Every asserted link across the corpus, materialized once with its source. Each edge names its two independent confidence axes where the source carries them — Evidence (is it real?) kept separate from Attribution (whose is it?). Indicators are defanged.
| From | Relationship | To | Confidence | Source | As of |
|---|---|---|---|---|---|
| UNC1549 / TA455 · NightLedgercampaign | Uses | NightLedgermalware | — | Correlated cluster | 2026-08-12 |
| PowerShell-based RATcampaign | Uses | MpEngine.dllmalware | — | Correlated cluster | 2026-08-31 |
| Qilin (fka Agenda) · Qilincampaign | Uses | Lummamalware | — | Correlated cluster | 2026-09-25 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | Trojan-Dropper.AndroidOS.Bankermalware | — | Correlated cluster | 2026-08-12 |
| msgbox.execampaign | Uses | msgbox.exemalware | — | Correlated cluster | 2026-09-21 |
| JSCealcampaign | Uses | Troymalware | — | Correlated cluster | 2026-09-02 |
| Qilin (fka Agenda) · Qilincampaign | Uses | MeshCentralmalware | — | Correlated cluster | 2026-09-25 |
| AnyDeskcampaign | Uses | ChatGPTmalware | — | Correlated cluster | 2026-09-17 |
| Qilin (fka Agenda) · Qilincampaign | Uses | x.jspmalware | — | Correlated cluster | 2026-09-25 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | NoodleRATmalware | — | Correlated cluster | 2026-09-16 |
| AnyDeskcampaign | Uses | DeadLock ransomwaremalware | — | Correlated cluster | 2026-09-17 |
| Qilin (fka Agenda) · Qilincampaign | Uses | Rhysidamalware | — | Correlated cluster | 2026-09-25 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | custom Go command-and-control platformmalware | — | Correlated cluster | 2026-09-16 |
| TeamPCP Cloud Stealercampaign | Uses | BADFALLmalware | — | Correlated cluster | 2026-09-02 |
| JSCealcampaign | Uses | JSCealmalware | — | Correlated cluster | 2026-09-02 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | FofaMap-Platinum-Full-Expert MCP servermalware | — | Correlated cluster | 2026-09-16 |
| AnyDeskcampaign | Uses | Astrill VPNmalware | — | Correlated cluster | 2026-09-17 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | Kimimalware | — | Correlated cluster | 2026-09-16 |
| Information stealerscampaign | Uses | Bulk-mail platform (Tubely-themed spam campaign)malware | — | Correlated cluster | 2026-09-03 |
| BadIIScampaign | Uses | PentestGPTmalware | — | Correlated cluster | 2026-08-26 |
| GoogleService.dllcampaign | Uses | texture.dllmalware | — | Correlated cluster | 2026-09-04 |
| payload · Amateracampaign | Uses | GCleanermalware | — | Correlated cluster | 2026-09-24 |
| Warlock · MeshAgentcampaign | Uses | EvilTokensmalware | — | Correlated cluster | 2026-09-03 |
| GoogleService.dllcampaign | Uses | Toy Ghouls backdoormalware | — | Correlated cluster | 2026-09-04 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | DDoS botnet toolingmalware | — | Correlated cluster | 2026-08-12 |
| FudModulecampaign | Uses | MISTPENmalware | — | Correlated cluster | 2026-09-03 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | ArcBridgemalware | — | Correlated cluster | 2026-08-12 |
| XZ Utils backdoorcampaign | Uses | ChainDrop npm wormmalware | — | Correlated cluster | 2026-08-21 |
| fscancampaign | Uses | fscanmalware | — | Correlated cluster | 2026-09-02 |
| SparrowDoorcampaign | Uses | LummaC2malware | — | Correlated cluster | 2026-09-21 |
| PowerShell-based RATcampaign | Uses | lpk.dllmalware | — | Correlated cluster | 2026-08-31 |
| AnyDeskcampaign | Uses | SysExcSvc.dllmalware | — | Correlated cluster | 2026-09-17 |
| AnyDeskcampaign | Uses | MEmumalware | — | Correlated cluster | 2026-09-17 |
| SPECTREcampaign | Uses | Spectermalware | — | Correlated cluster | 2026-08-20 |
| JWRcampaign | Uses | obfuscator.iomalware | — | Correlated cluster | 2026-09-14 |
| MacSynccampaign | Uses | ProKYCmalware | — | Correlated cluster | 2026-08-18 |
| SparrowDoorcampaign | Uses | Casabaneiro (Mekotio)malware | — | Correlated cluster | 2026-09-21 |
| BianLian ransomwarecampaign | Uses | BianLian ransomwaremalware | — | Correlated cluster | 2026-08-11 |
| Trojanized PDF softwarecampaign | Uses | Monero minermalware | — | Correlated cluster | 2026-08-17 |
| payload · XMRigcampaign | Uses | Cavern Agentmalware | — | Correlated cluster | 2026-09-03 |
| PowerShell-based RATcampaign | Uses | PowerShell-based RATmalware | — | Correlated cluster | 2026-08-31 |
| SPECTREcampaign | Uses | NoodleRATmalware | — | Correlated cluster | 2026-08-20 |
| Cyclops Blinkcampaign | Uses | Cyclops Blinkmalware | — | Correlated cluster | 2026-09-10 |
| Cyclops Blinkcampaign | Uses | Qilinmalware | — | Correlated cluster | 2026-09-10 |
| AnyDeskcampaign | Uses | iTop Screen Recordermalware | — | Correlated cluster | 2026-09-17 |
| Dysphoriacampaign | Uses | FofaMap-Platinum-Full-Expert MCP servermalware | — | Correlated cluster | 2026-08-24 |
| STOCKSTAYcampaign | Uses | Uroburosmalware | — | Correlated cluster | 2026-08-04 |
| Dysphoriacampaign | Uses | Kimimalware | — | Correlated cluster | 2026-08-24 |
| Astarothcampaign | Uses | Varegmalware | — | Correlated cluster | 2026-08-18 |
| Qilin (fka Agenda) · Qilincampaign | Uses | BlackBytemalware | — | Correlated cluster | 2026-09-25 |