","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--1dbd783e-bde2-572b-ac48-bff6c0f3986f","created":"2026-10-18T20:02:50Z","modified":"2026-10-18T20:02:50Z","name":"Belcorp","identity_class":"organization","sectors":["other"],"country":"EC"},{"type":"relationship","spec_version":"2.1","id":"relationship--f1000140-07e0-5b25-8630-7a9924ec6cdb","created":"2026-10-18T00:00:00Z","modified":"2026-10-18T20:02:50Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--1dbd783e-bde2-572b-ac48-bff6c0f3986f","start_time":"2026-10-18T00:00:00Z","description":"Ransomware claim against Belcorp by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=694c13db-c3d4-4612-8013-bf43668f9151","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--7823ebba-3e88-57bf-b992-f120c8b5ab03","created":"2026-10-18T08:05:09Z","modified":"2026-10-18T08:05:09Z","name":"Brutra Logistek","identity_class":"organization","sectors":["other"],"country":"IE"},{"type":"relationship","spec_version":"2.1","id":"relationship--a9e7ef1b-5762-579c-a008-0a883d3a8cd2","created":"2026-10-18T00:00:00Z","modified":"2026-10-18T08:05:09Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--7823ebba-3e88-57bf-b992-f120c8b5ab03","start_time":"2026-10-18T00:00:00Z","description":"Ransomware claim against Brutra Logistek by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=4e27102e-c0f2-47b7-9abe-c69df381d668","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--6b0d5ffe-be1d-5249-9359-8e3b20348934","created":"2026-10-17T22:06:47Z","modified":"2026-10-17T22:06:47Z","name":"PART2 Global AirFreight International","identity_class":"organization","sectors":["other"]},{"type":"relationship","spec_version":"2.1","id":"relationship--30ec15d4-4709-5555-b395-d1dd733e7900","created":"2026-10-17T22:06:47Z","modified":"2026-10-17T22:06:47Z","relationship_type":"targets","source_ref":"threat-actor--8363ac67-854b-5be6-975e-0f003b5bbc5e","target_ref":"identity--6b0d5ffe-be1d-5249-9359-8e3b20348934","start_time":"2026-10-17T22:06:47Z","description":"Ransomware claim against PART2 Global AirFreight International by eclipse.","external_references":[{"source_name":"eclipse","url":"http://eclipse4g5kxfwsvpu4qx5sdcnrji6gxl5gt67bucjlgt35g7akvjoid.onion/place/7npbyw8ifegqzfr0","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--f2d51146-7d29-5f78-a0e8-ae64c94e566d","created":"2026-10-17T20:06:02Z","modified":"2026-10-17T20:06:02Z","name":"Company #88","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--d5453221-1d36-5833-beb7-e6f4ab0657de","created":"2026-10-17T20:06:02Z","modified":"2026-10-17T20:06:02Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--f2d51146-7d29-5f78-a0e8-ae64c94e566d","start_time":"2026-10-17T20:06:02Z","description":"Ransomware claim against Company #88 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-88","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--6d9506fc-f0e2-53ad-acfa-04d03c5a7850","created":"2026-10-17T20:03:11Z","modified":"2026-10-17T20:03:11Z","name":"OakgroveTech","identity_class":"organization","sectors":["technology"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--0331716f-7454-5d43-8c0c-56b30b4182c8","created":"2026-10-17T20:03:11Z","modified":"2026-10-17T20:03:11Z","relationship_type":"targets","source_ref":"threat-actor--6d35c979-6c3c-5b4a-8861-8ea4e2322054","target_ref":"identity--6d9506fc-f0e2-53ad-acfa-04d03c5a7850","start_time":"2026-10-17T20:03:11Z","description":"Ransomware claim against OakgroveTech by dragonforce.","external_references":[{"source_name":"dragonforce","url":"http://xjhmtitnrdrgzw4vmsghirdoo2fk35a3tzj4enlmah4pvehdspydsiyd.onion/blog#oakgrovetech","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--1e8ea450-686b-5efb-9270-b40ed5562723","created":"2026-10-17T16:01:46Z","modified":"2026-10-17T16:01:46Z","name":"DINQ.me","identity_class":"organization","sectors":["technology"]},{"type":"relationship","spec_version":"2.1","id":"relationship--fb3e4428-b819-5f53-8aea-ac72245eb6f0","created":"2026-10-17T16:01:46Z","modified":"2026-10-17T16:01:46Z","relationship_type":"targets","source_ref":"threat-actor--c4e7862c-acd5-55e1-b25c-6bcb9e8df905","target_ref":"identity--1e8ea450-686b-5efb-9270-b40ed5562723","start_time":"2026-10-17T16:01:46Z","description":"Ransomware claim against DINQ.me by lapsus$.","external_references":[{"source_name":"lapsus$","url":"https://dropdrive.rip/d/BzxZhR6F","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--50fb0c56-5676-5416-b310-0c459c1e2712","created":"2026-10-17T06:06:27Z","modified":"2026-10-17T06:06:27Z","name":"Company #86","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--060c64d2-e1ae-5b12-8ee2-9fb5059599b3","created":"2026-10-17T06:06:27Z","modified":"2026-10-17T06:06:27Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--50fb0c56-5676-5416-b310-0c459c1e2712","start_time":"2026-10-17T06:06:27Z","description":"Ransomware claim against Company #86 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-86","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--1f5ddf15-489b-58cb-afd1-9e0020e79b7c","created":"2026-10-17T06:06:27Z","modified":"2026-10-17T06:06:27Z","name":"Company #85","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--a4dcd1f4-d22c-5728-a185-96f62f7e94c0","created":"2026-10-17T06:06:27Z","modified":"2026-10-17T06:06:27Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--1f5ddf15-489b-58cb-afd1-9e0020e79b7c","start_time":"2026-10-17T06:06:27Z","description":"Ransomware claim against Company #85 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-85","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--61c068dd-ea7b-523f-849b-10912d091594","created":"2026-10-17T06:06:27Z","modified":"2026-10-17T06:06:27Z","name":"Company #84","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--689b46ce-403f-5226-a866-c9dec5b4a3d7","created":"2026-10-17T06:06:27Z","modified":"2026-10-17T06:06:27Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--61c068dd-ea7b-523f-849b-10912d091594","start_time":"2026-10-17T06:06:27Z","description":"Ransomware claim against Company #84 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-84","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--00ed5acd-b29a-5165-847d-3d28a760189c","created":"2026-10-17T19:03:36Z","modified":"2026-10-17T19:03:36Z","name":"First Brothers Co., Ltd","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--6c96edc1-55e3-5d7c-9c53-50e8143d32ff","created":"2026-10-17T00:00:00Z","modified":"2026-10-17T19:03:36Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--00ed5acd-b29a-5165-847d-3d28a760189c","start_time":"2026-10-17T00:00:00Z","description":"Ransomware claim against First Brothers Co., Ltd by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=c4115757-95f5-48f1-bfd5-29e33075df54","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--cda16469-2919-5a0a-9269-51a34b299141","created":"2026-10-17T15:07:13Z","modified":"2026-10-17T15:07:13Z","name":"Decorolala","identity_class":"organization","sectors":["other"],"country":"CA"},{"type":"relationship","spec_version":"2.1","id":"relationship--ed372eb0-847b-578b-81c5-72b67924e986","created":"2026-10-17T00:00:00Z","modified":"2026-10-17T15:07:13Z","relationship_type":"targets","source_ref":"threat-actor--bd7d771f-cda8-530b-8f3f-13709e27fde5","target_ref":"identity--cda16469-2919-5a0a-9269-51a34b299141","start_time":"2026-10-17T00:00:00Z","description":"Ransomware claim against Decorolala by byod.","external_references":[{"source_name":"byod","url":"http://byodxn5s7sua6oyyjj74rycgn6afncfckprt5ezskt3cni6lg3wdrgad.onion/#decorolala-500-line-sample","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--158c406e-a1d6-5c8f-ad76-89b3b85a0737","created":"2026-10-16T23:06:32Z","modified":"2026-10-16T23:06:32Z","name":"Prafesta Ind. e Com. de Embalagens Ltda","identity_class":"organization","sectors":["manufacturing"],"country":"BR"},{"type":"relationship","spec_version":"2.1","id":"relationship--a787b5d9-c8b8-5f13-8a70-bc2731c3858a","created":"2026-10-16T23:06:32Z","modified":"2026-10-16T23:06:32Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--158c406e-a1d6-5c8f-ad76-89b3b85a0737","start_time":"2026-10-16T23:06:32Z","description":"Ransomware claim against Prafesta Ind. e Com. de Embalagens Ltda by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#prafesta-ind-e-com-de-embalagens-ltda","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--9376d912-b846-5c00-91e9-e09d9ef12175","created":"2026-10-16T19:05:02Z","modified":"2026-10-16T19:05:02Z","name":"ONEOK, Inc.","identity_class":"organization","sectors":["energy-utilities"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--39592062-363a-5301-980f-3c0d8ce5c014","created":"2026-10-16T19:05:02Z","modified":"2026-10-16T19:05:02Z","relationship_type":"targets","source_ref":"threat-actor--b5b73b38-a5d8-5cd5-811a-089e1a2f829a","target_ref":"identity--9376d912-b846-5c00-91e9-e09d9ef12175","start_time":"2026-10-16T19:05:02Z","description":"Ransomware claim against ONEOK, Inc. by redact.","external_references":[{"source_name":"redact","url":"http://neclc36yt4yaa5lv54kh4qbhvjcvuv6nnaurqowkellytpvj3afh4aid.onion/companies#oneok-inc","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--ad2ab791-cd59-5003-be2c-0f7cb8011902","created":"2026-10-16T17:06:09Z","modified":"2026-10-16T17:06:09Z","name":"Sherman Chan, DDS, Inc.","identity_class":"organization","sectors":["healthcare"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--de51f65a-4bfb-54d7-afec-769a54971816","created":"2026-10-16T17:06:09Z","modified":"2026-10-16T17:06:09Z","relationship_type":"targets","source_ref":"threat-actor--41f8c7c6-7ab8-50b4-b7bf-be146adf4214","target_ref":"identity--ad2ab791-cd59-5003-be2c-0f7cb8011902","start_time":"2026-10-16T17:06:09Z","description":"Ransomware claim against Sherman Chan, DDS, Inc. by titan.","external_references":[{"source_name":"titan","url":"http://x4bccxlsmjsxlnnf3ocvndlshgfkagzytpqmsjnlfykceumnw6i4hkqd.onion/post/sherman-chan-dds-inc-data-160gb-0b7pcxph5q","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--294d3965-00c3-5319-8a46-d4c0001cf366","created":"2026-10-16T17:06:09Z","modified":"2026-10-16T17:06:09Z","name":"Grupo Hospifar S.R.L.","identity_class":"organization","sectors":["healthcare"],"country":"DO"},{"type":"relationship","spec_version":"2.1","id":"relationship--9e9b41b1-cf9e-5e84-a7fe-89bf623e0ca6","created":"2026-10-16T17:06:09Z","modified":"2026-10-16T17:06:09Z","relationship_type":"targets","source_ref":"threat-actor--41f8c7c6-7ab8-50b4-b7bf-be146adf4214","target_ref":"identity--294d3965-00c3-5319-8a46-d4c0001cf366","start_time":"2026-10-16T17:06:09Z","description":"Ransomware claim against Grupo Hospifar S.R.L. by titan.","external_references":[{"source_name":"titan","url":"http://x4bccxlsmjsxlnnf3ocvndlshgfkagzytpqmsjnlfykceumnw6i4hkqd.onion/post/grupo-hospifar-s-r-l-data-400gb-0b2q7e7nx5","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--18410fc6-43a1-5a0c-aa02-7c479ef01f6f","created":"2026-10-16T16:02:19Z","modified":"2026-10-16T16:02:19Z","name":"Minkon International","identity_class":"organization","country":"DE"},{"type":"relationship","spec_version":"2.1","id":"relationship--26e18f5f-d02a-5942-8760-f2b955c4a4a3","created":"2026-10-16T16:02:19Z","modified":"2026-10-16T16:02:19Z","relationship_type":"targets","source_ref":"threat-actor--8f1196b6-6ad9-5a8a-be13-9e844d704c49","target_ref":"identity--18410fc6-43a1-5a0c-aa02-7c479ef01f6f","start_time":"2026-10-16T16:02:19Z","description":"Ransomware claim against Minkon International by bravox.","external_references":[{"source_name":"bravox","url":"http://bravoxxtrmqeeevhl7gdh2yzvlrjxajr66d33c7ozosrccx4cz7cepad.onion/blog/b52c5ad3-7db4-48e4-925c-44e04d6bac21","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--11b68861-9ee2-564f-ac28-bb2531f112ac","created":"2026-10-17T17:07:45Z","modified":"2026-10-17T17:07:45Z","name":"Polisee Inc","identity_class":"organization","sectors":["technology"],"country":"JP"},{"type":"relationship","spec_version":"2.1","id":"relationship--a3db01c1-668a-56f9-83a2-993870cfb573","created":"2026-10-16T16:01:48Z","modified":"2026-10-17T17:07:45Z","relationship_type":"targets","source_ref":"threat-actor--11f62186-d1ed-551b-9f18-78fb1193ee72","target_ref":"identity--11b68861-9ee2-564f-ac28-bb2531f112ac","start_time":"2026-10-16T16:01:48Z","description":"Ransomware claim against Polisee Inc by vexy ransomware.","external_references":[{"source_name":"vexy ransomware","url":"http://vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd.onion/#box_v45","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--094e7957-0add-5b1d-8036-a854fdba31b3","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","name":"Company #80","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--f34dda93-826c-53a5-9aa5-afff1faa9ac4","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--094e7957-0add-5b1d-8036-a854fdba31b3","start_time":"2026-10-16T15:07:44Z","description":"Ransomware claim against Company #80 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-80","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--d6bc463f-1d97-52ba-a1b4-0a4cea5fbd8d","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","name":"Company #79","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--20c0ab45-41af-5baf-842e-6cf07373be54","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--d6bc463f-1d97-52ba-a1b4-0a4cea5fbd8d","start_time":"2026-10-16T15:07:44Z","description":"Ransomware claim against Company #79 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-79","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--84b44922-b377-5402-8d60-7c2a1a09d3a8","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","name":"Company #78","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--998cb4de-902e-5112-986e-dd1b90b21030","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--84b44922-b377-5402-8d60-7c2a1a09d3a8","start_time":"2026-10-16T15:07:44Z","description":"Ransomware claim against Company #78 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-78","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--1d8c123f-e8a8-5f53-931e-f33c2c3fff81","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","name":"Company #77","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--a51b8c38-d5e6-52d0-90f0-dec06e69663a","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--1d8c123f-e8a8-5f53-931e-f33c2c3fff81","start_time":"2026-10-16T15:07:44Z","description":"Ransomware claim against Company #77 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-77","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--4e0cbc52-0c23-5a9d-ba43-252abfb4e165","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","name":"Company #76","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--44c0b840-d1ea-5875-acf2-68150104e8be","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--4e0cbc52-0c23-5a9d-ba43-252abfb4e165","start_time":"2026-10-16T15:07:44Z","description":"Ransomware claim against Company #76 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-76","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--3eb2f8a9-ad99-5203-b709-e6498d92fc0c","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","name":"Company #72","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--fee33d02-90f8-56b4-b61e-e262d9095235","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--3eb2f8a9-ad99-5203-b709-e6498d92fc0c","start_time":"2026-10-16T15:07:44Z","description":"Ransomware claim against Company #72 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-72","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--6898118b-3c9c-5b42-ba09-6ef3dec4264d","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","name":"Company #71","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--8c8ec37a-0b29-5ca7-9491-e1050d5af8f9","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--6898118b-3c9c-5b42-ba09-6ef3dec4264d","start_time":"2026-10-16T15:07:44Z","description":"Ransomware