NIMBUS MANTICORE uses DCSYNCER.SLICK

relationin forceversion 2

A relation MITRE ATT&CK Enterprise records between two entities. It names no address and no transaction.

MITRE ATT&CK Enterprise records that NIMBUS MANTICORE uses DCSYNCER.SLICK.

MITRE ATT&CK Enterprise · authority · 60 · first read 20 Oct 2026

version: 2 of 2; in force
in force since: not served; a relation carries no start
first read: 20 Oct 2026; 16:03 UTC
rests on: 1; its identifier in the source's own system
disputes: 0; none open · none resolved

Attributions

the claim · what it says, what it rests on, since when

what is said

from: NIMBUS MANTICOREthreat actor
states: uses
to: DCSYNCER.SLICKsoftware
about: the two entities · no address and no transaction
source: MITRE ATT&CK Enterpriselicence: MITRE ATT&CK terms of use
class: authority · 60from a public authority's own publication

MITRE ATT&CK® — © The MITRE Corporation, used under its terms

what it rests on 1

identifier: relationship--6091f1e4-505c-49ec-8cc6-67c13a5158eeits id in the source's own system
the source's file: sha256 539a843a7b53ed9749740b2123dddae3726b1a4831841c32aca740b011b910b5

the days

reported by the source: no report date: the record carries none
first read: 20 Oct 2026 16:03 UTC
written: 10 Nov 2026 19:50 UTCversion 2
in force since: not served
file read: not served: the record carries the file's hash and no time

A relation is between two entities. It never says that NIMBUS MANTICORE controls an address named for DCSYNCER.SLICK, and nothing on this page says so.

Everything said of NIMBUS MANTICORE Everything said of DCSYNCER.SLICK Dispute this claimnone open · none resolved

The record

cite it · its versions · check that what you quote is what is served

Citea citation names one claim at one version

citation: btcintel:relations:2951@v2 sha256:255e64f9b39115ea
this version: the link that pins version 2it keeps showing version 2 when a later one is written
as a file: the record as a STIX 2.1 file

Versions2 versions · the newest first

Version 2 · written 10 Nov 2026 19:50 UTC by the importer of MITRE ATT&CK Enterprisein forcethis pagebtcintel:relations:2951@v2 sha256:255e64f9b39115ea
Version 1 · written 20 Oct 2026 16:03 UTC by the importer of MITRE ATT&CK Enterprise · replaced on 10 Nov 2026 · its content is not kept · what is kept of version 1replacedbtcintel:relations:2951@v1 sha256:52c47e249a2a3840

The content of an earlier version is not kept: its hash and its citation stay. What changed between two versions is not served.

Verifythe hash of what is served must begin with the citation's 16 hex

A citation names a claim, a version and the first 16 hex of that version's content hash. Fetch the version and compare: the hash must begin with the citation's 16 hex. The ETag of the answer carries the same hash: production answers it weak (W/) and with its encoding's suffix (-gzip), or bare.

curl -sI "https://api.btcintel.io/v1/claims/rel_2951?version=2" | grep -i etag# ETag: W/"255e64f9b39115ea83de08dacb4ece73f15d55c5a43580d63e71fb658b900e26-gzip" curl -s "https://api.btcintel.io/v1/claims/rel_2951?version=2" | jq -r .content_sha256# 255e64f9b39115ea83de08dacb4ece73f15d55c5a43580d63e71fb658b900e26# the first 16 hex are the citation's: btcintel:relations:2951@v2 sha256:255e64f9b39115ea

it must give: 255e64f9b39115ea83de08dacb4ece73f15d55c5a43580d63e71fb658b900e26

Every change to the content writes a new version with its own hash; the previous version keeps its hash and its citation, so a quote never changes under the reader.