Every asserted link across the corpus, materialized once with its source. Each edge names its two independent confidence axes where the source carries them — Evidence (is it real?) kept separate from Attribution (whose is it?). Indicators are defanged.
| From | Relationship | To | Confidence | Source | As of |
|---|---|---|---|---|---|
| payload · XMRigcampaign | Uses | T1057technique | — | Correlated cluster | 2026-09-03 |
| PowerShell-based RATcampaign | Uses | T1114technique | — | Correlated cluster | 2026-08-31 |
| T1078campaign | Uses | T1021technique | — | Correlated cluster | 2026-08-18 |
| AnyDeskcampaign | Uses | T1569.002technique | — | Correlated cluster | 2026-09-04 |
| FudModulecampaign | Uses | T1027technique | — | Correlated cluster | 2026-09-03 |
| AnyDeskcampaign | Uses | T1505.003technique | — | Correlated cluster | 2026-09-04 |
| payload · Amateracampaign | Uses | T1071technique | — | Correlated cluster | 2026-09-10 |
| Trojanized PDF softwarecampaign | Uses | T1608technique | — | Correlated cluster | 2026-08-17 |
| MacSync Stealercampaign | Uses | T1055technique | — | Correlated cluster | 2026-08-18 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | T1491technique | — | Correlated cluster | 2026-08-12 |
| JWRcampaign | Uses | T1071.001technique | — | Correlated cluster | 2026-08-27 |
| Information stealerscampaign | Uses | T1003.002technique | — | Correlated cluster | 2026-09-03 |
| Dysphoriacampaign | Uses | T1189technique | — | Correlated cluster | 2026-08-24 |
| Ransomwarecampaign | Uses | T1566technique | — | Correlated cluster | 2026-09-02 |
| payload · XMRigcampaign | Uses | T1588.002technique | — | Correlated cluster | 2026-09-03 |
| AnyDeskcampaign | Uses | T1490technique | — | Correlated cluster | 2026-09-04 |
| JWRcampaign | Uses | T1055technique | — | Correlated cluster | 2026-08-27 |
| PowerShell-based RATcampaign | Uses | T1071technique | — | Correlated cluster | 2026-08-31 |
| Warlock · MeshAgentcampaign | Uses | T1111technique | — | Correlated cluster | 2026-09-08 |
| JWRcampaign | Uses | T1622technique | — | Correlated cluster | 2026-08-27 |
| Dysphoriacampaign | Uses | T1027technique | — | Correlated cluster | 2026-08-24 |
| AnyDeskcampaign | Uses | T1070.001technique | — | Correlated cluster | 2026-09-04 |
| PowerShell-based RATcampaign | Uses | T1656technique | — | Correlated cluster | 2026-08-31 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | T1566technique | — | Correlated cluster | 2026-08-12 |
| PowerShell-based RATcampaign | Uses | T1070technique | — | Correlated cluster | 2026-08-31 |
| JSCealcampaign | Uses | T1218.007technique | — | Correlated cluster | 2026-09-02 |
| PhantomCorecampaign | Uses | T1190technique | — | Correlated cluster | 2026-08-25 |
| MacSync Stealercampaign | Uses | T1057technique | — | Correlated cluster | 2026-08-18 |
| T1078campaign | Uses | T1548technique | — | Correlated cluster | 2026-08-18 |
| JWRcampaign | Uses | T1059.002technique | — | Correlated cluster | 2026-08-27 |
| BadIIScampaign | Uses | T1136.001technique | — | Correlated cluster | 2026-08-26 |
| QRCode/Phishingcampaign | Uses | T1598technique | — | Correlated cluster | 2026-08-19 |
| FudModulecampaign | Uses | T1608.006technique | — | Correlated cluster | 2026-09-03 |
| MacSynccampaign | Uses | T1585.001technique | — | Correlated cluster | 2026-08-18 |
| LegacyHivecampaign | Uses | T1204technique | — | Correlated cluster | 2026-08-11 |
| payload · XMRigcampaign | Uses | T1105technique | — | Correlated cluster | 2026-08-26 |
| Information stealerscampaign | Uses | T1583.006technique | — | Correlated cluster | 2026-09-03 |
| JSCealcampaign | Uses | Node.js-based JavaScript implantmalware | — | Correlated cluster | 2026-09-02 |
| SPECTREcampaign | Uses | DeepAuditmalware | — | Correlated cluster | 2026-08-20 |
| SPECTREcampaign | Uses | PentestGPTmalware | — | Correlated cluster | 2026-08-20 |
| Warlock · MeshAgentcampaign | Uses | SockTzmalware | — | Correlated cluster | 2026-09-08 |
| AnyDeskcampaign | Uses | MEmumalware | — | Correlated cluster | 2026-09-04 |
| payload · Amateracampaign | Uses | ValleyRATmalware | — | Correlated cluster | 2026-09-10 |
| AnyDeskcampaign | Uses | Grammarlymalware | — | Correlated cluster | 2026-09-04 |
| fscancampaign | Uses | OctLurkmalware | — | Correlated cluster | 2026-09-02 |
| Dysphoriacampaign | Uses | CloudAtlasGomalware | — | Correlated cluster | 2026-08-24 |
| PhantomCorecampaign | Uses | PhantomCoremalware | — | Correlated cluster | 2026-08-25 |
| SparrowDoorcampaign | Uses | LummaC2malware | — | Correlated cluster | 2026-08-25 |
| SPECTREcampaign | Uses | QuasarRATmalware | — | Correlated cluster | 2026-08-20 |
| BadIIScampaign | Uses | SPECTREmalware | — | Correlated cluster | 2026-08-26 |