claim against Company #71 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-71","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--cece2c41-a643-50b3-adb2-e82c34b35b18","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","name":"Company #29","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--fbb750e1-830d-5dd9-9ecb-690e47d409d0","created":"2026-10-16T15:07:44Z","modified":"2026-10-16T15:07:44Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--cece2c41-a643-50b3-adb2-e82c34b35b18","start_time":"2026-10-16T15:07:44Z","description":"Ransomware claim against Company #29 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-29","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--66f34145-9965-582f-938a-0521c6471263","created":"2026-10-16T16:07:37Z","modified":"2026-10-16T16:07:37Z","name":"Data-Core Systems","identity_class":"organization","sectors":["technology"]},{"type":"relationship","spec_version":"2.1","id":"relationship--06c333cf-3ebe-5f31-8d72-bf47c0cdc759","created":"2026-10-16T14:15:15Z","modified":"2026-10-16T16:07:37Z","relationship_type":"targets","source_ref":"threat-actor--11f62186-d1ed-551b-9f18-78fb1193ee72","target_ref":"identity--66f34145-9965-582f-938a-0521c6471263","start_time":"2026-10-16T14:15:15Z","description":"Ransomware claim against Data-Core Systems by vexy ransomware.","external_references":[{"source_name":"vexy ransomware","url":"http://vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd.onion/#box_v44","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--86e7499a-5d85-5da1-9ab1-03fa7a3b3150","created":"2026-10-16T14:07:13Z","modified":"2026-10-16T14:07:13Z","name":"Xinos Construction Corp","identity_class":"organization","sectors":["construction"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--fed02a8b-defb-5dee-b287-50085ef28fa2","created":"2026-10-16T14:07:13Z","modified":"2026-10-16T14:07:13Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--86e7499a-5d85-5da1-9ab1-03fa7a3b3150","start_time":"2026-10-16T14:07:13Z","description":"Ransomware claim against Xinos Construction Corp by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#xinos-construction-corp-and-its-accounting-group","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--dca7a057-7da3-5bf4-be37-3e0147be8bbe","created":"2026-10-16T14:07:13Z","modified":"2026-10-16T14:07:13Z","name":"Company #83","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--8ff99a95-200e-5e77-b0e3-93c4468506c6","created":"2026-10-16T14:07:13Z","modified":"2026-10-16T14:07:13Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--dca7a057-7da3-5bf4-be37-3e0147be8bbe","start_time":"2026-10-16T14:07:13Z","description":"Ransomware claim against Company #83 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-83","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--cfdd6867-e6fa-5a46-9dc2-13ac502cde86","created":"2026-10-16T14:07:13Z","modified":"2026-10-16T14:07:13Z","name":"Company #82","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--f5ade21a-336c-5505-b3f1-1500366df1e8","created":"2026-10-16T14:07:13Z","modified":"2026-10-16T14:07:13Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--cfdd6867-e6fa-5a46-9dc2-13ac502cde86","start_time":"2026-10-16T14:07:13Z","description":"Ransomware claim against Company #82 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-82","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--31cd5ddb-a0e8-5b4d-81fa-de3910d9cc7e","created":"2026-10-16T14:07:13Z","modified":"2026-10-16T14:07:13Z","name":"Company #81","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--5b410f85-13da-5999-8488-fc00a0d05413","created":"2026-10-16T14:07:13Z","modified":"2026-10-16T14:07:13Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--31cd5ddb-a0e8-5b4d-81fa-de3910d9cc7e","start_time":"2026-10-16T14:07:13Z","description":"Ransomware claim against Company #81 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-81","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--3928c5e0-1b30-5153-a671-7d0d3e877686","created":"2026-10-16T14:07:13Z","modified":"2026-10-16T14:07:13Z","name":"BladeTech Inc","identity_class":"organization","sectors":["manufacturing"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--2016eda6-2c92-5356-b2ca-10b377844af8","created":"2026-10-16T14:07:13Z","modified":"2026-10-16T14:07:13Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--3928c5e0-1b30-5153-a671-7d0d3e877686","start_time":"2026-10-16T14:07:13Z","description":"Ransomware claim against BladeTech Inc by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#bladetech-inc","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--141903a8-ea7a-5960-a52a-3da35e525346","created":"2026-10-16T14:05:37Z","modified":"2026-10-16T14:05:37Z","name":"Girl Scouts of Eastern Massachusetts","identity_class":"organization","sectors":["education"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--f7578004-83e5-55c2-91ec-f83e298d0db1","created":"2026-10-16T14:05:37Z","modified":"2026-10-16T14:05:37Z","relationship_type":"targets","source_ref":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","target_ref":"identity--141903a8-ea7a-5960-a52a-3da35e525346","start_time":"2026-10-16T14:05:37Z","description":"Ransomware claim against Girl Scouts of Eastern Massachusetts by wallstreet.","external_references":[{"source_name":"wallstreet","url":"http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/#girl-scouts-of-eastern-massachusetts","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--abf4e29d-37e1-56a5-95ed-6ede26cedc1b","created":"2026-10-16T14:05:32Z","modified":"2026-10-16T14:05:32Z","name":"Parker-Hannifin Corporation","identity_class":"organization","sectors":["manufacturing"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--8a2ad383-7f4a-5ac6-a78b-34d5e08b49ae","created":"2026-10-16T14:05:32Z","modified":"2026-10-16T14:05:32Z","relationship_type":"targets","source_ref":"threat-actor--b5b73b38-a5d8-5cd5-811a-089e1a2f829a","target_ref":"identity--abf4e29d-37e1-56a5-95ed-6ede26cedc1b","start_time":"2026-10-16T14:05:32Z","description":"Ransomware claim against Parker-Hannifin Corporation by redact.","external_references":[{"source_name":"redact","url":"http://neclc36yt4yaa5lv54kh4qbhvjcvuv6nnaurqowkellytpvj3afh4aid.onion/companies#parker-hannifin-corporation","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--6665a93d-5ed6-523d-831f-c513dd655581","created":"2026-10-16T12:07:14Z","modified":"2026-10-16T12:07:14Z","name":"EnVision Eye Care","identity_class":"organization","sectors":["healthcare"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--d6fdee10-a96f-566f-9f68-574c27bd4985","created":"2026-10-16T12:07:14Z","modified":"2026-10-16T12:07:14Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--6665a93d-5ed6-523d-831f-c513dd655581","start_time":"2026-10-16T12:07:14Z","description":"Ransomware claim against EnVision Eye Care by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#envision-eye-care","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--8e0bcb46-6666-5547-afff-e68d6c397851","created":"2026-10-16T10:06:25Z","modified":"2026-10-16T10:06:25Z","name":"Adams Warehouse & Delivery, Inc.","identity_class":"organization","sectors":["other"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--6d5c8a1a-bf0c-5ab3-9e7f-0927eb60e7c0","created":"2026-10-16T10:06:25Z","modified":"2026-10-16T10:06:25Z","relationship_type":"targets","source_ref":"threat-actor--e6361d0a-0132-5091-8c65-965b024e655f","target_ref":"identity--8e0bcb46-6666-5547-afff-e68d6c397851","start_time":"2026-10-16T10:06:25Z","description":"Ransomware claim against Adams Warehouse & Delivery, Inc. by aurora.","external_references":[{"source_name":"aurora","url":"http://u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion/blog/adams-warehouse-delivery-inc-2c6e2ef7","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--e20f610c-5227-52a8-ac24-5d49eb72a397","created":"2026-10-16T01:08:27Z","modified":"2026-10-16T01:08:27Z","name":"Company #75","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--dbdd1835-8c32-5abb-8e2e-1250864529f6","created":"2026-10-16T01:08:27Z","modified":"2026-10-16T01:08:27Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--e20f610c-5227-52a8-ac24-5d49eb72a397","start_time":"2026-10-16T01:08:27Z","description":"Ransomware claim against Company #75 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-75","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--8817a57d-3eae-5686-a398-143bc4cedd3e","created":"2026-10-16T01:08:27Z","modified":"2026-10-16T01:08:27Z","name":"Company #74","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--3459f998-38c4-57e3-a4eb-b78ef647cc3c","created":"2026-10-16T01:08:27Z","modified":"2026-10-16T01:08:27Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--8817a57d-3eae-5686-a398-143bc4cedd3e","start_time":"2026-10-16T01:08:27Z","description":"Ransomware claim against Company #74 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-74","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--b83b7f8d-471f-5693-b7e7-8b51f94f986f","created":"2026-10-16T00:07:22Z","modified":"2026-10-16T00:07:22Z","name":"Evolution Spine","identity_class":"organization","sectors":["healthcare"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--fedc4ba8-2059-5a77-b2e3-b375c1a53b97","created":"2026-10-16T00:07:22Z","modified":"2026-10-16T00:07:22Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--b83b7f8d-471f-5693-b7e7-8b51f94f986f","start_time":"2026-10-16T00:07:22Z","description":"Ransomware claim against Evolution Spine by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#evolution-spine-all-labs","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--b540ee8b-ebf5-596c-9ea5-0bbc29d55509","created":"2026-10-18T02:03:09Z","modified":"2026-10-18T02:03:09Z","name":"U**IN* Group","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--7aae9b93-4f1b-54bd-b3c5-5b56660cf3a6","created":"2026-10-16T00:00:00Z","modified":"2026-10-18T02:03:09Z","relationship_type":"targets","source_ref":"threat-actor--e6acb436-7c12-573c-8995-541d5e783c0b","target_ref":"identity--b540ee8b-ebf5-596c-9ea5-0bbc29d55509","start_time":"2026-10-16T00:00:00Z","description":"Ransomware claim against U**IN* Group by nightspire.","external_references":[{"source_name":"nightspire","url":"http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/database/1897","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--11f417a9-5488-51dd-953b-29836cc57d81","created":"2026-10-16T19:02:53Z","modified":"2026-10-16T19:02:53Z","name":"MicroSearch Corporation","identity_class":"organization","sectors":["technology"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--49951dd8-fdae-5b3d-a7a4-7edcffd2fe55","created":"2026-10-16T00:00:00Z","modified":"2026-10-16T19:02:53Z","relationship_type":"targets","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"identity--11f417a9-5488-51dd-953b-29836cc57d81","start_time":"2026-10-16T00:00:00Z","description":"Ransomware claim against MicroSearch Corporation by play.","external_references":[{"source_name":"play","url":"http://j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion/topic.php?id=tp1TrSWkWitIOn","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--a2fc17a5-2479-5572-a534-a872766371d1","created":"2026-10-16T19:02:53Z","modified":"2026-10-16T19:02:53Z","name":"Pure Options","identity_class":"organization","sectors":["financial-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--5ffe7c4b-3017-549c-a656-742558388c04","created":"2026-10-16T00:00:00Z","modified":"2026-10-16T19:02:53Z","relationship_type":"targets","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"identity--a2fc17a5-2479-5572-a534-a872766371d1","start_time":"2026-10-16T00:00:00Z","description":"Ransomware claim against Pure Options by play.","external_references":[{"source_name":"play","url":"http://j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion/topic.php?id=jvpTJVypTWzdnK","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--840846c8-3de4-5efc-83fb-94314e961078","created":"2026-10-16T20:02:30Z","modified":"2026-10-16T20:02:30Z","name":"New Tec Tool Limited","identity_class":"organization","sectors":["manufacturing"],"country":"CA"},{"type":"relationship","spec_version":"2.1","id":"relationship--593cfe06-2ca5-5a56-a3b2-ab0a3abd608c","created":"2026-10-16T00:00:00Z","modified":"2026-10-16T20:02:30Z","relationship_type":"targets","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"identity--840846c8-3de4-5efc-83fb-94314e961078","start_time":"2026-10-16T00:00:00Z","description":"Ransomware claim against New Tec Tool Limited by play.","external_references":[{"source_name":"play","url":"http://j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion/topic.php?id=iRxQ62ZXeoWZKd","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--d7391cb5-1193-53e0-901c-105f0b83f55a","created":"2026-10-16T20:02:30Z","modified":"2026-10-16T20:02:30Z","name":"Walloon Society for Business and Industry – ESBG","identity_class":"organization","sectors":["professional-services"],"country":"BE"},{"type":"relationship","spec_version":"2.1","id":"relationship--daba3497-1a75-560a-b091-346a5a2fb943","created":"2026-10-16T00:00:00Z","modified":"2026-10-16T20:02:30Z","relationship_type":"targets","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"identity--d7391cb5-1193-53e0-901c-105f0b83f55a","start_time":"2026-10-16T00:00:00Z","description":"Ransomware claim against Walloon Society for Business and Industry – ESBG by play.","external_references":[{"source_name":"play","url":"http://j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion/topic.php?id=e0NKnTYUr2EsuF","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--72643302-e8bb-5ddc-817b-a81667f5ec4d","created":"2026-10-16T06:03:24Z","modified":"2026-10-16T06:03:24Z","name":"VIA Credit Union","identity_class":"organization","sectors":["financial-services"]},{"type":"relationship","spec_version":"2.1","id":"relationship--aa952a58-760d-591c-84e7-1cf82c0101b3","created":"2026-10-16T00:00:00Z","modified":"2026-10-16T06:03:24Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--72643302-e8bb-5ddc-817b-a81667f5ec4d","start_time":"2026-10-16T00:00:00Z","description":"Ransomware claim against VIA Credit Union by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=0b4690ca-9214-4ddd-b5ca-15aa621e4d0e","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--85de5425-be7c-53f5-a2b8-26073de50802","created":"2026-10-15T23:02:28Z","modified":"2026-10-15T23:02:28Z","name":"Verveba","identity_class":"organization","sectors":["technology"]},{"type":"relationship","spec_version":"2.1","id":"relationship--112b6d18-88bb-5123-bcb1-e4cc6bc8bbc4","created":"2026-10-15T22:21:02Z","modified":"2026-10-15T23:02:28Z","relationship_type":"targets","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"identity--85de5425-be7c-53f5-a2b8-26073de50802","start_time":"2026-10-15T22:21:02Z","description":"Ransomware claim against Verveba by incransom.","external_references":[{"source_name":"incransom","url":"http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/6ad151ce9cd108bf26fd4077","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--d5bd280d-a9c4-5a86-8f0d-0df29c29c45a","created":"2026-10-15T22:02:13Z","modified":"2026-10-15T22:02:13Z","name":"Fair Fee Legal Services","identity_class":"organization","sectors":["legal"]},{"type":"relationship","spec_version":"2.1","id":"relationship--5fb76379-03d6-5033-96fa-aa574f407909","created":"2026-10-15T21:45:20Z","modified":"2026-10-15T22:02:13Z","relationship_type":"targets","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"identity--d5bd280d-a9c4-5a86-8f0d-0df29c29c45a","start_time":"2026-10-15T21:45:20Z","description":"Ransomware claim against Fair Fee Legal Services by incransom.","external_references":[{"source_name":"incransom","url":"http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/6ad149709cd108bf26fc615d","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--e2b4c5f2-31e0-555e-9e74-0c9299c3f095","created":"2026-10-15T22:02:13Z","modified":"2026-10-15T22:02:13Z","name":"Nowa