Relationships Corpus

Every asserted link across the corpus, materialized once with its source. Each edge names its two independent confidence axes where the source carries them — Evidence (is it real?) kept separate from Attribution (whose is it?). Indicators are defanged.

From	Relationship	To	Confidence	Source	As of
Gaussactor	Related to	OilRig (APT34)actor	—	Technique overlap	—
Coinbase Cartelactor	Related to	Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor	—	Technique overlap	—
OilRig (APT34)actor	Related to	Sarcomaactor	—	Technique overlap	—
miniFlame (SPE)actor	Related to	OilRig (APT34)actor	—	Technique overlap	—
Cactusactor	Related to	OilRig (APT34)actor	—	Technique overlap	—
AFB1C1583606599C7272CFB33CC6F498indicator	Indicates	UNC1549 / TA455actor	Likely (likelihood)Likely (likelihood)	own-case	2026-07-28
realhealthshop[.]comindicator	Indicates	UNC1549 / TA455actor	Likely (likelihood)Likely (likelihood)	own-case	2026-07-28
C90F0EFADBF322E5EB1C4103A38C30E6indicator	Indicates	UNC1549 / TA455actor	Likely (likelihood)Likely (likelihood)	own-case	2026-07-28
42F847597109DA2A220391BB09D00676indicator	Indicates	UNC1549 / TA455actor	Likely (likelihood)Likely (likelihood)	own-case	2026-07-28
aecert[.]orgindicator	Indicates	UNC1549 / TA455actor	Likely (likelihood)Likely (likelihood)	own-case	2026-07-28
6038D42AF0AFFD1FB263F470C0956F6Bindicator	Indicates	UNC1549 / TA455actor	Likely (likelihood)Likely (likelihood)	own-case	2026-07-28
AE628EFA305387B633DCE82F9364875Bindicator	Indicates	UNC1549 / TA455actor	Likely (likelihood)Likely (likelihood)	own-case	2026-07-28
F7D36CC5904A53252D2BB3D21615134Findicator	Indicates	UNC1549 / TA455actor	Likely (likelihood)Likely (likelihood)	own-case	2026-07-28
D09B14A2FE01C7363ECC56F5D046162Cindicator	Indicates	UNC1549 / TA455actor	Likely (likelihood)Likely (likelihood)	own-case	2026-07-28
tjconsultingservices[.]comindicator	Indicates	UNC1549 / TA455actor	Likely (likelihood)Likely (likelihood)	own-case	2026-07-28
A239E655709A2518DD0B7BDBED163679indicator	Indicates	UNC1549 / TA455actor	Likely (likelihood)Likely (likelihood)	own-case	2026-07-28
5FA15EF96808EA82F0A6176F0BB4B386indicator	Indicates	UNC1549 / TA455actor	Likely (likelihood)Likely (likelihood)	own-case	2026-07-28
Imperial Kitten (CURIUM)actor	Uses	System Time Discoverytechnique	—	ATT&CK mapping	—
Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor	Uses	Drive-by Compromisetechnique	—	ATT&CK mapping	—
Medusaactor	Uses	System Information Discoverytechnique	—	ATT&CK mapping	—
Void Manticore (Storm-0842)actor	Uses	Data Stagedtechnique	—	ATT&CK mapping	—
Domestic Kittenactor	Uses	Audio Capturetechnique	—	ATT&CK mapping	—
Cl0pactor	Uses	DLLtechnique	—	ATT&CK mapping	—
Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor	Uses	Windows Host Firewalltechnique	—	ATT&CK mapping	—
Spacebearsactor	Uses	Exfiltration to Cloud Storagetechnique	—	ATT&CK mapping	—
Cl0pactor	Uses	Archive Collected Datatechnique	—	ATT&CK mapping	—
GhostSec / GhostLockeractor	Uses	Inhibit System Recoverytechnique	—	ATT&CK mapping	—
Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactor	Uses	Tooltechnique	—	ATT&CK mapping	—
Medusaactor	Uses	Indicator Removal: File Deletiontechnique	—	ATT&CK mapping	—
MuddyWateractor	Uses	Pythontechnique	—	ATT&CK mapping	—
Cyber Toufan (Al-Aqsa)actor	Uses	Exfiltration Over Alternative Protocoltechnique	—	ATT&CK mapping	—
BladedFelineactor	Uses	Application Layer Protocol: Mail Protocolstechnique	—	ATT&CK mapping	—
Void Manticore (Storm-0842)actor	Uses	Domain Accountstechnique	—	ATT&CK mapping	—
Void Manticore (Storm-0842)actor	Uses	PowerShelltechnique	—	ATT&CK mapping	—
Void Manticore (Storm-0842)actor	Uses	Inhibit System Recoverytechnique	—	ATT&CK mapping	—
BladedFelineactor	Uses	Exfiltration Over Alternative Protocol: Exfiltration Over Symmetric Encrypted Non-C2 Protocoltechnique	—	ATT&CK mapping	—
Devmanactor	Uses	Network Share Discoverytechnique	—	ATT&CK mapping	—
Ferocious Kittenactor	Uses	Phishing: Spearphishing Attachmenttechnique	—	ATT&CK mapping	—
Everestactor	Uses	Data Encrypted for Impacttechnique	—	ATT&CK mapping	—
Warlockactor	Uses	IDE Tunnelingtechnique	—	ATT&CK mapping	—
Charming Kitten / APT42actor	Uses	Boot or Logon Autostart Executiontechnique	—	ATT&CK mapping	—
MuddyWateractor	Uses	Standard Encodingtechnique	—	ATT&CK mapping	—
Lynxactor	Uses	Windows Command Shelltechnique	—	ATT&CK mapping	—
APT39 / Chaferactor	Uses	Credentials from Password Storestechnique	—	ATT&CK mapping	—
Nemesis Kittenactor	Uses	Archive via Utilitytechnique	—	ATT&CK mapping	—
8Baseactor	Uses	Access Token Manipulation: Token Impersonation/Thefttechnique	—	ATT&CK mapping	—
Hunters Internationalactor	Uses	Inhibit System Recoverytechnique	—	ATT&CK mapping	—
Crypto24actor	Uses	Impair Defenses: Disable or Modify Toolstechnique	—	ATT&CK mapping	—
Void Manticore (Storm-0842)actor	Uses	Hidden Windowtechnique	—	ATT&CK mapping	—
Rhysidaactor	Uses	Impair Defenses: Disable or Modify Toolstechnique	—	ATT&CK mapping	—