Every asserted link across the corpus, materialized once with its source. Each edge names its two independent confidence axes where the source carries them — Evidence (is it real?) kept separate from Attribution (whose is it?). Indicators are defanged.
| From | Relationship | To | Confidence | Source | As of |
|---|---|---|---|---|---|
| CoolClientcampaign | Uses | infostealermalware | — | Correlated cluster | 2026-09-03 |
| PromptSpycampaign | Uses | OpenClawmalware | — | Correlated cluster | 2026-09-03 |
| payload · XMRigcampaign | Uses | Node.js-based JavaScript implantmalware | — | Correlated cluster | 2026-09-03 |
| AnyDeskcampaign | Uses | DragonForcemalware | — | Correlated cluster | 2026-09-17 |
| DeadLock ransomwarecampaign | Uses | RedExtmalware | — | Correlated cluster | 2026-09-04 |
| Dysphoriacampaign | Uses | GLMmalware | — | Correlated cluster | 2026-08-24 |
| AnyDeskcampaign | Uses | Waveboxmalware | — | Correlated cluster | 2026-09-17 |
| PhantomCorecampaign | Uses | SysReadSvc.dllmalware | — | Correlated cluster | 2026-08-25 |
| Astarothcampaign | Uses | OTTERCOOKIEmalware | — | Correlated cluster | 2026-08-18 |
| SparrowDoorcampaign | Uses | Luciferusmalware | — | Correlated cluster | 2026-09-21 |
| FudModulecampaign | Uses | Bulk-mail platform (Tubely-themed spam campaign)malware | — | Correlated cluster | 2026-09-03 |
| DeadLock ransomwarecampaign | Uses | PEEPmalware | — | Correlated cluster | 2026-09-04 |
| PowerShell-based RATcampaign | Uses | BTR.sysmalware | — | Correlated cluster | 2026-08-31 |
| JSCealcampaign | Uses | FudModulemalware | — | Correlated cluster | 2026-09-02 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | PentestGPTmalware | — | Correlated cluster | 2026-09-16 |
| Qilin (fka Agenda) · Qilincampaign | Uses | Stormousmalware | — | Correlated cluster | 2026-09-25 |
| PhantomCorecampaign | Uses | 360Util.dllmalware | — | Correlated cluster | 2026-08-25 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | 0APT Ransomwaremalware | — | Correlated cluster | 2026-08-12 |
| SparrowDoorcampaign | Uses | PhantomRavenmalware | — | Correlated cluster | 2026-09-21 |
| Qilin (fka Agenda) · Qilincampaign | Uses | ToxicPanda 2.0malware | — | Correlated cluster | 2026-09-25 |
| payload · Amateracampaign | Uses | QN Wallpapermalware | — | Correlated cluster | 2026-09-24 |
| Dysphoriacampaign | Uses | BusySnake Stealermalware | — | Correlated cluster | 2026-08-24 |
| PhantomCorecampaign | Uses | PhantomGraphmalware | — | Correlated cluster | 2026-08-25 |
| JWRcampaign | Uses | chrome_remotemalware | — | Correlated cluster | 2026-09-14 |
| MacSync Stealercampaign | Uses | OTTERCOOKIEmalware | — | Correlated cluster | 2026-08-18 |
| PhantomRavencampaign | Uses | PhantomRavenmalware | — | Correlated cluster | 2026-09-15 |
| Ransomwarecampaign | Uses | Ransomwaremalware | — | Correlated cluster | 2026-09-02 |
| JWRcampaign | Uses | FruitFlymalware | — | Correlated cluster | 2026-09-14 |
| payload · XMRigcampaign | Uses | Cavern frameworkmalware | — | Correlated cluster | 2026-09-03 |
| VectraRATcampaign | Uses | VectraRATmalware | — | Correlated cluster | 2026-09-17 |
| Qilin (fka Agenda) · Qilincampaign | Uses | MeshAgentmalware | — | Correlated cluster | 2026-09-25 |
| fscancampaign | Uses | cam-agent (cluster-asset-mapping)malware | — | Correlated cluster | 2026-09-02 |
| payload · Amateracampaign | Uses | Amateramalware | — | Correlated cluster | 2026-09-24 |
| JWRcampaign | Uses | The Outsidermalware | — | Correlated cluster | 2026-09-14 |
| CornFlakecampaign | Uses | ChocoShellmalware | — | Correlated cluster | 2026-08-20 |
| Shai-Huludcampaign | Uses | Miner Droppermalware | — | Correlated cluster | 2026-08-06 |
| AnyDeskcampaign | Uses | PAExecmalware | — | Correlated cluster | 2026-09-17 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | Anatsamalware | — | Correlated cluster | 2026-08-12 |
| PowerShell-based RATcampaign | Uses | PetitPotammalware | — | Correlated cluster | 2026-08-31 |
| Dysphoriacampaign | Uses | PAN-OS-User-ID-Buffer-Overflow-PoCmalware | — | Correlated cluster | 2026-08-24 |
| SparrowDoorcampaign | Uses | Information stealersmalware | — | Correlated cluster | 2026-09-21 |
| PhantomCorecampaign | Uses | Recipe Lister (NSIS installer)malware | — | Correlated cluster | 2026-08-25 |
| AnyDeskcampaign | Uses | ysoserialmalware | — | Correlated cluster | 2026-09-17 |
| fscancampaign | Uses | SilkLurkmalware | — | Correlated cluster | 2026-09-02 |
| msaRATcampaign | Uses | msaRATmalware | — | Correlated cluster | 2026-09-01 |
| Dysphoriacampaign | Uses | GSocketmalware | — | Correlated cluster | 2026-08-24 |
| Astarothcampaign | Uses | Glasswormmalware | — | Correlated cluster | 2026-08-18 |
| PromptSpycampaign | Uses | CANFAILmalware | — | Correlated cluster | 2026-09-03 |
| payload · Amateracampaign | Uses | CRUDEEXCLUDEmalware | — | Correlated cluster | 2026-09-24 |
| XZ Utils backdoorcampaign | Uses | XZ Utils backdoormalware | — | Correlated cluster | 2026-08-21 |