Szkoła","identity_class":"organization","sectors":["education"],"country":"PL"},{"type":"relationship","spec_version":"2.1","id":"relationship--a1ac3d31-8a73-5897-8531-b6bea51276bf","created":"2026-10-15T21:38:33Z","modified":"2026-10-15T22:02:13Z","relationship_type":"targets","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"identity--e2b4c5f2-31e0-555e-9e74-0c9299c3f095","start_time":"2026-10-15T21:38:33Z","description":"Ransomware claim against Nowa Szkoła by incransom.","external_references":[{"source_name":"incransom","url":"http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/6ad147d99cd108bf26fc2c01","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--7d464755-2fb0-5bc5-8973-7b1a78a58be0","created":"2026-10-15T22:02:13Z","modified":"2026-10-15T22:02:13Z","name":"Coopecaja","identity_class":"organization","sectors":["financial-services"],"country":"CR"},{"type":"relationship","spec_version":"2.1","id":"relationship--acaa90ff-6bb9-511e-b492-c112dc2a8032","created":"2026-10-15T21:28:57Z","modified":"2026-10-15T22:02:13Z","relationship_type":"targets","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"identity--7d464755-2fb0-5bc5-8973-7b1a78a58be0","start_time":"2026-10-15T21:28:57Z","description":"Ransomware claim against Coopecaja by incransom.","external_references":[{"source_name":"incransom","url":"http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/6ad145999cd108bf26fbe5bc","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--e4865d11-6c2a-5765-b370-9c98e59187dc","created":"2026-10-15T20:05:57Z","modified":"2026-10-15T20:05:57Z","name":"TGM Manufacturing, Inc.","identity_class":"organization","sectors":["manufacturing"]},{"type":"relationship","spec_version":"2.1","id":"relationship--926eab72-e58c-5740-a427-2601d80f0fe9","created":"2026-10-15T20:05:57Z","modified":"2026-10-15T20:05:57Z","relationship_type":"targets","source_ref":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","target_ref":"identity--e4865d11-6c2a-5765-b370-9c98e59187dc","start_time":"2026-10-15T20:05:57Z","description":"Ransomware claim against TGM Manufacturing, Inc. by wallstreet.","external_references":[{"source_name":"wallstreet","url":"http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/#tgm-manufacturing--inc","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--fcfb6eaa-80f6-5c24-9889-17e90e7129d4","created":"2026-10-15T17:29:55Z","modified":"2026-10-15T17:29:55Z","name":"CINDER","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--415fce02-ae90-5f41-8b1a-a7be4e23c77e","created":"2026-10-15T17:29:55Z","modified":"2026-10-15T17:29:55Z","relationship_type":"targets","source_ref":"threat-actor--00cc282b-2f8d-53cf-897c-d80f676577dc","target_ref":"identity--fcfb6eaa-80f6-5c24-9889-17e90e7129d4","start_time":"2026-10-15T17:29:55Z","description":"Ransomware claim against CINDER by iah6477.","external_references":[{"source_name":"iah6477","url":"http://iah6477wcvisc45wl54u524fbrh4dnmtcctpg2fpe5epf3jbpkiwu4qd.onion/a/trc-companies","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--935eef7b-ccc2-5d39-b031-537e3dea1fd7","created":"2026-10-15T17:29:55Z","modified":"2026-10-15T17:29:55Z","name":"Sunshine Mills","identity_class":"organization","sectors":["agriculture-food"]},{"type":"relationship","spec_version":"2.1","id":"relationship--4176ec40-8ea6-5217-81ed-6b57438c0abf","created":"2026-10-15T17:29:55Z","modified":"2026-10-15T17:29:55Z","relationship_type":"targets","source_ref":"threat-actor--00cc282b-2f8d-53cf-897c-d80f676577dc","target_ref":"identity--935eef7b-ccc2-5d39-b031-537e3dea1fd7","start_time":"2026-10-15T17:29:55Z","description":"Ransomware claim against Sunshine Mills by iah6477.","external_references":[{"source_name":"iah6477","url":"http://iah6477wcvisc45wl54u524fbrh4dnmtcctpg2fpe5epf3jbpkiwu4qd.onion/a/sunshine-mills","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--49acd465-bdb5-5096-92bd-f15fce82f931","created":"2026-10-15T17:29:55Z","modified":"2026-10-15T17:29:55Z","name":"Regency Centers Group, Inc.","identity_class":"organization","sectors":["real-estate"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--2e986ce8-dcff-561a-9b7a-4fe860b33b1f","created":"2026-10-15T17:29:55Z","modified":"2026-10-15T17:29:55Z","relationship_type":"targets","source_ref":"threat-actor--00cc282b-2f8d-53cf-897c-d80f676577dc","target_ref":"identity--49acd465-bdb5-5096-92bd-f15fce82f931","start_time":"2026-10-15T17:29:55Z","description":"Ransomware claim against Regency Centers Group, Inc. by iah6477.","external_references":[{"source_name":"iah6477","url":"http://iah6477wcvisc45wl54u524fbrh4dnmtcctpg2fpe5epf3jbpkiwu4qd.onion/a/regencycenters","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--4c2d41bd-d91c-5afb-a044-77fd545f52cb","created":"2026-10-15T17:29:55Z","modified":"2026-10-15T17:29:55Z","name":"Middleby Corporation","identity_class":"organization","sectors":["manufacturing"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--f098f32d-a825-5ace-a26e-1633874dd3e7","created":"2026-10-15T17:29:55Z","modified":"2026-10-15T17:29:55Z","relationship_type":"targets","source_ref":"threat-actor--00cc282b-2f8d-53cf-897c-d80f676577dc","target_ref":"identity--4c2d41bd-d91c-5afb-a044-77fd545f52cb","start_time":"2026-10-15T17:29:55Z","description":"Ransomware claim against Middleby Corporation by iah6477.","external_references":[{"source_name":"iah6477","url":"http://iah6477wcvisc45wl54u524fbrh4dnmtcctpg2fpe5epf3jbpkiwu4qd.onion/a/middleby","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--25c33493-b4e2-5f28-91ec-8848e67a1d4e","created":"2026-10-15T17:29:55Z","modified":"2026-10-15T17:29:55Z","name":"MAT Holdings Inc","identity_class":"organization","country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--2f71a9df-e86b-50af-afdc-936924b90d6a","created":"2026-10-15T17:29:55Z","modified":"2026-10-15T17:29:55Z","relationship_type":"targets","source_ref":"threat-actor--00cc282b-2f8d-53cf-897c-d80f676577dc","target_ref":"identity--25c33493-b4e2-5f28-91ec-8848e67a1d4e","start_time":"2026-10-15T17:29:55Z","description":"Ransomware claim against MAT Holdings Inc by iah6477.","external_references":[{"source_name":"iah6477","url":"http://iah6477wcvisc45wl54u524fbrh4dnmtcctpg2fpe5epf3jbpkiwu4qd.onion/a/mat-holdings-inc","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--6fb30b1c-88d6-5fd7-b59d-ff9ce49c51c0","created":"2026-10-15T17:29:55Z","modified":"2026-10-15T17:29:55Z","name":"Hilmar Cheese","identity_class":"organization","sectors":["agriculture-food"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--43ac9232-9999-511c-b22e-c730cec4eff8","created":"2026-10-15T17:29:55Z","modified":"2026-10-15T17:29:55Z","relationship_type":"targets","source_ref":"threat-actor--00cc282b-2f8d-53cf-897c-d80f676577dc","target_ref":"identity--6fb30b1c-88d6-5fd7-b59d-ff9ce49c51c0","start_time":"2026-10-15T17:29:55Z","description":"Ransomware claim against Hilmar Cheese by iah6477.","external_references":[{"source_name":"iah6477","url":"http://iah6477wcvisc45wl54u524fbrh4dnmtcctpg2fpe5epf3jbpkiwu4qd.onion/a/hilmar-cheese","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--0d49d6b7-84ab-50e0-a771-5aa4f0d7100b","created":"2026-10-15T17:29:55Z","modified":"2026-10-15T17:29:55Z","name":"Hensley","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--07c3e043-83f2-55fe-a794-a88c0ccb4d06","created":"2026-10-15T17:29:55Z","modified":"2026-10-15T17:29:55Z","relationship_type":"targets","source_ref":"threat-actor--00cc282b-2f8d-53cf-897c-d80f676577dc","target_ref":"identity--0d49d6b7-84ab-50e0-a771-5aa4f0d7100b","start_time":"2026-10-15T17:29:55Z","description":"Ransomware claim against Hensley by iah6477.","external_references":[{"source_name":"iah6477","url":"http://iah6477wcvisc45wl54u524fbrh4dnmtcctpg2fpe5epf3jbpkiwu4qd.onion/a/hensley","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--f77bffef-1db0-5ec6-be6d-abe450841591","created":"2026-10-15T17:28:44Z","modified":"2026-10-15T17:28:44Z","name":"Company #73","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--cf226b4d-a901-5814-917e-3d664bf84450","created":"2026-10-15T17:28:44Z","modified":"2026-10-15T17:28:44Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--f77bffef-1db0-5ec6-be6d-abe450841591","start_time":"2026-10-15T17:28:44Z","description":"Ransomware claim against Company #73 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-73","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--aaac4573-a458-5a9a-9a68-16d7acba2f92","created":"2026-10-15T17:28:44Z","modified":"2026-10-15T17:28:44Z","name":"Company #70","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--48f2444e-d6a3-53c6-9614-6414924ef775","created":"2026-10-15T17:28:44Z","modified":"2026-10-15T17:28:44Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--aaac4573-a458-5a9a-9a68-16d7acba2f92","start_time":"2026-10-15T17:28:44Z","description":"Ransomware claim against Company #70 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-70","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--6eb6e656-e2d2-516c-ac58-f9ae177b9a78","created":"2026-10-15T17:28:44Z","modified":"2026-10-15T17:28:44Z","name":"Company #27","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--418d5eac-3f13-5406-9378-c1668e4430d7","created":"2026-10-15T17:28:44Z","modified":"2026-10-15T17:28:44Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--6eb6e656-e2d2-516c-ac58-f9ae177b9a78","start_time":"2026-10-15T17:28:44Z","description":"Ransomware claim against Company #27 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-27","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--c71a944a-48c8-5683-8ab3-689584f21bae","created":"2026-10-15T17:29:30Z","modified":"2026-10-15T17:29:30Z","name":"BienestarEmpresarial","identity_class":"organization","sectors":["professional-services"]},{"type":"relationship","spec_version":"2.1","id":"relationship--a582b75c-7ccb-515c-bffd-8d8104852373","created":"2026-10-15T16:02:23Z","modified":"2026-10-15T17:29:30Z","relationship_type":"targets","source_ref":"threat-actor--74758428-a610-5ce8-a1aa-e76703530381","target_ref":"identity--c71a944a-48c8-5683-8ab3-689584f21bae","start_time":"2026-10-15T16:02:23Z","description":"Ransomware claim against BienestarEmpresarial by 0x00.","external_references":[{"source_name":"0x00","url":"http://oxooxmnl67z5t5cctt3uw7ukqoy6k7kr6x5vn2yyhcfpbuj5ddq2hjid.onion/#bienestarempresarial","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--8b0acc80-3b61-57df-93a2-dcedd373e439","created":"2026-10-15T11:10:04Z","modified":"2026-10-15T23:32:35Z","name":"Camden Living","identity_class":"organization","sectors":["real-estate"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--75295250-05f0-5854-819f-6b561e510d36","created":"2026-10-15T11:10:04Z","modified":"2026-10-15T23:32:35Z","relationship_type":"targets","source_ref":"threat-actor--00cc282b-2f8d-53cf-897c-d80f676577dc","target_ref":"identity--8b0acc80-3b61-57df-93a2-dcedd373e439","start_time":"2026-10-15T11:10:04Z","description":"Ransomware claim against Camden Living by iah6477.","external_references":[{"source_name":"iah6477","url":"http://iah6477wcvisc45wl54u524fbrh4dnmtcctpg2fpe5epf3jbpkiwu4qd.onion/a/camden-living","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--0f73c179-cdb1-5d62-81d1-af064a3ec42e","created":"2026-10-15T11:10:04Z","modified":"2026-10-15T11:10:04Z","name":"buckle","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--5d2d1bb3-f4bc-5d31-867e-cc60ddd6cd1f","created":"2026-10-15T11:10:04Z","modified":"2026-10-15T11:10:04Z","relationship_type":"targets","source_ref":"threat-actor--00cc282b-2f8d-53cf-897c-d80f676577dc","target_ref":"identity--0f73c179-cdb1-5d62-81d1-af064a3ec42e","start_time":"2026-10-15T11:10:04Z","description":"Ransomware claim against buckle by iah6477.","external_references":[{"source_name":"iah6477","url":"http://iah6477wcvisc45wl54u524fbrh4dnmtcctpg2fpe5epf3jbpkiwu4qd.onion/a/buckle","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--856f225f-e3be-5a6c-985e-53165085498b","created":"2026-10-15T11:10:23Z","modified":"2026-10-15T23:32:46Z","name":"Enchanted Fine Jewellery","identity_class":"organization","sectors":["other"],"country":"GB"},{"type":"relationship","spec_version":"2.1","id":"relationship--629751e1-5c62-53d1-9ac4-fb2bf2a98264","created":"2026-10-15T10:13:27Z","modified":"2026-10-15T23:32:46Z","relationship_type":"targets","source_ref":"threat-actor--11f62186-d1ed-551b-9f18-78fb1193ee72","target_ref":"identity--856f225f-e3be-5a6c-985e-53165085498b","start_time":"2026-10-15T10:13:27Z","description":"Ransomware claim against Enchanted Fine Jewellery by vexy ransomware.","external_references":[{"source_name":"vexy ransomware","url":"http://vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd.onion/#box_v43","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--aaec1e04-a449-5c6b-a476-ee6ecc49aa38","created":"2026-10-15T09:08:46Z","modified":"2026-10-15T22:56:18Z","name":"MPI LTDA","identity_class":"organization","country":"BR"},{"type":"relationship","spec_version":"2.1","id":"relationship--e21f34e6-f3ef-5c03-92bb-d308105b0af7","created":"2026-10-15T08:34:00Z","modified":"2026-10-15T22:56:18Z","relationship_type":"targets","source_ref":"threat-actor--34221ba3-936e-50ef-a0ee-676bb412a537","target_ref":"identity--aaec1e04-a449-5c6b-a476-ee6ecc49aa38","start_time":"2026-10-15T08:34:00Z","description":"Ransomware claim against MPI LTDA by emperador.","external_references":[{"source_name":"emperador","url":"http://emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion/post/mpi-ltda","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--fc521fb6-2feb-500c-a20f-84e3f86cc328","created":"2026-10-15T07:07:59Z","modified":"2026-10-15T07:07:59Z","name":"Company #69","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--15145144-1080-5ac2-8069-84626b37245e","created":"2026-10-15T07:07:59Z","modified":"2026-10-15T07:07:59Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--fc521fb6-2feb-500c-a20f-84e3f86cc328","start_time":"2026-10-15T07:07:59Z","description":"Ransomware claim against Company #69 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-69","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--4da9f58d-5763-5aef-9908-b32431ddbbbe","created":"2026-10-15T07:07:59Z","modified":"2026-10-15T07:07:59Z","name":"Company #68","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--a7230a53-4360-51bf-90cb-ca14712c42c0","created":"2026-10-15T07:07:59Z","modified":"2026-10-15T07:07:59Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--4da9f58d-5763-5aef-9908-b32431ddbbbe","start_time":"2026-10-15T07:07:59Z","description":"Ransomware claim against Company #68 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-68","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--a20a80d0-a1b3-52b7-82b4-5d681400281e","created":"2026-10-15T07:07:59Z","modified":"2026-10-15T07:07:59Z","name":"Company #67","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--41a42396-c713-5536-a201-6bb530a07e9c","created":"2026-10-15T07:07:59Z","modified":"2026-10-15T07:07:59Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--a20a80d0-a1b3-52b7-82b4-5d681400281e","start_time":"2026-10-15T07:07:59Z","description":"Ransomware claim against Company #67 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-67","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--79e620fb-c990-55b2-a727-42106c7afd21","created":"2026-10-15T07:07:59Z","modified":"2026-10-15T07:07:59Z","name":"Company #66","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--67ff8277-af43-5e1c-9171-e7e6ea5f66bc","created":"2026-10-15T07:07:59Z","modified":"2026-10-15T07:07:59Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--79e620fb-c990-55b2-a727-42106c7afd21","start_time":"2026-10-15T07:07:59Z","description":"Ransomware claim against Company #66 