{"type":"bundle","id":"bundle--31ba37fc-f501-5d09-ad88-c2edd61299dc","objects":[{"type":"intrusion-set","id":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Agrius","description":"Iranian destructive-attack cluster operating wipers under ransomware cover.","aliases":["Agrius","Pink Sandstorm","DEV-0227","BlackShadow","AMERICIUM","UNC3890","G1030","IRON SANDSTORM"],"first_seen":"2020-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/agrius"},{"source_name":"mitre-attack","external_id":"G1030","url":"https://attack.mitre.org/groups/G1030/"}],"labels":["nation-state","dis"]},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--8f23bd73-aa57-5636-8371-4fefbbf4487c","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--12812afa-d011-50ee-ba2f-46d6a1cfbcc0","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Security Account Manager","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.002","url":"https://attack.mitre.org/techniques/T1003/002"}]},{"type":"relationship","id":"relationship--55feeb47-fef7-5b5d-a2e5-67d576905cd4","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--12812afa-d011-50ee-ba2f-46d6a1cfbcc0"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--2549396d-5cfd-5ec1-9363-ac516c0b5cc7","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--eca5d619-2c4b-5a82-a91f-21b1b021b20b","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--4274d6b8-5e21-5d17-b90e-9c5687120539","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Masquerading","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036","url":"https://attack.mitre.org/techniques/T1036"}]},{"type":"relationship","id":"relationship--b0299aa4-f2cf-5339-b0ac-e9d097fac076","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a"},{"type":"attack-pattern","id":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Exfiltration Over C2 Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1041","url":"https://attack.mitre.org/techniques/T1041"}]},{"type":"relationship","id":"relationship--9c05913f-4811-570a-a401-929421460255","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--6e61e59b-acff-51a5-bf18-c02b135992c1","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--95b4b508-904b-58c1-80f0-bd1cbc774fb5","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Domain Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.002","url":"https://attack.mitre.org/techniques/T1078/002"}]},{"type":"relationship","id":"relationship--c3338606-604c-5fca-801e-d4f56d42774e","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a"},{"type":"attack-pattern","id":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Brute Force","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1110","url":"https://attack.mitre.org/techniques/T1110"}]},{"type":"relationship","id":"relationship--9db49e1e-99cd-5893-a677-bb82390de9f8","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429"},{"type":"attack-pattern","id":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Automated Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1119","url":"https://attack.mitre.org/techniques/T1119"}]},{"type":"relationship","id":"relationship--d9fde5fe-45ea-5e24-99df-da94d330a991","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--52e2f92e-a937-5ba5-b6e3-f06a8759ac25","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--8bd79d64-44c0-5134-8dbb-f70b417ce910","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Windows Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1543.003","url":"https://attack.mitre.org/techniques/T1543/003"}]},{"type":"relationship","id":"relationship--24698000-4b3b-5257-9ae7-3d05fba353a5","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d"},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--f889ddac-b6de-505e-811f-942682371e8c","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Lateral Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1570","url":"https://attack.mitre.org/techniques/T1570"}]},{"type":"relationship","id":"relationship--8552631d-4b47-50e6-a1fe-deb07f2ce1c7","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807"},{"type":"attack-pattern","id":"attack-pattern--0f0cc6d7-1ffa-5b47-8f22-758cc19b400b","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Acquire Infrastructure","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583","url":"https://attack.mitre.org/techniques/T1583"}]},{"type":"relationship","id":"relationship--cc1751de-da1e-5e41-a35a-cee1b29fc514","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--0f0cc6d7-1ffa-5b47-8f22-758cc19b400b"},{"type":"attack-pattern","id":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Disable or Modify Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1685","url":"https://attack.mitre.org/techniques/T1685"}]},{"type":"relationship","id":"relationship--87249296-cb21-5bdd-bf58-e59c29b7aff6","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"uses","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f"},{"type":"location","id":"location--1375b154-0a19-561b-b92a-50fd99cbdd99","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"United Arab Emirates","country":"AE","region":"asia"},{"type":"relationship","id":"relationship--7d6ee9e4-0965-5afd-90f4-8d53df0d5833","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"targets","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"location--1375b154-0a19-561b-b92a-50fd99cbdd99"},{"type":"location","id":"location--a010f9b5-f121-5125-a684-6dd58c48d368","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","name":"Israel","country":"IL","region":"asia"},{"type":"relationship","id":"relationship--1d7acd32-20bc-5567-8bc8-e6aa83a6f4f2","spec_version":"2.1","created":"2026-05-20T09:52:17.502129+00:00","modified":"2026-07-28T19:41:19.916+00:00","relationship_type":"targets","source_ref":"intrusion-set--bc50655e-dda4-5c06-9593-c66c97c10f82","target_ref":"location--a010f9b5-f121-5125-a684-6dd58c48d368"}]}