Every asserted link across the corpus, materialized once with its source. Each edge names its two independent confidence axes where the source carries them — Evidence (is it real?) kept separate from Attribution (whose is it?). Indicators are defanged.
| From | Relationship | To | Confidence | Source | As of |
|---|---|---|---|---|---|
| payload · Amateracampaign | Uses | ShieldCrashmalware | — | Correlated cluster | 2026-09-24 |
| AnyDeskcampaign | Uses | NetProvidermalware | — | Correlated cluster | 2026-09-17 |
| Dysphoriacampaign | Uses | Claude Codemalware | — | Correlated cluster | 2026-08-24 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | TELESHIMmalware | — | Correlated cluster | 2026-08-12 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | Bulk-mail platform (Tubely-themed spam campaign)malware | — | Correlated cluster | 2026-08-12 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | Claude Codemalware | — | Correlated cluster | 2026-09-16 |
| AnyDeskcampaign | Uses | LIGHTPAINTmalware | — | Correlated cluster | 2026-09-17 |
| Dysphoriacampaign | Uses | 1DayNewsmalware | — | Correlated cluster | 2026-08-24 |
| AnyDeskcampaign | Uses | WinRM-fsmalware | — | Correlated cluster | 2026-09-17 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | PebbleDashmalware | — | Correlated cluster | 2026-08-12 |
| Astarothcampaign | Uses | Astarothmalware | — | Correlated cluster | 2026-08-18 |
| Warlock · MeshAgentcampaign | Uses | Sinobimalware | — | Correlated cluster | 2026-09-03 |
| JWRcampaign | Uses | XCSSETmalware | — | Correlated cluster | 2026-09-14 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | IOCONTROLmalware | — | Correlated cluster | 2026-08-12 |
| payload · Amateracampaign | Uses | ARKTunnelmalware | — | Correlated cluster | 2026-09-24 |
| Dysphoriacampaign | Uses | ClickLock Stealermalware | — | Correlated cluster | 2026-08-24 |
| TeamPCP Cloud Stealercampaign | Uses | SLICKDEMONmalware | — | Correlated cluster | 2026-09-02 |
| Qilin (fka Agenda) · Qilincampaign | Uses | u2.jspmalware | — | Correlated cluster | 2026-09-25 |
| AnyDeskcampaign | Uses | Impacketmalware | — | Correlated cluster | 2026-09-17 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | CloudAtlasGomalware | — | Correlated cluster | 2026-09-16 |
| fscancampaign | Uses | pwnkitmalware | — | Correlated cluster | 2026-09-02 |
| AnyDeskcampaign | Uses | Google Chrome Remote Desktopmalware | — | Correlated cluster | 2026-09-17 |
| Qilin (fka Agenda) · Qilincampaign | Uses | Oystermalware | — | Correlated cluster | 2026-09-25 |
| SPECTREcampaign | Uses | ysoserialmalware | — | Correlated cluster | 2026-08-20 |
| Information stealerscampaign | Uses | Information stealersmalware | — | Correlated cluster | 2026-09-03 |
| PowerShell-based RATcampaign | Uses | QScanmalware | — | Correlated cluster | 2026-08-31 |
| fscancampaign | Uses | OctLurkmalware | — | Correlated cluster | 2026-09-02 |
| Shai-Huludcampaign | Uses | Coinminermalware | — | Correlated cluster | 2026-08-06 |
| payload · XMRigcampaign | Uses | MISTPENmalware | — | Correlated cluster | 2026-09-03 |
| JWRcampaign | Uses | JWRmalware | — | Correlated cluster | 2026-09-14 |
| AnyDeskcampaign | Uses | REALBREEZEmalware | — | Correlated cluster | 2026-09-17 |
| Ransomwarecampaign | Uses | Miners (Windows executable and web miners)malware | — | Correlated cluster | 2026-09-02 |
| fscancampaign | Uses | unix_updatesmalware | — | Correlated cluster | 2026-09-02 |
| Warlock · MeshAgentcampaign | Uses | AISURUmalware | — | Correlated cluster | 2026-09-03 |
| AnyDeskcampaign | Uses | AnyDeskmalware | — | Correlated cluster | 2026-09-17 |
| Trojanized PDF softwarecampaign | Uses | Autonomous AI agentsmalware | — | Correlated cluster | 2026-08-17 |
| Qilin (fka Agenda) · Qilincampaign | Uses | NightSpiremalware | — | Correlated cluster | 2026-09-25 |
| Cavern Manticore · Caverncampaign | Uses | n-HTCommp.dllmalware | — | Correlated cluster | 2026-07-08 |
| PowerShell-based RATcampaign | Uses | QTRoutermalware | — | Correlated cluster | 2026-08-31 |
| BADBOXcampaign | Uses | TWCoremalware | — | Correlated cluster | 2026-08-27 |
| payload · XMRigcampaign | Uses | SecurityPDFmalware | — | Correlated cluster | 2026-09-03 |
| Ransomwarecampaign | Uses | Spywaremalware | — | Correlated cluster | 2026-09-02 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | Hermes Agentmalware | — | Correlated cluster | 2026-09-16 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | BadIISmalware | — | Correlated cluster | 2026-09-16 |
| Qilin ransomwarecampaign | Uses | PivotC2malware | — | Correlated cluster | 2026-09-11 |
| PromptSpycampaign | Uses | PromptLockmalware | — | Correlated cluster | 2026-09-03 |
| fscancampaign | Uses | chuser backdoormalware | — | Correlated cluster | 2026-09-02 |
| Ransomwarecampaign | Uses | AutoCAD malwaremalware | — | Correlated cluster | 2026-09-02 |
| Qilin (fka Agenda) · Qilincampaign | Uses | Akiramalware | — | Correlated cluster | 2026-09-25 |
| XZ Utils backdoorcampaign | Uses | Mini Shai-Hulud (npm worm)malware | — | Correlated cluster | 2026-08-21 |