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-66","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--f6f9f18d-e345-5e78-966f-86c37be1c837","created":"2026-10-15T06:41:02Z","modified":"2026-10-15T06:41:02Z","name":"Alera","identity_class":"organization","sectors":["healthcare"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--dbe2918d-5f8c-56bd-bee0-ff9656bdb99d","created":"2026-10-15T06:41:02Z","modified":"2026-10-15T06:41:02Z","relationship_type":"targets","source_ref":"threat-actor--00cc282b-2f8d-53cf-897c-d80f676577dc","target_ref":"identity--f6f9f18d-e345-5e78-966f-86c37be1c837","start_time":"2026-10-15T06:41:02Z","description":"Ransomware claim against Alera by iah6477.","external_references":[{"source_name":"iah6477","url":"http://iah6477wcvisc45wl54u524fbrh4dnmtcctpg2fpe5epf3jbpkiwu4qd.onion/a/alera","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--47f59ac2-2f42-52cb-8abf-52cdbb2444dc","created":"2026-10-15T06:38:59Z","modified":"2026-10-15T06:38:59Z","name":"Junta de Andalucía","identity_class":"organization","sectors":["government-public-sector"],"country":"ES"},{"type":"relationship","spec_version":"2.1","id":"relationship--b151e9c8-c69e-5c6d-8a23-cbc5e575c63d","created":"2026-10-15T06:38:59Z","modified":"2026-10-15T06:38:59Z","relationship_type":"targets","source_ref":"threat-actor--7a41aa13-d6aa-57d0-a9a0-8e4e340b1025","target_ref":"identity--47f59ac2-2f42-52cb-8abf-52cdbb2444dc","start_time":"2026-10-15T06:38:59Z","description":"Ransomware claim against Junta de Andalucía by bavacai.","external_references":[{"source_name":"bavacai","url":"http://t33zoj4qwv455fog7qnb2azi5xcdxkixughmmduzbw2rtdgryqfbh6id.onion/company/BAWARAA","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--1e80a968-59a1-531c-ac8a-fa0680afa8cc","created":"2026-10-15T06:38:59Z","modified":"2026-10-15T06:38:59Z","name":"Juntadeandalucia","identity_class":"organization","sectors":["government-public-sector"],"country":"ES"},{"type":"relationship","spec_version":"2.1","id":"relationship--71f6a5cd-a2a0-54cd-913a-6ac98982815f","created":"2026-10-15T06:38:59Z","modified":"2026-10-15T06:38:59Z","relationship_type":"targets","source_ref":"threat-actor--7a41aa13-d6aa-57d0-a9a0-8e4e340b1025","target_ref":"identity--1e80a968-59a1-531c-ac8a-fa0680afa8cc","start_time":"2026-10-15T06:38:59Z","description":"Ransomware claim against Juntadeandalucia by bavacai.","external_references":[{"source_name":"bavacai","url":"http://t33zoj4qwv455fog7qnb2azi5xcdxkixughmmduzbw2rtdgryqfbh6id.onion/company/BATAAAB","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--8dd75cf6-9d6f-538e-8c2c-001296f1f0d9","created":"2026-10-15T06:37:21Z","modified":"2026-10-15T06:37:21Z","name":"Alma Center Servizi Medicali S.r.l.","identity_class":"organization","sectors":["healthcare"],"country":"IT"},{"type":"relationship","spec_version":"2.1","id":"relationship--0e4ed855-51de-5e08-8449-2a4e0587d24a","created":"2026-10-15T06:37:21Z","modified":"2026-10-15T06:37:21Z","relationship_type":"targets","source_ref":"threat-actor--3f7930ac-0e74-5fe8-99d9-c1236dcdc5e7","target_ref":"identity--8dd75cf6-9d6f-538e-8c2c-001296f1f0d9","start_time":"2026-10-15T06:37:21Z","description":"Ransomware claim against Alma Center Servizi Medicali S.r.l. by spacebears.","external_references":[{"source_name":"spacebears","url":"http://5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid.onion/companies/79/alma-center-servizi-medicali-srl","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--ca9ae016-b270-5bb3-b1bf-d8e7a0627397","created":"2026-10-15T06:37:21Z","modified":"2026-10-15T06:37:21Z","name":"Holistic Health Group, Inc.","identity_class":"organization","sectors":["manufacturing"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--8329d655-0cb2-58a9-8c4c-83a5ef10f991","created":"2026-10-15T06:37:21Z","modified":"2026-10-15T06:37:21Z","relationship_type":"targets","source_ref":"threat-actor--3f7930ac-0e74-5fe8-99d9-c1236dcdc5e7","target_ref":"identity--ca9ae016-b270-5bb3-b1bf-d8e7a0627397","start_time":"2026-10-15T06:37:21Z","description":"Ransomware claim against Holistic Health Group, Inc. by spacebears.","external_references":[{"source_name":"spacebears","url":"http://5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid.onion/companies/78/holistic-health-group-inc-dba-suncrafted","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--18317125-3b25-5941-ae27-510bde306efe","created":"2026-10-15T20:03:28Z","modified":"2026-10-15T21:38:27Z","name":"KD Corp","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--14e48ece-2b9b-5b72-93fc-4d37c3afb792","created":"2026-10-15T00:00:00Z","modified":"2026-10-15T21:38:27Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--18317125-3b25-5941-ae27-510bde306efe","start_time":"2026-10-15T00:00:00Z","description":"Ransomware claim against KD Corp by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=ffc7f386-782e-433a-aa1d-e7e92c6b44fe","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--fca79279-844b-5f75-b2ee-6ee482bfdb24","created":"2026-10-15T20:03:28Z","modified":"2026-10-15T20:03:28Z","name":"Segres Systec","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--45abd67d-2e3e-595a-8d42-77e3b3c4170f","created":"2026-10-15T00:00:00Z","modified":"2026-10-15T20:03:28Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--fca79279-844b-5f75-b2ee-6ee482bfdb24","start_time":"2026-10-15T00:00:00Z","description":"Ransomware claim against Segres Systec by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=c2bff0b0-ad78-414d-b29b-9a3ddfcd59b0","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--cf9d3875-112c-5e1b-bc97-0918297fa6ed","created":"2026-10-15T20:03:28Z","modified":"2026-10-15T20:03:28Z","name":"Hocon Gas","identity_class":"organization","sectors":["energy-utilities"]},{"type":"relationship","spec_version":"2.1","id":"relationship--21a973e5-1b54-541e-a737-d20883309c26","created":"2026-10-15T00:00:00Z","modified":"2026-10-15T20:03:28Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--cf9d3875-112c-5e1b-bc97-0918297fa6ed","start_time":"2026-10-15T00:00:00Z","description":"Ransomware claim against Hocon Gas by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=bbae74d9-11f0-4687-ae26-cb89acd01eb4","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--3d8a72d3-8a06-57a2-a6b9-2ac7edf1089a","created":"2026-10-15T20:03:28Z","modified":"2026-10-15T20:03:28Z","name":"The Excalibur Group","identity_class":"organization","sectors":["professional-services"]},{"type":"relationship","spec_version":"2.1","id":"relationship--15b51cf7-70ba-5fe2-a3d5-e1cc80a63bfe","created":"2026-10-15T00:00:00Z","modified":"2026-10-15T20:03:28Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--3d8a72d3-8a06-57a2-a6b9-2ac7edf1089a","start_time":"2026-10-15T00:00:00Z","description":"Ransomware claim against The Excalibur Group by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=b5c41839-38f6-4dc1-b4ce-1c93373b9405","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--c605a61e-07e5-58d6-96b9-7eb916b4b7bf","created":"2026-10-15T20:03:28Z","modified":"2026-10-15T20:03:28Z","name":"HyperGen Solutions","identity_class":"organization","sectors":["technology"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--a22c20b8-2280-50b2-a1c2-411b9e8809f1","created":"2026-10-15T00:00:00Z","modified":"2026-10-15T20:03:28Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--c605a61e-07e5-58d6-96b9-7eb916b4b7bf","start_time":"2026-10-15T00:00:00Z","description":"Ransomware claim against HyperGen Solutions by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=aa2f1bf5-2d3b-4729-b069-ab39fa13da98","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--156184bc-e494-5179-927d-b2acda8b8047","created":"2026-10-15T20:03:28Z","modified":"2026-10-15T20:03:28Z","name":"Telcoe Federal Credit Union","identity_class":"organization","sectors":["financial-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--cc427e9e-b81b-5fdf-a4d7-0fc158441d61","created":"2026-10-15T00:00:00Z","modified":"2026-10-15T20:03:28Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--156184bc-e494-5179-927d-b2acda8b8047","start_time":"2026-10-15T00:00:00Z","description":"Ransomware claim against Telcoe Federal Credit Union by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=73b16550-d65c-4aba-a3ee-88b2b44452ca","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--ac3df469-6354-5c6d-8b91-d4d5caede4b4","created":"2026-10-15T21:04:26Z","modified":"2026-10-15T21:04:26Z","name":"Kemlows Diecasting Products Limited","identity_class":"organization","sectors":["manufacturing"]},{"type":"relationship","spec_version":"2.1","id":"relationship--47b7ca19-dfac-547a-aa35-bf35a7a3fefc","created":"2026-10-15T00:00:00Z","modified":"2026-10-15T21:04:26Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--ac3df469-6354-5c6d-8b91-d4d5caede4b4","start_time":"2026-10-15T00:00:00Z","description":"Ransomware claim against Kemlows Diecasting Products Limited by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=4a91246b-aea6-4278-be5c-8a55947c0bd6","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--7a51e60a-3a7e-5cd7-b397-b4d14efde490","created":"2026-10-15T20:03:28Z","modified":"2026-10-15T20:03:28Z","name":"Chattanooga Shooting Supplies","identity_class":"organization","sectors":["other"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--48de58a0-e8eb-5fa0-b166-a99e7bfb52e2","created":"2026-10-15T00:00:00Z","modified":"2026-10-15T20:03:28Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--7a51e60a-3a7e-5cd7-b397-b4d14efde490","start_time":"2026-10-15T00:00:00Z","description":"Ransomware claim against Chattanooga Shooting Supplies by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=466ea5fa-3596-49d6-ae8c-3ab69a9879e2","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--eca9f1c3-931b-519d-8541-9eaf5e61a7a5","created":"2026-10-15T20:03:28Z","modified":"2026-10-15T20:03:28Z","name":"Brame Telecom","identity_class":"organization","sectors":["telecommunications"]},{"type":"relationship","spec_version":"2.1","id":"relationship--d51fb234-bb27-5850-aafb-9200bf908175","created":"2026-10-15T00:00:00Z","modified":"2026-10-15T20:03:28Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--eca9f1c3-931b-519d-8541-9eaf5e61a7a5","start_time":"2026-10-15T00:00:00Z","description":"Ransomware claim against Brame Telecom by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=37defa29-f502-4356-ace7-c32811790070","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--412cabfd-069c-5821-bde7-6dbb2ff4d202","created":"2026-10-15T20:03:28Z","modified":"2026-10-15T20:03:28Z","name":"Shield Wall Systems of Florida","identity_class":"organization","sectors":["professional-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--42499acb-3337-56be-93e3-f914fb8b7252","created":"2026-10-15T00:00:00Z","modified":"2026-10-15T20:03:28Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--412cabfd-069c-5821-bde7-6dbb2ff4d202","start_time":"2026-10-15T00:00:00Z","description":"Ransomware claim against Shield Wall Systems of Florida by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=17e6b9a4-c3b3-4957-a5ad-65981f83faa6","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--ec3d062a-9064-567a-b331-516f9742ef3c","created":"2026-10-15T20:03:28Z","modified":"2026-10-15T20:03:28Z","name":"Commune Du Tampon","identity_class":"organization","sectors":["government-public-sector"],"country":"FR"},{"type":"relationship","spec_version":"2.1","id":"relationship--8757153a-7ef3-5825-9c81-230fa070959c","created":"2026-10-15T00:00:00Z","modified":"2026-10-15T20:03:28Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--ec3d062a-9064-567a-b331-516f9742ef3c","start_time":"2026-10-15T00:00:00Z","description":"Ransomware claim against Commune Du Tampon by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=17857655-4f48-478d-95f2-8b1f5b8cf529","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--38b7cd18-1a4b-509e-8cb7-55bbfeb3d79d","created":"2026-10-15T21:04:26Z","modified":"2026-10-15T21:04:26Z","name":"Keio Corporation","identity_class":"organization","sectors":["professional-services"],"country":"JP"},{"type":"relationship","spec_version":"2.1","id":"relationship--69380c32-de8b-5cb9-b2a4-9c7537a2580b","created":"2026-10-15T00:00:00Z","modified":"2026-10-15T21:04:26Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--38b7cd18-1a4b-509e-8cb7-55bbfeb3d79d","start_time":"2026-10-15T00:00:00Z","description":"Ransomware claim against Keio Corporation by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=09d2df3d-43e6-4548-9df6-d318272878e0","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--a64dc911-12de-538e-ac32-93f66c395b03","created":"2026-10-14T22:03:18Z","modified":"2026-10-14T22:03:18Z","name":"Crinetics","identity_class":"organization","sectors":["technology"]},{"type":"relationship","spec_version":"2.1","id":"relationship--5d6a596e-f18f-52d3-9d85-e9d9a6437a25","created":"2026-10-14T22:03:18Z","modified":"2026-10-14T22:03:18Z","relationship_type":"targets","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"identity--a64dc911-12de-538e-ac32-93f66c395b03","start_time":"2026-10-14T22:03:18Z","description":"Ransomware claim against Crinetics by lockbit3.","external_references":[{"source_name":"lockbit3","url":"http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/post/yJCz4MQYog93PSqR663cc92f0415a","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--8c252e7b-4735-54cf-9b11-571277d9176a","created":"2026-10-14T19:05:07Z","modified":"2026-10-14T19:05:07Z","name":"BNP Media","identity_class":"organization","sectors":["media-entertainment"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--5d27853b-f3a2-555a-8393-42f63313c8c5","created":"2026-10-14T19:05:07Z","modified":"2026-10-14T19:05:07Z","relationship_type":"targets","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"identity--8c252e7b-4735-54cf-9b11-571277d9176a","start_time":"2026-10-14T19:05:07Z","description":"Ransomware claim against BNP Media by lockbit3.","external_references":[{"source_name":"lockbit3","url":"http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/post/al0hCjlsWICxv7er663ca9d3eb52e","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--9be92294-4179-5333-9e3a-b8ea479d0177","created":"2026-10-14T19:12:28Z","modified":"2026-10-14T19:12:28Z","name":"Interior Technologies","identity_class":"organization","sectors":["technology"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--eea2d927-e4d7-55b9-a9a2-845ad52f578f","created":"2026-10-14T18:00:00Z","modified":"2026-10-14T19:12:28Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--9be92294-4179-5333-9e3a-b8ea479d0177","start_time":"2026-10-14T18:00:00Z","description":"Ransomware claim against Interior Technologies by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#interior-technologies","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--f5e79e56-0cd5-5278-8eea-68e721997335","created":"2026-10-14T17:10:50Z","modified":"2026-10-14T17:10:50Z","name":"Taiwan Otsuka Pharmaceutical","identity_class":"organization","sectors":["healthcare"],"country":"TW"},{"type":"relationship","spec_version":"2.1","id":"relationship--c5baa76d-6018-51fc-9b4f-bbb0d2ee0da7","created":"2026-10-14T17:10:50Z","modified":"2026-10-14T17:10:50Z","relationship_type":"targets","source_ref":"threat-actor--8363ac67-854b-5be6-975e-0f003b5bbc5e","target_ref":"identity--f5e79e56-0cd5-5278-8eea-68e721997335","start_time":"2026-10-14T17:10:50Z","description":"Ransomware claim against Taiwan Otsuka Pharmaceutical by eclipse.","external_references":[{"source_name":"eclipse","url":"http://eclipse4g5kxfwsvpu4qx5sdcnrji6gxl5gt67bucjlgt35g7akvjoid.onion/place/0gaa86a0todvfnu7","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--15c0d134-983f-5dd4-8b62-ca19bbafc106","created":"2026-10-14T16:04:19Z","modified":"2026-10-14T16:04:19Z","name":"Core Engineering