Every asserted link across the corpus, materialized once with its source. Each edge names its two independent confidence axes where the source carries them — Evidence (is it real?) kept separate from Attribution (whose is it?). Indicators are defanged.
| From | Relationship | To | Confidence | Source | As of |
|---|---|---|---|---|---|
| SparrowDoorcampaign | Uses | BragJackmalware | — | Correlated cluster | 2026-09-21 |
| payload · Amateracampaign | Uses | HEAVYGRAMmalware | — | Correlated cluster | 2026-09-24 |
| AnyDeskcampaign | Uses | GhostWebShellmalware | — | Correlated cluster | 2026-09-17 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | QuasarRATmalware | — | Correlated cluster | 2026-09-16 |
| MacSync Stealercampaign | Uses | ClickLock Stealermalware | — | Correlated cluster | 2026-08-18 |
| MacSynccampaign | Uses | Atomic Stealermalware | — | Correlated cluster | 2026-08-18 |
| Astarothcampaign | Uses | ClickLock Stealermalware | — | Correlated cluster | 2026-08-18 |
| payload · Amateracampaign | Uses | DotNetZip.dllmalware | — | Correlated cluster | 2026-09-24 |
| SparrowDoorcampaign | Uses | DanaBotmalware | — | Correlated cluster | 2026-09-21 |
| SPECTREcampaign | Uses | BadIISmalware | — | Correlated cluster | 2026-08-20 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | Coinminermalware | — | Correlated cluster | 2026-08-12 |
| AnyDeskcampaign | Uses | RedAlertmalware | — | Correlated cluster | 2026-09-17 |
| FudModulecampaign | Uses | SecurityPDFmalware | — | Correlated cluster | 2026-09-03 |
| Warlock · MeshAgentcampaign | Uses | Warlockmalware | — | Correlated cluster | 2026-09-03 |
| AnyDeskcampaign | Uses | Mimikatzmalware | — | Correlated cluster | 2026-09-17 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | Miner Droppermalware | — | Correlated cluster | 2026-08-12 |
| payload · XMRigcampaign | Uses | infostealermalware | — | Correlated cluster | 2026-09-03 |
| Astarothcampaign | Uses | GSocketmalware | — | Correlated cluster | 2026-08-18 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | Umbrijmalware | — | Correlated cluster | 2026-08-12 |
| SparrowDoorcampaign | Uses | SparroWockymalware | — | Correlated cluster | 2026-09-21 |
| PhantomCorecampaign | Uses | Rhadamanthysmalware | — | Correlated cluster | 2026-08-25 |
| MacSync Stealercampaign | Uses | MacSync Stealermalware | — | Correlated cluster | 2026-08-18 |
| payload · Amateracampaign | Uses | NetSupport Managermalware | — | Correlated cluster | 2026-09-24 |
| AnyDeskcampaign | Uses | adobe_32.exemalware | — | Correlated cluster | 2026-09-17 |
| payload · Amateracampaign | Uses | FalconFlankmalware | — | Correlated cluster | 2026-09-24 |
| Dysphoriacampaign | Uses | Codexmalware | — | Correlated cluster | 2026-08-24 |
| AnyDeskcampaign | Uses | Recipe Lister (NSIS installer)malware | — | Correlated cluster | 2026-09-17 |
| fscancampaign | Uses | opsproxy.cmalware | — | Correlated cluster | 2026-09-02 |
| Ransomwarecampaign | Uses | Denylisted internet resources (malicious hosts)malware | — | Correlated cluster | 2026-09-02 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | EfsPotatomalware | — | Correlated cluster | 2026-09-16 |
| payload · XMRigcampaign | Uses | FudModulemalware | — | Correlated cluster | 2026-09-03 |
| SparrowDoorcampaign | Uses | Grandoreiromalware | — | Correlated cluster | 2026-09-21 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | PAN-OS-User-ID-Buffer-Overflow-PoCmalware | — | Correlated cluster | 2026-09-16 |
| Qilin (fka Agenda) · Qilincampaign | Uses | SafePaymalware | — | Correlated cluster | 2026-09-25 |
| Shai-Huludcampaign | Uses | DDoS botnet toolingmalware | — | Correlated cluster | 2026-08-06 |
| Dysphoriacampaign | Uses | MiniMaxmalware | — | Correlated cluster | 2026-08-24 |
| PowerShell-based RATcampaign | Uses | TWOSTROKE-like backdoormalware | — | Correlated cluster | 2026-08-31 |
| AnyDeskcampaign | Uses | rdp2tcpmalware | — | Correlated cluster | 2026-09-17 |
| payload · XMRigcampaign | Uses | n-HTCommp.dllmalware | — | Correlated cluster | 2026-09-03 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | ZshBucketmalware | — | Correlated cluster | 2026-09-16 |
| XZ Utils backdoorcampaign | Uses | Trivy compromisemalware | — | Correlated cluster | 2026-08-21 |
| AnyDeskcampaign | Uses | GhostContainermalware | — | Correlated cluster | 2026-09-17 |
| Dysphoriacampaign | Uses | LapDogsmalware | — | Correlated cluster | 2026-08-24 |
| CoolClientcampaign | Uses | msagent.sys (kernel driver)malware | — | Correlated cluster | 2026-09-03 |
| AnyDeskcampaign | Uses | LockBitmalware | — | Correlated cluster | 2026-09-17 |
| Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroff · SPECTREcampaign | Uses | Gh0stCringemalware | — | Correlated cluster | 2026-09-16 |
| AnyDeskcampaign | Uses | Grammarlymalware | — | Correlated cluster | 2026-09-17 |
| AnyDeskcampaign | Uses | 360Util.dllmalware | — | Correlated cluster | 2026-09-17 |
| SparrowDoorcampaign | Uses | Fenix botnetmalware | — | Correlated cluster | 2026-09-21 |
| UNC1549 / TA455 · NightLedgercampaign | Uses | Creduzmalware | — | Correlated cluster | 2026-08-12 |