Every asserted link across the corpus, materialized once with its source. Each edge names its two independent confidence axes where the source carries them — Evidence (is it real?) kept separate from Attribution (whose is it?). Indicators are defanged.
| From | Relationship | To | Confidence | Source | As of |
|---|---|---|---|---|---|
| payload · Amateracampaign | Uses | Socks5Systemzmalware | — | Correlated cluster | 2026-09-24 |
| Qilin (fka Agenda) · Qilincampaign | Uses | Respondermalware | — | Correlated cluster | 2026-09-25 |
| Qilin (fka Agenda) · Qilincampaign | Uses | The Gentlemenmalware | — | Correlated cluster | 2026-09-25 |
| AnyDeskcampaign | Uses | PhantomGraphmalware | — | Correlated cluster | 2026-09-17 |
| Information stealerscampaign | Uses | Mini Shai-Hulud (npm worm)malware | — | Correlated cluster | 2026-09-03 |
| Astarothcampaign | Uses | MacSync Stealermalware | — | Correlated cluster | 2026-08-18 |
| Information stealerscampaign | Uses | KAZUARmalware | — | Correlated cluster | 2026-09-03 |
| BadIIScampaign | Uses | EfsPotatomalware | — | Correlated cluster | 2026-08-26 |
| SPECTREcampaign | Uses | ASHX SEO engine (SeoEngineHandler)malware | — | Correlated cluster | 2026-08-20 |
| Cavern Manticore · Caverncampaign | Uses | Cavern frameworkmalware | — | Correlated cluster | 2026-07-08 |
| BadIIScampaign | Uses | BadIISmalware | — | Correlated cluster | 2026-08-26 |
| Qilin (fka Agenda) · Qilincampaign | Uses | FlutterShellmalware | — | Correlated cluster | 2026-09-25 |
| FudModulecampaign | Uses | infostealermalware | — | Correlated cluster | 2026-09-03 |
| FudModulecampaign | Uses | RelayShellmalware | — | Correlated cluster | 2026-09-03 |
| Dysphoriacampaign | Uses | OWAReapermalware | — | Correlated cluster | 2026-08-24 |
| JSCealcampaign | Uses | dui70.dllmalware | — | Correlated cluster | 2026-09-02 |
| STOCKSTAYcampaign | Uses | STOCKSTAYmalware | — | Correlated cluster | 2026-08-04 |
| fscancampaign | Uses | 3snake-based credential stealermalware | — | Correlated cluster | 2026-09-02 |
| CoolClientcampaign | Uses | PlugXmalware | — | Correlated cluster | 2026-09-03 |
| AnyDeskcampaign | Uses | socks5.exemalware | — | Correlated cluster | 2026-09-17 |
| TeamPCP Cloud Stealercampaign | Uses | QUIC RATmalware | — | Correlated cluster | 2026-09-02 |
| fscancampaign | Uses | DownPromalware | — | Correlated cluster | 2026-09-02 |
| JSCealcampaign | Uses | MeadowLocustmalware | — | Correlated cluster | 2026-09-02 |
| Warlock · MeshAgentcampaign | Uses | MeshAgentmalware | — | Correlated cluster | 2026-09-03 |
| GoogleService.dllcampaign | Uses | WinRM-fsmalware | — | Correlated cluster | 2026-09-04 |
| Warlock · MeshAgentcampaign | Uses | Kimwolfmalware | — | Correlated cluster | 2026-09-03 |
| Warlock · MeshAgentcampaign | Uses | ARTokenmalware | — | Correlated cluster | 2026-09-03 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | Cleanova loadermalware | — | Correlated cluster | 2026-08-12 |
| PowerShell-based RATcampaign | Uses | Quick Assist (abused RMM tool)malware | — | Correlated cluster | 2026-08-31 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | Autonomous AI agentsmalware | — | Correlated cluster | 2026-09-16 |
| msaRATcampaign | Uses | Silver Foxmalware | — | Correlated cluster | 2026-09-01 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | Meterpretermalware | — | Correlated cluster | 2026-09-16 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | ysoserialmalware | — | Correlated cluster | 2026-09-16 |
| fscancampaign | Uses | Keylogger (AnyDesk.exe)malware | — | Correlated cluster | 2026-09-02 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | OWAReapermalware | — | Correlated cluster | 2026-09-16 |
| QRCode/Phishingcampaign | Uses | QRCode/Phishingmalware | — | Correlated cluster | 2026-08-19 |
| Warlock · MeshAgentcampaign | Uses | Nitrogenmalware | — | Correlated cluster | 2026-09-03 |
| MacSynccampaign | Uses | Atomic Stealer (AMOS)malware | — | Correlated cluster | 2026-08-18 |
| AnyDeskcampaign | Uses | GodPotatomalware | — | Correlated cluster | 2026-09-17 |
| Shai-Huludcampaign | Uses | Shai-Huludmalware | — | Correlated cluster | 2026-08-06 |
| BADBOXcampaign | Uses | ToxicPandamalware | — | Correlated cluster | 2026-08-27 |
| payload · Amateracampaign | Uses | XWORMmalware | — | Correlated cluster | 2026-09-24 |
| Qilin ransomwarecampaign | Uses | TWOSTROKE-like backdoormalware | — | Correlated cluster | 2026-09-11 |
| payload · XMRigcampaign | Uses | XMRigmalware | — | Correlated cluster | 2026-08-26 |
| BadIIScampaign | Uses | QuasarRATmalware | — | Correlated cluster | 2026-08-26 |
| PowerShell-based RATcampaign | Uses | BTR_CLImalware | — | Correlated cluster | 2026-08-31 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | ReverseSocksmalware | — | Correlated cluster | 2026-08-12 |
| AnyDeskcampaign | Uses | XWORMmalware | — | Correlated cluster | 2026-09-17 |
| XZ Utils backdoorcampaign | Uses | Shai-Hulud npm wormmalware | — | Correlated cluster | 2026-08-21 |
| JSCealcampaign | Uses | WEEVILPROXYmalware | — | Correlated cluster | 2026-09-02 |