LLC","identity_class":"organization","sectors":["professional-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--a5eebbd3-4d3a-577d-95e5-7fb99ceea3d1","created":"2026-10-14T16:04:19Z","modified":"2026-10-14T16:04:19Z","relationship_type":"targets","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"identity--15c0d134-983f-5dd4-8b62-ca19bbafc106","start_time":"2026-10-14T16:04:19Z","description":"Ransomware claim against Core Engineering LLC by lockbit3.","external_references":[{"source_name":"lockbit3","url":"http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/post/eDKGaLUEpCAWYbNO66b9eae460946","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--81e442ee-0938-5338-863c-9152b2805f2d","created":"2026-10-14T16:03:15Z","modified":"2026-10-14T16:03:15Z","name":"FINANCIAMENTO LTDA","identity_class":"organization","sectors":["financial-services"],"country":"BR"},{"type":"relationship","spec_version":"2.1","id":"relationship--7e04a8ed-39f5-53a2-9054-045a44746cbd","created":"2026-10-14T15:26:04Z","modified":"2026-10-14T16:03:15Z","relationship_type":"targets","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"identity--81e442ee-0938-5338-863c-9152b2805f2d","start_time":"2026-10-14T15:26:04Z","description":"Ransomware claim against FINANCIAMENTO LTDA by incransom.","external_references":[{"source_name":"incransom","url":"http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/6acf9f0c9cd108bf26c1cfa1","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--bf9fbd4c-6689-5ce7-9ea5-93ec458cf22d","created":"2026-09-30T14:13:15Z","modified":"2026-10-14T15:11:17Z","name":"SitePro Rentals","identity_class":"organization","sectors":["professional-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--3663214c-772e-50d9-ae7d-0fe51964fba9","created":"2026-10-14T15:05:00Z","modified":"2026-10-14T15:11:17Z","relationship_type":"targets","source_ref":"threat-actor--34221ba3-936e-50ef-a0ee-676bb412a537","target_ref":"identity--bf9fbd4c-6689-5ce7-9ea5-93ec458cf22d","start_time":"2026-10-14T15:05:00Z","description":"Ransomware claim against SitePro Rentals by emperador.","external_references":[{"source_name":"emperador","url":"http://emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion/post/sitepro-rentals","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--f1385178-1b10-50e8-9793-0c96a7387dc1","created":"2026-10-14T13:09:08Z","modified":"2026-10-14T13:09:08Z","name":"Green Clinic","identity_class":"organization","sectors":["healthcare"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--e81eccaf-e8a7-504b-834a-b1a4f0cadbbd","created":"2026-10-14T13:09:08Z","modified":"2026-10-14T13:09:08Z","relationship_type":"targets","source_ref":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","target_ref":"identity--f1385178-1b10-50e8-9793-0c96a7387dc1","start_time":"2026-10-14T13:09:08Z","description":"Ransomware claim against Green Clinic by wallstreet.","external_references":[{"source_name":"wallstreet","url":"http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/#green-clinic","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--ed428332-8aec-5b77-b638-86f35a84d76e","created":"2026-10-14T13:09:08Z","modified":"2026-10-14T13:09:08Z","name":"E-Z Pack Trucks","identity_class":"organization","sectors":["manufacturing"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--cf4216f6-55b1-52cd-a095-001ad68d2730","created":"2026-10-14T13:09:08Z","modified":"2026-10-14T13:09:08Z","relationship_type":"targets","source_ref":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","target_ref":"identity--ed428332-8aec-5b77-b638-86f35a84d76e","start_time":"2026-10-14T13:09:08Z","description":"Ransomware claim against E-Z Pack Trucks by wallstreet.","external_references":[{"source_name":"wallstreet","url":"http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/#e-z-pack-trucks","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--59fee26c-2cd6-5c4e-b24a-6272e70c1a4d","created":"2026-10-14T12:11:09Z","modified":"2026-10-14T12:11:09Z","name":"Trieschmann Dumala Architectural Group","identity_class":"organization","sectors":["professional-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--1a5400ae-ab93-5329-b599-d21ef5766588","created":"2026-10-14T12:11:09Z","modified":"2026-10-14T12:11:09Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--59fee26c-2cd6-5c4e-b24a-6272e70c1a4d","start_time":"2026-10-14T12:11:09Z","description":"Ransomware claim against Trieschmann Dumala Architectural Group by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#trieschmann-dumala-architectural-group","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--9c0dee7f-442f-52d0-8b51-38a5532d4e37","created":"2026-10-14T11:09:33Z","modified":"2026-10-14T11:09:33Z","name":"Specchem LLC","identity_class":"organization","sectors":["manufacturing"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--c00cb61e-0f23-5ce7-8f8e-663826079b79","created":"2026-10-14T10:32:45Z","modified":"2026-10-14T11:09:33Z","relationship_type":"targets","source_ref":"threat-actor--630da242-8e2d-5710-ae7c-407f35619795","target_ref":"identity--9c0dee7f-442f-52d0-8b51-38a5532d4e37","start_time":"2026-10-14T10:32:45Z","description":"Ransomware claim against Specchem LLC by dark project.","external_references":[{"source_name":"dark project","url":"http://darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion/article?slug=specchem-llc","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--5188b11a-fdf7-587b-8e35-88f04e7b6279","created":"2026-10-14T10:07:09Z","modified":"2026-10-14T10:07:09Z","name":"Estrategias BigMat S.L.U.","identity_class":"organization","sectors":["construction"],"country":"ES"},{"type":"relationship","spec_version":"2.1","id":"relationship--ad46056d-2851-5966-ad1c-5c0c6e527cb1","created":"2026-10-14T10:07:09Z","modified":"2026-10-14T10:07:09Z","relationship_type":"targets","source_ref":"threat-actor--e6361d0a-0132-5091-8c65-965b024e655f","target_ref":"identity--5188b11a-fdf7-587b-8e35-88f04e7b6279","start_time":"2026-10-14T10:07:09Z","description":"Ransomware claim against Estrategias BigMat S.L.U. by aurora.","external_references":[{"source_name":"aurora","url":"http://u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion/blog/estrategias-bigmat-slu-86da2d8a","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--312b7f16-fe4f-5b8d-9551-e0530e477a1e","created":"2026-10-14T10:04:17Z","modified":"2026-10-14T10:04:17Z","name":"Harwood Lloyd Ltd.","identity_class":"organization","sectors":["professional-services"],"country":"GB"},{"type":"relationship","spec_version":"2.1","id":"relationship--54f3702e-65bf-58ca-adb5-ced5aa9c1ac5","created":"2026-10-14T10:04:17Z","modified":"2026-10-14T10:04:17Z","relationship_type":"targets","source_ref":"threat-actor--20f5687c-3bc2-5a66-90fd-ffa03ea58f1d","target_ref":"identity--312b7f16-fe4f-5b8d-9551-e0530e477a1e","start_time":"2026-10-14T10:04:17Z","description":"Ransomware claim against Harwood Lloyd Ltd. by lockbit3.","external_references":[{"source_name":"lockbit3","url":"http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion/post/drmDpV81yAMZDfND6638f22950ffe","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--383142e2-6884-55c7-a792-550d54993de6","created":"2026-10-14T09:11:12Z","modified":"2026-10-14T09:11:12Z","name":"MyM ODONTOCLINICA S.A","identity_class":"organization","sectors":["healthcare"],"country":"PY"},{"type":"relationship","spec_version":"2.1","id":"relationship--a3ea9b14-e42e-5d82-9c2e-c5c7b70d97b6","created":"2026-10-14T08:49:00Z","modified":"2026-10-14T09:11:12Z","relationship_type":"targets","source_ref":"threat-actor--34221ba3-936e-50ef-a0ee-676bb412a537","target_ref":"identity--383142e2-6884-55c7-a792-550d54993de6","start_time":"2026-10-14T08:49:00Z","description":"Ransomware claim against MyM ODONTOCLINICA S.A by emperador.","external_references":[{"source_name":"emperador","url":"http://emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion/post/mym-odontoclinica-sa","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--29ec4035-cd9a-5cc5-b76e-018968e4d830","created":"2026-10-14T05:09:09Z","modified":"2026-10-14T05:09:09Z","name":"Orient Corporation","identity_class":"organization","sectors":["manufacturing"],"country":"SG"},{"type":"relationship","spec_version":"2.1","id":"relationship--14488230-8f88-58c2-8917-8c298400b352","created":"2026-10-14T04:58:11Z","modified":"2026-10-14T05:09:09Z","relationship_type":"targets","source_ref":"threat-actor--b32cb61b-df5e-5e13-a0ef-3ff18cbba65a","target_ref":"identity--29ec4035-cd9a-5cc5-b76e-018968e4d830","start_time":"2026-10-14T04:58:11Z","description":"Ransomware claim against Orient Corporation by orova.","external_references":[{"source_name":"orova","url":"http://mll5ddmdzgiq2siv3qnocmmqyiigfpajtc663xtf32qtp6weycyx2hyd.onion/#orient-corporation","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--f2ae414d-664e-52cf-847d-9059f34f7564","created":"2026-10-14T05:09:09Z","modified":"2026-10-14T05:09:09Z","name":"Bright Property Service","identity_class":"organization","sectors":["real-estate"],"country":"MY"},{"type":"relationship","spec_version":"2.1","id":"relationship--7084c346-bc44-560f-8159-4f56a8b36f2b","created":"2026-10-14T04:54:04Z","modified":"2026-10-14T05:09:09Z","relationship_type":"targets","source_ref":"threat-actor--b32cb61b-df5e-5e13-a0ef-3ff18cbba65a","target_ref":"identity--f2ae414d-664e-52cf-847d-9059f34f7564","start_time":"2026-10-14T04:54:04Z","description":"Ransomware claim against Bright Property Service by orova.","external_references":[{"source_name":"orova","url":"http://mll5ddmdzgiq2siv3qnocmmqyiigfpajtc663xtf32qtp6weycyx2hyd.onion/#bright-property-service","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--acb46d1d-9264-5893-ad64-0f0c62202690","created":"2026-10-14T01:07:38Z","modified":"2026-10-14T01:07:38Z","name":"Lane Equipment","identity_class":"organization","sectors":["construction"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--ec4a7ddc-c16b-5b08-87e3-49b4b9a421f0","created":"2026-10-14T01:07:38Z","modified":"2026-10-14T01:07:38Z","relationship_type":"targets","source_ref":"threat-actor--6d35c979-6c3c-5b4a-8861-8ea4e2322054","target_ref":"identity--acb46d1d-9264-5893-ad64-0f0c62202690","start_time":"2026-10-14T01:07:38Z","description":"Ransomware claim against Lane Equipment by dragonforce.","external_references":[{"source_name":"dragonforce","url":"http://xjhmtitnrdrgzw4vmsghirdoo2fk35a3tzj4enlmah4pvehdspydsiyd.onion/blog#lane-equipment","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--98693a55-0693-5c77-aa75-9b05cd1c46ce","created":"2026-10-14T17:04:18Z","modified":"2026-10-14T17:04:18Z","name":"Oceania Digital Communications","identity_class":"organization","sectors":["technology"],"country":"VU"},{"type":"relationship","spec_version":"2.1","id":"relationship--1470d090-53e0-5d6b-a47a-223daffde3af","created":"2026-10-14T00:00:00Z","modified":"2026-10-14T17:04:18Z","relationship_type":"targets","source_ref":"threat-actor--00795ca5-982e-5b8f-980f-534064e71325","target_ref":"identity--98693a55-0693-5c77-aa75-9b05cd1c46ce","start_time":"2026-10-14T00:00:00Z","description":"Ransomware claim against Oceania Digital Communications by kairos.","external_references":[{"source_name":"kairos","url":"http://kairosgeuzkzz3ajntqcyxl3ib36szz3mg62mb3zbui33pbk3uzo4qqd.onion/service/357?page=1","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--a05a466d-40cd-5a1b-a59c-b402bcdc5a29","created":"2026-10-14T16:05:40Z","modified":"2026-10-14T16:05:40Z","name":"Joliet Public Schools District 86","identity_class":"organization","sectors":["education"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--fc8af103-7194-59c5-9a7a-0f7b3e9560cf","created":"2026-10-14T00:00:00Z","modified":"2026-10-14T16:05:40Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--a05a466d-40cd-5a1b-a59c-b402bcdc5a29","start_time":"2026-10-14T00:00:00Z","description":"Ransomware claim against Joliet Public Schools District 86 by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=63e77859-80a2-418f-ac13-e0dc0492339a","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--f717f53e-e25f-51a4-91a1-e41edb950c3f","created":"2026-10-14T15:06:16Z","modified":"2026-10-14T15:06:16Z","name":"MOA Architecture","identity_class":"organization","sectors":["professional-services"]},{"type":"relationship","spec_version":"2.1","id":"relationship--4c6d4fbb-0080-5847-9be4-357a992d6f23","created":"2026-10-14T00:00:00Z","modified":"2026-10-14T15:06:16Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--f717f53e-e25f-51a4-91a1-e41edb950c3f","start_time":"2026-10-14T00:00:00Z","description":"Ransomware claim against MOA Architecture by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=14137818-4d18-4e68-9e9b-8855af8cfbbd","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--c6831d46-241a-56bf-929b-9bd9eda1c29a","created":"2026-10-13T23:07:47Z","modified":"2026-10-13T23:07:47Z","name":"Company #65","identity_class":"organization","sectors":["manufacturing"],"country":"BR"},{"type":"relationship","spec_version":"2.1","id":"relationship--4ac8a2b0-8574-5e8a-8d34-0227645bcfdc","created":"2026-10-13T23:07:47Z","modified":"2026-10-13T23:07:47Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--c6831d46-241a-56bf-929b-9bd9eda1c29a","start_time":"2026-10-13T23:07:47Z","description":"Ransomware claim against Company #65 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-65","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--43a76e2a-406a-548f-99f2-e2cf30a4a6fb","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","name":"Vendus Sweden AB","identity_class":"organization","sectors":["real-estate"],"country":"SE"},{"type":"relationship","spec_version":"2.1","id":"relationship--adf51613-5a54-5cbf-b856-7d4e1bce07b3","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","relationship_type":"targets","source_ref":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","target_ref":"identity--43a76e2a-406a-548f-99f2-e2cf30a4a6fb","start_time":"2026-10-13T17:06:16Z","description":"Ransomware claim against Vendus Sweden AB by wallstreet.","external_references":[{"source_name":"wallstreet","url":"http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/#vendus-sweden-ab","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--3d30b890-ff80-5c4f-a075-7f19c39d8a98","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","name":"Spectrum Arkitekter AB","identity_class":"organization","sectors":["professional-services"],"country":"SE"},{"type":"relationship","spec_version":"2.1","id":"relationship--4f8164c2-7b02-51fc-b54c-613e8124cfef","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","relationship_type":"targets","source_ref":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","target_ref":"identity--3d30b890-ff80-5c4f-a075-7f19c39d8a98","start_time":"2026-10-13T17:06:16Z","description":"Ransomware claim against Spectrum Arkitekter AB by wallstreet.","external_references":[{"source_name":"wallstreet","url":"http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/#spectrum-arkitekter-ab","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--5b41b145-8892-536f-b3ba-e784d1eedf9e","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","name":"Mantum Holding AB","identity_class":"organization","sectors":["other"],"country":"SE"},{"type":"relationship","spec_version":"2.1","id":"relationship--365f1abc-5f57-5514-9154-cbe0a6ed2820","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","relationship_type":"targets","source_ref":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","target_ref":"identity--5b41b145-8892-536f-b3ba-e784d1eedf9e","start_time":"2026-10-13T17:06:16Z","description":"Ransomware claim against Mantum Holding AB by wallstreet.","external_references":[{"source_name":"wallstreet","url":"http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/#mantum-holding-ab","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--8758e206-f3d1-5590-9e03-b617d5b176dd","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","name":"Lambertinum Seniorenwohnanlage","identity_class":"organization","sectors":["healthcare"],"country":"DE"},{"type":"relationship","spec_version":"2.1","id":"relationship--b22f9c67-f12d-58e0-9370-571f0ff92164","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","relationship_type":"targets","source_ref":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","target_ref":"identity--8758e206-f3d1-5590-9e03-b617d5b176dd","start_time":"2026-10-13T17:06:16Z","description":"Ransomware claim against Lambertinum Seniorenwohnanlage by wallstreet.","external_references":[{"source_name":"wallstreet","url":"http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/#lambertinum-seniorenwohnanlage","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--1773d562-6d90-52e9-a1d2-89498749979b","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","name":"Fab Support AB","identity_class":"organization","sectors":["telecommunications"],"country":"SE"},{"type":"relationship","spec_version":"2.1","id":"relationship--308a3cdf-af9f-5bda-9c6e-a68007e49656","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","relationship_type":"targets","source_ref":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","target_ref":"identity--1773d562-6d90-52e9-a1d2-89498749979b","start_time":"2026-10-13T17:06:16Z","description":"Ransomware claim against Fab Support AB by wallstreet.","external_references":[{"source_name":"wallstreet","url":"http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/#fab-support-ab","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--5c2a3177-0c8e-5271-914c-f4b1db991238","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","name":"Englund Konsultbyrå AB","identity_class":"organization","sectors":["professional-services"],"country":"SE"},{"type":"relationship","spec_version":"2.1","id":"relationship--e5881c0d-0569-579e-af73-5396b0408a5b","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","relationship_type":"targets","source_ref":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","target_ref":"identity--5c2a3177-0c8e-5271-914c-f4b1db991238","start_time":"2026-10-13T17:06:16Z","description":"Ransomware claim against Englund Konsultbyrå AB by wallstreet.","external_references":[{"source_name":"wallstreet","url":"http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/#englunds-konsultbyrå-ab","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--01256ba1-a69f-569b-a0de-239a00517f10","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","name":"Danvikshem (Stiftelsen Danviks Hospital)","identity_class":"organization","sectors":["healthcare"],"country":"SE"},{"type":"relationship","spec_version":"2.1","id":"relationship--6596a37c-af2e-5ff8-86b5-be81ba79310f","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","relationship_type":"targets","source_ref":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","target_ref":"identity--01256ba1-a69f-569b-a0de-239a00517f10","start_time":"2026-10-13T17:06:16Z","description":"Ransomware claim against Danvikshem (Stiftelsen Danviks Hospital) by wallstreet.","external_references":[{"source_name":"wallstreet","url":"http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/#danvikshem--stiftelsen-danviks-hospital","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--812d8b78-6a8b-596b-b601-fb15cdcad75e","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","name":"Byrån för Arkitektur och Urbanism","identity_class":"organization","sectors":["professional-services"],"country":"SE"},{"type":"relationship","spec_version":"2.1","id":"relationship--55286fbc-bdeb-59fc-afce-a87d1fc0cf1f","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","relationship_type":"targets","source_ref":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","target_ref":"identity--812d8b78-6a8b-596b-b601-fb15cdcad75e","start_time":"2026-10-13T17:06:16Z","description":"Ransomware claim against Byrån för Arkitektur och Urbanism by wallstreet.","external_references":[{"source_name":"wallstreet","url":"http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/#byrån-för-arkitektur-och-urbanism","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--87682f9e-9a18-5aee-abd8-c7ffeaeee7c1","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","name":"Brunnberg & Forshed Arkitektkontor","identity_class":"organization","sectors":["professional-services"],"country":"SE"},{"type":"relationship","spec_version":"2.1","id":"relationship--3c606c89-3201-5a2a-aba0-9a84fc7fd556","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","relationship_type":"targets","source_ref":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","target_ref":"identity--87682f9e-9a18-5aee-abd8-c7ffeaeee7c1","start_time":"2026-10-13T17:06:16Z","description":"Ransomware claim against Brunnberg & Forshed Arkitektkontor by wallstreet.","external_references":[{"source_name":"wallstreet","url":"http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/#brunnberg---forshed-arkitektkontor","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--d1f82f7e-8b05-5ec6-947a-983ad5bde2ae","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","name":"Briab Group AB","identity_class":"organization","country":"SE"},{"type":"relationship","spec_version":"2.1","id":"relationship--e3506ba0-c2ff-52b3-a8ba-d77289432892","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","relationship_type":"targets","source_ref":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","target_ref":"identity--d1f82f7e-8b05-5ec6-947a-983ad5bde2ae","start_time":"2026-10-13T17:06:16Z","description":"Ransomware claim against Briab Group AB by wallstreet.","external_references":[{"source_name":"wallstreet","url":"http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/#briab-group-ab","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--bef35751-1c52-570f-8bc9-2194d8255855","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","name":"Ahlqvist & Almqvist Arkitekter AB","identity_class":"organization","sectors":["professional-services"],"country":"SE"},{"type":"relationship","spec_version":"2.1","id":"relationship--271752b8-6b4a-531e-834f-f313022bd080","created":"2026-10-13T17:06:16Z","modified":"2026-10-13T17:06:16Z","relationship_type":"targets","source_ref":"threat-actor--a667244c-8c3c-56af-9543-04f4f848ab8a","target_ref":"identity--bef35751-1c52-570f-8bc9-2194d8255855","start_time":"2026-10-13T17:06:16Z","description":"Ransomware claim against Ahlqvist & Almqvist Arkitekter AB by wallstreet.","external_references":[{"source_name":"wallstreet","url":"http://4dwiv37h7hhuhjpvtn72hme4ylcv3qoe65arfc6mbweal7als6ma7pyd.onion/#ahlqvist---almqvist-arkitekter-ab","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--0cb58d4e-1fb6-5b36-b842-dd9dec8203c1","created":"2026-10-13T15:07:25Z","modified":"2026-10-13T15:07:25Z","name":"Company #64","identity_class":"organization","sectors":["healthcare"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--1fbd3c5f-94ca-5e5d-849f-0b48c647eab6","created":"2026-10-13T15:07:25Z","modified":"2026-10-13T15:07:25Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--0cb58d4e-1fb6-5b36-b842-dd9dec8203c1","start_time":"2026-10-13T15:07:25Z","description":"Ransomware claim against Company #64 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-64","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--d8187314-25c7-529a-827d-849db849a847","created":"2026-10-13T14:02:14Z","modified":"2026-10-13T14:02:14Z","name":"Great Lakes Institute of Management","identity_class":"organization","sectors":["education"],"country":"IN"},{"type":"relationship","spec_version":"2.1","id":"relationship--c7bf89dd-e632-569e-8dbd-57391e057e02","created":"2026-10-13T13:47:02Z","modified":"2026-10-13T14:02:14Z","relationship_type":"targets","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"identity--d8187314-25c7-529a-827d-849db849a847","start_time":"2026-10-13T13:47:02Z","description":"Ransomware claim against Great Lakes Institute of Management by incransom.","external_references":[{"source_name":"incransom","url":"http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/6ace36569cd108bf2694586b","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--37e497b0-9281-5a1c-b6ad-e9c661b333dd","created":"2026-10-13T15:07:25Z","modified":"2026-10-13T15:07:25Z","name":"Hunter Neurology","identity_class":"organization","sectors":["healthcare"],"country":"AU"},{"type":"relationship","spec_version":"2.1","id":"relationship--32b74e1b-e9a5-5e5b-bc10-614ef0f72664","created":"2026-10-13T12:37:00Z","modified":"2026-10-13T15:07:25Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--37e497b0-9281-5a1c-b6ad-e9c661b333dd","start_time":"2026-10-13T12:37:00Z","description":"Ransomware claim against Hunter Neurology by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#hunter-neurology","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--67562cdf-833f-58c9-8a8f-80426751b808","created":"2026-10-13T12:08:51Z","modified":"2026-10-13T12:08:51Z","name":"Company #63","identity_class":"organization","sectors":["professional-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--e39a380f-6d52-55aa-a676-ddb424e6e57b","created":"2026-10-13T12:08:51Z","modified":"2026-10-13T12:08:51Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--67562cdf-833f-58c9-8a8f-80426751b808","start_time":"2026-10-13T12:08:51Z","description":"Ransomware claim against Company #63 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-63","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--30b92010-a016-586a-8dae-d9a68f8c1cb0","created":"2026-10-13T12:03:33Z","modified":"2026-10-13T12:03:33Z","name":"Wolf & Sofsky GmbH","identity_class":"organization","sectors":["construction"],"country":"DE"},{"type":"relationship","spec_version":"2.1","id":"relationship--becc82a7-6ba7-5dd9-8ef7-f09fa2ee2d2d","created":"2026-10-13T12:03:13Z","modified":"2026-10-13T12:03:33Z","relationship_type":"targets","source_ref":"threat-actor--718b4d10-9ff5-5374-96f1-1d902b9dc182","target_ref":"identity--30b92010-a016-586a-8dae-d9a68f8c1cb0","start_time":"2026-10-13T12:03:13Z","description":"Ransomware claim against Wolf & Sofsky GmbH by incransom.","external_references":[{"source_name":"incransom","url":"http://incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion/blog/disclosures/6ace1e019cd108bf26913637","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--283be860-e64a-51d6-a19c-4c9b2ab9dba2","created":"2026-10-13T12:08:43Z","modified":"2026-10-13T12:08:43Z","name":"Guarufilme","identity_class":"organization","sectors":["manufacturing"]},{"type":"relationship","spec_version":"2.1","id":"relationship--4fddf0d3-ecbb-5f95-b77d-c7551ecf7df3","created":"2026-10-13T11:59:04Z","modified":"2026-10-13T12:08:43Z","relationship_type":"targets","source_ref":"threat-actor--11f62186-d1ed-551b-9f18-78fb1193ee72","target_ref":"identity--283be860-e64a-51d6-a19c-4c9b2ab9dba2","start_time":"2026-10-13T11:59:04Z","description":"Ransomware claim against Guarufilme by vexy ransomware.","external_references":[{"source_name":"vexy ransomware","url":"http://vexytsr3chimdz6siwaqi2lvxxwfkxvffkpwyanr2llequ2hkm56jvqd.onion/#box_v42","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--93c1e202-62af-5d91-8f52-b309046f5a0f","created":"2026-10-13T11:08:15Z","modified":"2026-10-13T11:08:15Z","name":"Company #25","identity_class":"organization","sectors":["healthcare"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--03068c3b-f27c-5093-bff8-0e1a074c9864","created":"2026-10-13T11:08:15Z","modified":"2026-10-13T11:08:15Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--93c1e202-62af-5d91-8f52-b309046f5a0f","start_time":"2026-10-13T11:08:15Z","description":"Ransomware claim against Company #25 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-25","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--2c530f2b-9b88-5dbb-855b-e70a3c3ae41c","created":"2026-10-13T10:08:32Z","modified":"2026-10-13T10:08:32Z","name":"CMC AUDITORES SRL","identity_class":"organization","sectors":["professional-services"],"country":"AR"},{"type":"relationship","spec_version":"2.1","id":"relationship--9b97db6f-704d-5425-8fcc-d722e3ff923e","created":"2026-10-13T09:46:00Z","modified":"2026-10-13T10:08:32Z","relationship_type":"targets","source_ref":"threat-actor--34221ba3-936e-50ef-a0ee-676bb412a537","target_ref":"identity--2c530f2b-9b88-5dbb-855b-e70a3c3ae41c","start_time":"2026-10-13T09:46:00Z","description":"Ransomware claim against CMC AUDITORES SRL by emperador.","external_references":[{"source_name":"emperador","url":"http://emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion/post/cmc-auditores-srl","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--fd434f87-9c0f-5a7f-befa-999f22b312c9","created":"2026-10-13T11:08:15Z","modified":"2026-10-13T11:08:15Z","name":"PG Group (Pure Options)","identity_class":"organization","sectors":["agriculture-food"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--986c12cb-268c-5468-beb9-21b919108d57","created":"2026-10-13T09:40:00Z","modified":"2026-10-13T11:08:15Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--fd434f87-9c0f-5a7f-befa-999f22b312c9","start_time":"2026-10-13T09:40:00Z","description":"Ransomware claim against PG Group (Pure Options) by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#pg-group-pure-options","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--124a2501-7b36-5e55-ba80-87c49a69002d","created":"2026-10-13T11:08:15Z","modified":"2026-10-13T11:08:15Z","name":"MarieBelle New York","identity_class":"organization","sectors":["manufacturing"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--22475cbd-35ea-5f7d-9b2b-b33292de185e","created":"2026-10-13T09:40:00Z","modified":"2026-10-13T11:08:15Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--124a2501-7b36-5e55-ba80-87c49a69002d","start_time":"2026-10-13T09:40:00Z","description":"Ransomware claim against MarieBelle New York by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#mariebelle-new-york","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--32c757d5-c622-5e3e-bd6e-1afe9d33b112","created":"2026-10-13T11:07:34Z","modified":"2026-10-13T11:07:34Z","name":"Detronics Pte Ltd","identity_class":"organization","sectors":["manufacturing"],"country":"SG"},{"type":"relationship","spec_version":"2.1","id":"relationship--2dd14050-5033-5248-af63-1426252c37cb","created":"2026-10-13T07:34:42Z","modified":"2026-10-13T11:07:34Z","relationship_type":"targets","source_ref":"threat-actor--b32cb61b-df5e-5e13-a0ef-3ff18cbba65a","target_ref":"identity--32c757d5-c622-5e3e-bd6e-1afe9d33b112","start_time":"2026-10-13T07:34:42Z","description":"Ransomware claim against Detronics Pte Ltd by orova.","external_references":[{"source_name":"orova","url":"http://mll5ddmdzgiq2siv3qnocmmqyiigfpajtc663xtf32qtp6weycyx2hyd.onion/#detronics-pte-ltd","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--49b6f3e7-dc39-593a-a4a3-4e415d84522a","created":"2026-10-13T07:09:07Z","modified":"2026-10-13T07:09:07Z","name":"Company #26","identity_class":"organization","sectors":["manufacturing"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--9784204c-23fd-5b4d-99e9-c0c96f965167","created":"2026-10-13T07:09:07Z","modified":"2026-10-13T07:09:07Z","relationship_type":"targets","source_ref":"threat-actor--2773604d-5edf-5db3-acb3-cab5f7d612de","target_ref":"identity--49b6f3e7-dc39-593a-a4a3-4e415d84522a","start_time":"2026-10-13T07:09:07Z","description":"Ransomware claim against Company #26 by n0n.","external_references":[{"source_name":"n0n","url":"http://nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion/#company-26","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--ea220f05-b927-5bb7-ae4e-9d0c5bcd8798","created":"2026-10-13T07:09:29Z","modified":"2026-10-13T07:09:29Z","name":"Alfameli Group","identity_class":"organization","sectors":["energy-utilities"],"country":"MY"},{"type":"relationship","spec_version":"2.1","id":"relationship--9a5c876a-491d-589b-bf74-9f1c31616bea","created":"2026-10-13T07:07:17Z","modified":"2026-10-13T07:09:29Z","relationship_type":"targets","source_ref":"threat-actor--b32cb61b-df5e-5e13-a0ef-3ff18cbba65a","target_ref":"identity--ea220f05-b927-5bb7-ae4e-9d0c5bcd8798","start_time":"2026-10-13T07:07:17Z","description":"Ransomware claim against Alfameli Group by orova.","external_references":[{"source_name":"orova","url":"http://mll5ddmdzgiq2siv3qnocmmqyiigfpajtc663xtf32qtp6weycyx2hyd.onion/#alfameli-group","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--db2ecefe-e096-583b-bc9e-463fbb64e8e0","created":"2026-10-13T07:06:29Z","modified":"2026-10-13T07:06:29Z","name":"The Buckner Company, Inc.","identity_class":"organization","sectors":["professional-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--86c8611d-f1aa-5586-b1a3-7b14fdad0a30","created":"2026-10-13T07:06:29Z","modified":"2026-10-13T07:06:29Z","relationship_type":"targets","source_ref":"threat-actor--e6361d0a-0132-5091-8c65-965b024e655f","target_ref":"identity--db2ecefe-e096-583b-bc9e-463fbb64e8e0","start_time":"2026-10-13T07:06:29Z","description":"Ransomware claim against The Buckner Company, Inc. by aurora.","external_references":[{"source_name":"aurora","url":"http://u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion/blog/the-buckner-company-inc-75b23ef0","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--eaa63141-c558-5411-afff-afe90a95c232","created":"2026-10-14T17:12:09Z","modified":"2026-10-14T17:12:09Z","name":"Merkez İlaç","identity_class":"organization","sectors":["manufacturing"],"country":"TR"},{"type":"relationship","spec_version":"2.1","id":"relationship--8531e2b4-a96c-51b2-91f4-c38d682c1595","created":"2026-10-13T06:16:39Z","modified":"2026-10-14T17:12:09Z","relationship_type":"targets","source_ref":"threat-actor--f990530f-0e8a-59f1-9889-fdcb91c25ba9","target_ref":"identity--eaa63141-c558-5411-afff-afe90a95c232","start_time":"2026-10-13T06:16:39Z","description":"Ransomware claim against Merkez İlaç by hyflock.","external_references":[{"source_name":"hyflock","url":"http://yhgphvfgaecacgtlbn67u7yfhafe6evnj4gs4s2oyb3hzjnlhq45azqd.onion/blog/view/1791872199828507435_r9kQ9W80","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--41f8796f-a60f-5df2-b701-452849455fcd","created":"2026-10-13T05:09:18Z","modified":"2026-10-13T05:09:18Z","name":"Codar (Pte) Ltd","identity_class":"organization","sectors":["manufacturing"],"country":"SG"},{"type":"relationship","spec_version":"2.1","id":"relationship--b51debe6-1c47-589d-9965-0329898bd544","created":"2026-10-13T04:58:10Z","modified":"2026-10-13T05:09:18Z","relationship_type":"targets","source_ref":"threat-actor--b32cb61b-df5e-5e13-a0ef-3ff18cbba65a","target_ref":"identity--41f8796f-a60f-5df2-b701-452849455fcd","start_time":"2026-10-13T04:58:10Z","description":"Ransomware claim against Codar (Pte) Ltd by orova.","external_references":[{"source_name":"orova","url":"http://mll5ddmdzgiq2siv3qnocmmqyiigfpajtc663xtf32qtp6weycyx2hyd.onion/#codar-pte-ltd","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--b8de42fc-1922-5362-86de-bbfd9a16c615","created":"2026-10-13T05:09:18Z","modified":"2026-10-13T05:09:18Z","name":"Durga Bearings","identity_class":"organization","sectors":["manufacturing"],"country":"IN"},{"type":"relationship","spec_version":"2.1","id":"relationship--7d0132cc-9cdf-5a2d-9d42-e59cad186754","created":"2026-10-13T04:51:59Z","modified":"2026-10-13T05:09:18Z","relationship_type":"targets","source_ref":"threat-actor--b32cb61b-df5e-5e13-a0ef-3ff18cbba65a","target_ref":"identity--b8de42fc-1922-5362-86de-bbfd9a16c615","start_time":"2026-10-13T04:51:59Z","description":"Ransomware claim against Durga Bearings by orova.","external_references":[{"source_name":"orova","url":"http://mll5ddmdzgiq2siv3qnocmmqyiigfpajtc663xtf32qtp6weycyx2hyd.onion/#durga-bearings","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--d684597f-d652-5fe6-b9bb-3cc946f9ed87","created":"2026-10-13T04:08:22Z","modified":"2026-10-13T04:08:22Z","name":"City Chain","identity_class":"organization","sectors":["retail-wholesale"],"country":"SG"},{"type":"relationship","spec_version":"2.1","id":"relationship--16098514-a89d-5c5a-a66f-7ee095f449d1","created":"2026-10-13T03:09:07Z","modified":"2026-10-13T04:08:22Z","relationship_type":"targets","source_ref":"threat-actor--b32cb61b-df5e-5e13-a0ef-3ff18cbba65a","target_ref":"identity--d684597f-d652-5fe6-b9bb-3cc946f9ed87","start_time":"2026-10-13T03:09:07Z","description":"Ransomware claim against City Chain by orova.","external_references":[{"source_name":"orova","url":"http://mll5ddmdzgiq2siv3qnocmmqyiigfpajtc663xtf32qtp6weycyx2hyd.onion/#city-chain","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--97618a52-1566-57f2-8972-955a2df7c961","created":"2026-10-14T02:04:15Z","modified":"2026-10-14T02:04:15Z","name":"***o* **s**e** Solutions","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--3a8ffeba-83a5-53b9-b150-12af8dcbb979","created":"2026-10-13T00:00:00Z","modified":"2026-10-14T02:04:15Z","relationship_type":"targets","source_ref":"threat-actor--e6acb436-7c12-573c-8995-541d5e783c0b","target_ref":"identity--97618a52-1566-57f2-8972-955a2df7c961","start_time":"2026-10-13T00:00:00Z","description":"Ransomware claim against ***o* **s**e** Solutions by nightspire.","external_references":[{"source_name":"nightspire","url":"http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/database/1896","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--ee110164-492a-5f4c-ad03-4dabf4807577","created":"2026-10-13T00:05:41Z","modified":"2026-10-13T00:05:41Z","name":"Advanced Imaging Solutions","identity_class":"organization","sectors":["technology"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--85d6f1d3-f4ab-5864-ab22-85d599368472","created":"2026-10-13T00:00:00Z","modified":"2026-10-13T00:05:41Z","relationship_type":"targets","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"identity--ee110164-492a-5f4c-ad03-4dabf4807577","start_time":"2026-10-13T00:00:00Z","description":"Ransomware claim against Advanced Imaging Solutions by play.","external_references":[{"source_name":"play","url":"http://ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion/topic.php?id=fLdQsL6MK6gzRZ","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--a9e40fa7-383d-5a9b-8474-f17ae52b6b8c","created":"2026-10-13T00:05:41Z","modified":"2026-10-13T00:05:41Z","name":"Saddlers Court MFG","identity_class":"organization","sectors":["manufacturing"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--c74b4182-b1b0-553b-83a3-16b4951eaa65","created":"2026-10-13T00:00:00Z","modified":"2026-10-13T00:05:41Z","relationship_type":"targets","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"identity--a9e40fa7-383d-5a9b-8474-f17ae52b6b8c","start_time":"2026-10-13T00:00:00Z","description":"Ransomware claim against Saddlers Court MFG by play.","external_references":[{"source_name":"play","url":"http://ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion/topic.php?id=dBw5dkGF1qFW","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--1acc8189-db6a-5d90-8a5d-847bdb58deff","created":"2026-10-13T00:05:41Z","modified":"2026-10-13T00:05:41Z","name":"The Innovation Group","identity_class":"organization","sectors":["professional-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--c7ff306d-c443-57ab-b39d-1dc6425df4d3","created":"2026-10-13T00:00:00Z","modified":"2026-10-13T00:05:41Z","relationship_type":"targets","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"identity--1acc8189-db6a-5d90-8a5d-847bdb58deff","start_time":"2026-10-13T00:00:00Z","description":"Ransomware claim against The Innovation Group by play.","external_references":[{"source_name":"play","url":"http://ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion/topic.php?id=Kh2jwtbyr911ND","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--76d36ed7-3eda-573c-a057-147a0bd1d5c6","created":"2026-10-13T00:05:41Z","modified":"2026-10-13T00:05:41Z","name":"Culinary Specialties","identity_class":"organization","sectors":["retail-wholesale"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--f0ceee41-fbec-5dea-9f40-d49c5a3c6548","created":"2026-10-13T00:00:00Z","modified":"2026-10-13T00:05:41Z","relationship_type":"targets","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"identity--76d36ed7-3eda-573c-a057-147a0bd1d5c6","start_time":"2026-10-13T00:00:00Z","description":"Ransomware claim against Culinary Specialties by play.","external_references":[{"source_name":"play","url":"http://ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion/topic.php?id=69oMIPNxL3PCHJ","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--f44162cd-2984-50cd-9357-12166a37bff6","created":"2026-10-13T00:05:41Z","modified":"2026-10-13T00:05:41Z","name":"DFK Group","identity_class":"organization","sectors":["technology"],"country":"DE"},{"type":"relationship","spec_version":"2.1","id":"relationship--4120e2c3-926e-5a62-86b3-7031718021f6","created":"2026-10-13T00:00:00Z","modified":"2026-10-13T00:05:41Z","relationship_type":"targets","source_ref":"threat-actor--5037ba3d-3c24-5e41-813c-e99167f075d9","target_ref":"identity--f44162cd-2984-50cd-9357-12166a37bff6","start_time":"2026-10-13T00:00:00Z","description":"Ransomware claim against DFK Group by play.","external_references":[{"source_name":"play","url":"http://ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion/topic.php?id=3Z0SHYDpejI48A","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--799f58cb-bd1e-5fac-b3d7-1dd5808fccd5","created":"2026-10-13T13:04:03Z","modified":"2026-10-13T13:04:03Z","name":"Milstein Siegel, LLC","identity_class":"organization","sectors":["legal"]},{"type":"relationship","spec_version":"2.1","id":"relationship--69abbacb-9ede-50f0-bb37-905179af6516","created":"2026-10-13T00:00:00Z","modified":"2026-10-13T13:04:03Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--799f58cb-bd1e-5fac-b3d7-1dd5808fccd5","start_time":"2026-10-13T00:00:00Z","description":"Ransomware claim against Milstein Siegel, LLC by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=ae463972-5ee3-4911-807d-b97fc6a8284d","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--9d33582a-a0f4-5fd6-a3a5-12f812576b7a","created":"2026-10-13T15:03:46Z","modified":"2026-10-13T15:03:46Z","name":"Iliff, Meredith, Wildberger & Brennan, P.C","identity_class":"organization","sectors":["professional-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--970f0db6-8457-5d48-88b7-0e6cbdbf67f0","created":"2026-10-13T00:00:00Z","modified":"2026-10-13T15:03:46Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--9d33582a-a0f4-5fd6-a3a5-12f812576b7a","start_time":"2026-10-13T00:00:00Z","description":"Ransomware claim against Iliff, Meredith, Wildberger & Brennan, P.C by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=59c33c5e-fea2-4c5c-9616-95bdfe6adfc0","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--4f5f9e41-b0f3-56f9-8f64-3e4d3619e5b8","created":"2026-10-13T13:04:03Z","modified":"2026-10-13T13:04:03Z","name":"Comisión Municipal de Agua Potable y Alcantarillado de Victoria","identity_class":"organization","sectors":["energy-utilities"]},{"type":"relationship","spec_version":"2.1","id":"relationship--f3c73261-9eb9-5e1a-a2b9-b62e10bb59f0","created":"2026-10-13T00:00:00Z","modified":"2026-10-13T13:04:03Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--4f5f9e41-b0f3-56f9-8f64-3e4d3619e5b8","start_time":"2026-10-13T00:00:00Z","description":"Ransomware claim against Comisión Municipal de Agua Potable y Alcantarillado de Victoria by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=3207ef15-fce2-49c6-87bd-88b19dcce878","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--9b2247b3-ee1f-5558-810f-a5a7f511ba76","created":"2026-10-13T21:05:12Z","modified":"2026-10-13T21:05:12Z","name":"The Golden Legacy Financing","identity_class":"organization","sectors":["financial-services"]},{"type":"relationship","spec_version":"2.1","id":"relationship--040bb471-c210-5731-8fea-9e3f16299a73","created":"2026-10-13T00:00:00Z","modified":"2026-10-13T21:05:12Z","relationship_type":"targets","source_ref":"threat-actor--b77cd28c-f532-5f0a-bd4b-4f2be13d4939","target_ref":"identity--9b2247b3-ee1f-5558-810f-a5a7f511ba76","start_time":"2026-10-13T00:00:00Z","description":"Ransomware claim against The Golden Legacy Financing by qilin.","external_references":[{"source_name":"qilin","url":"http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/blog?uuid=1bfb7b37-625a-40a4-bf5c-11ff2028ddad","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--076fd8de-6865-5ba5-8867-c49426355ffa","created":"2026-10-13T14:00:53Z","modified":"2026-10-13T14:00:53Z","name":"Interseguro","identity_class":"organization","sectors":["financial-services"],"country":"PE"},{"type":"relationship","spec_version":"2.1","id":"relationship--4c851c98-f2c3-53ad-991b-ade58fde6937","created":"2026-10-13T00:00:00Z","modified":"2026-10-13T14:00:53Z","relationship_type":"targets","source_ref":"threat-actor--b44af868-d196-5794-a16b-52cc0ee555be","target_ref":"identity--076fd8de-6865-5ba5-8867-c49426355ffa","start_time":"2026-10-13T00:00:00Z","description":"Ransomware claim against Interseguro by direwolf.","external_references":[{"source_name":"direwolf","url":"http://direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion/#interseguro","description":"Darknet victim disclosure card"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--e90dde85-e517-5057-8c70-6c775364590d","created":"2026-10-13T00:00:00Z","modified":"2026-10-13T08:09:22Z","relationship_type":"targets","source_ref":"threat-actor--bd7d771f-cda8-530b-8f3f-13709e27fde5","target_ref":"identity--cda16469-2919-5a0a-9269-51a34b299141","start_time":"2026-10-13T00:00:00Z","description":"Ransomware claim against Decorolala by byod.","external_references":[{"source_name":"byod","url":"http://byodxn5s7sua6oyyjj74rycgn6afncfckprt5ezskt3cni6lg3wdrgad.onion/#decorolala","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--4d718a4e-71ec-56e4-8753-80f99163e18b","created":"2026-10-13T12:06:29Z","modified":"2026-10-13T12:06:29Z","name":"Sa***ge","identity_class":"organization"},{"type":"relationship","spec_version":"2.1","id":"relationship--5d7a0b67-6eae-52a5-9471-0a0917eeee19","created":"2026-10-13T00:00:00Z","modified":"2026-10-13T12:06:29Z","relationship_type":"targets","source_ref":"threat-actor--cd7ea2bc-26b6-5f74-b5b6-7fc1da4ffd2e","target_ref":"identity--4d718a4e-71ec-56e4-8753-80f99163e18b","start_time":"2026-10-13T00:00:00Z","description":"Ransomware claim against Sa***ge by auditteam.","external_references":[{"source_name":"auditteam","url":"http://6tdqqaxftvradka5d2frzgwixis7fmro7rfh4ettzcx7jfapkebe6jad.onion/entity/F1BC17AA5D133FA6","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--f236dda0-4fb3-5e01-9dbf-268ed6ee0333","created":"2026-10-13T12:06:29Z","modified":"2026-10-13T12:06:29Z","name":"AD***ed","identity_class":"organization","country":"GB"},{"type":"relationship","spec_version":"2.1","id":"relationship--f76e1145-6d68-566d-804b-60f177435213","created":"2026-10-13T00:00:00Z","modified":"2026-10-13T12:06:29Z","relationship_type":"targets","source_ref":"threat-actor--cd7ea2bc-26b6-5f74-b5b6-7fc1da4ffd2e","target_ref":"identity--f236dda0-4fb3-5e01-9dbf-268ed6ee0333","start_time":"2026-10-13T00:00:00Z","description":"Ransomware claim against AD***ed by auditteam.","external_references":[{"source_name":"auditteam","url":"http://6tdqqaxftvradka5d2frzgwixis7fmro7rfh4ettzcx7jfapkebe6jad.onion/entity/9ACBED3DF66E8E73","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--7e9e6560-4881-527a-af87-ab67224eaba9","created":"2026-10-13T12:06:29Z","modified":"2026-10-13T12:06:29Z","name":"Ze***ce","identity_class":"organization","country":"IT"},{"type":"relationship","spec_version":"2.1","id":"relationship--79efa8df-8926-5ca1-ba09-7e37b8aac901","created":"2026-10-13T00:00:00Z","modified":"2026-10-13T12:06:29Z","relationship_type":"targets","source_ref":"threat-actor--cd7ea2bc-26b6-5f74-b5b6-7fc1da4ffd2e","target_ref":"identity--7e9e6560-4881-527a-af87-ab67224eaba9","start_time":"2026-10-13T00:00:00Z","description":"Ransomware claim against Ze***ce by auditteam.","external_references":[{"source_name":"auditteam","url":"http://6tdqqaxftvradka5d2frzgwixis7fmro7rfh4ettzcx7jfapkebe6jad.onion/entity/1719FB7EED3A12C3","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--624ea2bc-a1ce-549e-b668-918e1b351af6","created":"2026-10-12T15:05:28Z","modified":"2026-10-18T21:01:49Z","name":"VIATechnik","identity_class":"organization","sectors":["construction"],"country":"DE"},{"type":"relationship","spec_version":"2.1","id":"relationship--f5a26cff-1f36-5ce6-932f-f6fa2e234be8","created":"2026-10-12T21:01:48Z","modified":"2026-10-18T21:01:49Z","relationship_type":"targets","source_ref":"threat-actor--0f561605-d0e6-5975-ad7f-5e36cbcebb8e","target_ref":"identity--624ea2bc-a1ce-549e-b668-918e1b351af6","start_time":"2026-10-12T21:01:48Z","description":"Ransomware claim against VIATechnik by metaencryptor.","external_references":[{"source_name":"metaencryptor","url":"https://metacrpttdfpbm4qoxzcrqqgr6e6zafpazgxm72knmujw2mwvi34rwad.onion/0AFC:7eb89fbd9f56b6d67338e429dabe05564f61821a07f4a54ba0703e5b7da0a389/0AFC:5f4d0ebf2b8d329b1d19c8c9a034f5d892e61b7580c26e261a4c564cbf22e7ac","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--949a5ee1-0de8-5213-a69f-56d7d8e5afee","created":"2026-10-12T20:04:05Z","modified":"2026-10-12T20:04:05Z","name":"HIQ Bio","identity_class":"organization","sectors":["healthcare"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--ca9b41e2-681f-518b-b6df-5f8ed49e4b2a","created":"2026-10-12T20:04:05Z","modified":"2026-10-12T20:04:05Z","relationship_type":"targets","source_ref":"threat-actor--47c97875-4fb3-5d9f-8e45-ee85b231dd08","target_ref":"identity--949a5ee1-0de8-5213-a69f-56d7d8e5afee","start_time":"2026-10-12T20:04:05Z","description":"Ransomware claim against HIQ Bio by safepay.","external_references":[{"source_name":"safepay","url":"http://safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion/blog/post/hiqbiocom","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--7378c0f4-51b0-5af4-aaf2-b90db30f7d07","created":"2026-10-12T15:05:28Z","modified":"2026-10-15T20:02:26Z","name":"MyMichigan Health","identity_class":"organization","sectors":["healthcare"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--967a0e86-6458-5486-8d10-96cc977870de","created":"2026-10-12T20:02:26Z","modified":"2026-10-15T20:02:26Z","relationship_type":"targets","source_ref":"threat-actor--0f561605-d0e6-5975-ad7f-5e36cbcebb8e","target_ref":"identity--7378c0f4-51b0-5af4-aaf2-b90db30f7d07","start_time":"2026-10-12T20:02:26Z","description":"Ransomware claim against MyMichigan Health by metaencryptor.","external_references":[{"source_name":"metaencryptor","url":"https://metacrpttdfpbm4qoxzcrqqgr6e6zafpazgxm72knmujw2mwvi34rwad.onion/0AFC:7608c06a544bf5886857ec7d51fc62feaa633abf005ddb27cee1fd5d9bfdcbb3/0AFC:f2b344df5ba8ca001214114b691f5680b1db339c94a2ade8824748c9499f3364","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--8f076b8e-1cf2-53ab-b749-b6256bbc54d4","created":"2026-10-12T19:07:36Z","modified":"2026-10-12T20:07:07Z","name":"Gatetech Technology","identity_class":"organization","sectors":["manufacturing"],"country":"TW"},{"type":"relationship","spec_version":"2.1","id":"relationship--104c95fe-c961-5d79-97ee-8d8060325ecb","created":"2026-10-12T18:52:38Z","modified":"2026-10-12T20:07:07Z","relationship_type":"targets","source_ref":"threat-actor--b32cb61b-df5e-5e13-a0ef-3ff18cbba65a","target_ref":"identity--8f076b8e-1cf2-53ab-b749-b6256bbc54d4","start_time":"2026-10-12T18:52:38Z","description":"Ransomware claim against Gatetech Technology by orova.","external_references":[{"source_name":"orova","url":"http://mll5ddmdzgiq2siv3qnocmmqyiigfpajtc663xtf32qtp6weycyx2hyd.onion/#gatetech-technology","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--2a053b5c-5253-5d6b-8cc5-ba5783ee583b","created":"2026-10-12T19:07:36Z","modified":"2026-10-12T20:07:07Z","name":"Amantya Technologies","identity_class":"organization","sectors":["technology"],"country":"IN"},{"type":"relationship","spec_version":"2.1","id":"relationship--a8a9cffc-057e-558b-8086-7d81d679b4f1","created":"2026-10-12T18:47:25Z","modified":"2026-10-12T20:07:07Z","relationship_type":"targets","source_ref":"threat-actor--b32cb61b-df5e-5e13-a0ef-3ff18cbba65a","target_ref":"identity--2a053b5c-5253-5d6b-8cc5-ba5783ee583b","start_time":"2026-10-12T18:47:25Z","description":"Ransomware claim against Amantya Technologies by orova.","external_references":[{"source_name":"orova","url":"http://mll5ddmdzgiq2siv3qnocmmqyiigfpajtc663xtf32qtp6weycyx2hyd.onion/#amantya-technologies","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--9583a578-1eaa-55ee-a8aa-83e707ce6ae7","created":"2026-10-12T19:07:36Z","modified":"2026-10-12T20:07:07Z","name":"Libre Wireless Technologies","identity_class":"organization","sectors":["technology"],"country":"IN"},{"type":"relationship","spec_version":"2.1","id":"relationship--c7b1fefa-1487-5aaa-8250-5dfdbfbf832f","created":"2026-10-12T18:38:21Z","modified":"2026-10-12T20:07:07Z","relationship_type":"targets","source_ref":"threat-actor--b32cb61b-df5e-5e13-a0ef-3ff18cbba65a","target_ref":"identity--9583a578-1eaa-55ee-a8aa-83e707ce6ae7","start_time":"2026-10-12T18:38:21Z","description":"Ransomware claim against Libre Wireless Technologies by orova.","external_references":[{"source_name":"orova","url":"http://mll5ddmdzgiq2siv3qnocmmqyiigfpajtc663xtf32qtp6weycyx2hyd.onion/#libre-wireless-technologies","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--2afed8ea-82c3-5f26-acdf-ec69a48e9666","created":"2026-10-12T19:07:36Z","modified":"2026-10-12T20:07:07Z","name":"The Park Lane Hong Kong, Autograph Collection","identity_class":"organization","sectors":["professional-services"],"country":"HK"},{"type":"relationship","spec_version":"2.1","id":"relationship--769c0a8f-3a75-51f1-9f29-3f08444dd1d1","created":"2026-10-12T18:20:07Z","modified":"2026-10-12T20:07:07Z","relationship_type":"targets","source_ref":"threat-actor--b32cb61b-df5e-5e13-a0ef-3ff18cbba65a","target_ref":"identity--2afed8ea-82c3-5f26-acdf-ec69a48e9666","start_time":"2026-10-12T18:20:07Z","description":"Ransomware claim against The Park Lane Hong Kong, Autograph Collection by orova.","external_references":[{"source_name":"orova","url":"http://mll5ddmdzgiq2siv3qnocmmqyiigfpajtc663xtf32qtp6weycyx2hyd.onion/#the-park-lane-hong-kong","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--1aeb8d59-0902-5284-a811-8e03d463371f","created":"2026-10-12T17:05:49Z","modified":"2026-10-12T17:05:49Z","name":"Rechtsanwaltskanzlei Dr. Bien","identity_class":"organization","sectors":["legal"],"country":"DE"},{"type":"relationship","spec_version":"2.1","id":"relationship--7656500c-95d0-5e8e-83dc-cbeed9d289a6","created":"2026-10-12T17:05:49Z","modified":"2026-10-12T17:05:49Z","relationship_type":"targets","source_ref":"threat-actor--e6361d0a-0132-5091-8c65-965b024e655f","target_ref":"identity--1aeb8d59-0902-5284-a811-8e03d463371f","start_time":"2026-10-12T17:05:49Z","description":"Ransomware claim against Rechtsanwaltskanzlei Dr. Bien by aurora.","external_references":[{"source_name":"aurora","url":"http://u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion/blog/rechtsanwaltskanzlei-dr-bien-88f4b584","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--1cb611fa-6b7e-5de1-aa36-034d12e72922","created":"2026-10-12T17:07:02Z","modified":"2026-10-12T21:08:01Z","name":"Claire's Inc.","identity_class":"organization","sectors":["retail-wholesale"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--463c7f72-8426-5bca-8526-1cee2deb93a4","created":"2026-10-12T16:39:11Z","modified":"2026-10-12T21:08:01Z","relationship_type":"targets","source_ref":"threat-actor--630da242-8e2d-5710-ae7c-407f35619795","target_ref":"identity--1cb611fa-6b7e-5de1-aa36-034d12e72922","start_time":"2026-10-12T16:39:11Z","description":"Ransomware claim against Claire's Inc. by dark project.","external_references":[{"source_name":"dark project","url":"http://darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion/article?slug=claires-inc","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--380f0ae9-9afa-5e4e-8a73-19b62d2abdec","created":"2026-10-12T17:07:02Z","modified":"2026-10-12T21:08:01Z","name":"PennEastern Architects LLC","identity_class":"organization","sectors":["construction"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--7b28891a-eafd-5fc6-9077-e5577b2e85d0","created":"2026-10-12T16:33:14Z","modified":"2026-10-12T21:08:01Z","relationship_type":"targets","source_ref":"threat-actor--630da242-8e2d-5710-ae7c-407f35619795","target_ref":"identity--380f0ae9-9afa-5e4e-8a73-19b62d2abdec","start_time":"2026-10-12T16:33:14Z","description":"Ransomware claim against PennEastern Architects LLC by dark project.","external_references":[{"source_name":"dark project","url":"http://darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion/article?slug=penneastern-architects-lcc","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--37400506-c8c8-57cb-98b0-e915d7f2242d","created":"2026-10-12T17:07:02Z","modified":"2026-10-12T21:08:01Z","name":"Franklin Miller Inc.","identity_class":"organization","sectors":["manufacturing"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--92136f1f-c60a-553d-a34a-15d5d358618c","created":"2026-10-12T16:19:05Z","modified":"2026-10-12T21:08:01Z","relationship_type":"targets","source_ref":"threat-actor--630da242-8e2d-5710-ae7c-407f35619795","target_ref":"identity--37400506-c8c8-57cb-98b0-e915d7f2242d","start_time":"2026-10-12T16:19:05Z","description":"Ransomware claim against Franklin Miller Inc. by dark project.","external_references":[{"source_name":"dark project","url":"http://darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion/article?slug=franklin-miller-inc","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--401a17d0-762f-5e47-855d-2d81dfa6dd3c","created":"2026-10-12T16:07:45Z","modified":"2026-10-12T16:07:45Z","name":"R. A. Wood Associates","identity_class":"organization","sectors":["technology"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--2eed8f92-6ea3-52c0-ae14-791b5c1cab90","created":"2026-10-12T15:16:02Z","modified":"2026-10-12T16:07:45Z","relationship_type":"targets","source_ref":"threat-actor--410ada0c-ff4a-5ab5-8b42-3f1c7c23b6be","target_ref":"identity--401a17d0-762f-5e47-855d-2d81dfa6dd3c","start_time":"2026-10-12T15:16:02Z","description":"Ransomware claim against R. A. Wood Associates by storm.","external_references":[{"source_name":"storm","url":"http://yqhecvqtdvq6p7duqcgw2qca77spbgakxcoibtx6zpvfshltsbbbhfqd.onion/company/6accf9b2017ad22f3de0f1eb","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--ffd818d4-32c7-5889-9e1a-ed15bf187352","created":"2026-10-12T16:07:45Z","modified":"2026-10-12T16:07:45Z","name":"Tech Electronics","identity_class":"organization","sectors":["technology"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--e9be9b8a-9a2d-5c3d-b25f-67acf88c3d27","created":"2026-10-12T15:13:42Z","modified":"2026-10-12T16:07:45Z","relationship_type":"targets","source_ref":"threat-actor--410ada0c-ff4a-5ab5-8b42-3f1c7c23b6be","target_ref":"identity--ffd818d4-32c7-5889-9e1a-ed15bf187352","start_time":"2026-10-12T15:13:42Z","description":"Ransomware claim against Tech Electronics by storm.","external_references":[{"source_name":"storm","url":"http://yqhecvqtdvq6p7duqcgw2qca77spbgakxcoibtx6zpvfshltsbbbhfqd.onion/company/6accf926017ad22f3de0f1e9","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--185142cc-1671-51ae-994f-74fea7963c54","created":"2026-10-12T15:04:00Z","modified":"2026-10-12T15:04:00Z","name":"Valenti Chili Restaurants","identity_class":"organization","sectors":["retail-wholesale"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--2c5fcade-da78-5a2b-a9bf-1c69e5bc212b","created":"2026-10-12T15:04:00Z","modified":"2026-10-12T15:04:00Z","relationship_type":"targets","source_ref":"threat-actor--6adf22bd-d344-5610-8727-61d8b6488ac9","target_ref":"identity--185142cc-1671-51ae-994f-74fea7963c54","start_time":"2026-10-12T15:04:00Z","description":"Ransomware claim against Valenti Chili Restaurants by interlock.","external_references":[{"source_name":"interlock","url":"http://ebhmkoohccl45qesdbvrjqtyro2hmhkmh6vkyfyjjzfllm3ix72aqaid.onion/leaks.php#valenti-management","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--d9280650-118d-5cae-85a1-46deac6b0895","created":"2026-10-12T15:04:00Z","modified":"2026-10-12T15:04:00Z","name":"Pedigo Products, Inc.","identity_class":"organization","sectors":["manufacturing"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--9fe6e256-2e23-5ff7-babb-bbb1144d09a2","created":"2026-10-12T15:04:00Z","modified":"2026-10-12T15:04:00Z","relationship_type":"targets","source_ref":"threat-actor--6adf22bd-d344-5610-8727-61d8b6488ac9","target_ref":"identity--d9280650-118d-5cae-85a1-46deac6b0895","start_time":"2026-10-12T15:04:00Z","description":"Ransomware claim against Pedigo Products, Inc. by interlock.","external_references":[{"source_name":"interlock","url":"http://ebhmkoohccl45qesdbvrjqtyro2hmhkmh6vkyfyjjzfllm3ix72aqaid.onion/leaks.php#pedigo-products-inc","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--e80c067f-1b5b-52ad-8e56-c9d1dc3c115a","created":"2026-10-12T15:04:00Z","modified":"2026-10-12T15:04:00Z","name":"Nu-Quest Distribution Inc","identity_class":"organization","sectors":["professional-services"]},{"type":"relationship","spec_version":"2.1","id":"relationship--8761cda5-0955-5423-a4e4-3708219b306a","created":"2026-10-12T15:04:00Z","modified":"2026-10-12T15:04:00Z","relationship_type":"targets","source_ref":"threat-actor--6adf22bd-d344-5610-8727-61d8b6488ac9","target_ref":"identity--e80c067f-1b5b-52ad-8e56-c9d1dc3c115a","start_time":"2026-10-12T15:04:00Z","description":"Ransomware claim against Nu-Quest Distribution Inc by interlock.","external_references":[{"source_name":"interlock","url":"http://ebhmkoohccl45qesdbvrjqtyro2hmhkmh6vkyfyjjzfllm3ix72aqaid.onion/leaks.php#nu-quest-distribution-inc","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--b671e836-ff5b-5696-b640-257046a250f7","created":"2026-10-12T15:04:00Z","modified":"2026-10-12T15:04:00Z","name":"Greentech Environmental","identity_class":"organization","sectors":["professional-services"],"country":"US"},{"type":"relationship","spec_version":"2.1","id":"relationship--37d9c779-ccb4-50c0-ab02-74e71c2705e4","created":"2026-10-12T15:04:00Z","modified":"2026-10-12T15:04:00Z","relationship_type":"targets","source_ref":"threat-actor--6adf22bd-d344-5610-8727-61d8b6488ac9","target_ref":"identity--b671e836-ff5b-5696-b640-257046a250f7","start_time":"2026-10-12T15:04:00Z","description":"Ransomware claim against Greentech Environmental by interlock.","external_references":[{"source_name":"interlock","url":"http://ebhmkoohccl45qesdbvrjqtyro2hmhkmh6vkyfyjjzfllm3ix72aqaid.onion/leaks.php#greentech-environmental","description":"Darknet victim disclosure card"}]},{"type":"identity","spec_version":"2.1","id":"identity--3b6d0df4-ace2-581e-96f3-a721115855a6","created":"2026-10-12T15:04:00Z","modified":"2026-10-12T15:04:00Z","name":"Engineers Contractors Fabricators Inc.","identity_class":"organization","sectors":["construction"]},{"type":"relationship","spec_version":"2.1","id":"relationship--074d31a1-648d-51e6-b94a-67f81a24bebb","created":"2026-10-12T15:04:00Z","modified":"2026-10-12T15:04:00Z","relationship_type":"targets","source_ref":"threat-actor--6adf22bd-d344-5610-8727-61d8b6488ac9","target_ref":"identity--3b6d0df4-ace2-581e-96f3-a721115855a6","start_time":"2026-10-12T15:04:00Z","description":"Ransomware claim against Engineers Contractors Fabricators Inc. by interlock.","external_references":[{"source_name":"interlock","url":"http://ebhmkoohccl45qesdbvrjqtyro2hmhkmh6vkyfyjjzfllm3ix72aqaid.onion/leaks.php#engineers-contractors-fabricators-inc-ecf","description":"Darknet victim disclosure card"}]}]}