{"type":"bundle","id":"bundle--0f715822-ba27-53b0-9c91-2758084dd1c9","objects":[{"type":"intrusion-set","id":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"APT17","aliases":["Hidden Lynx","Deputy Dog","Elderwood","SNEAKY PANDA","Tailgater Team","Group 8","AURORA PANDA","G0025","IRON TWILIGHT"],"first_seen":"2009-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt17"},{"source_name":"mitre-attack","external_id":"G0025","url":"https://attack.mitre.org/groups/G0025/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--02144a5a-d510-5191-bdfa-252c534be270","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"uses","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--cd4ecd74-d139-50de-a095-2315557dc810","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"uses","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--a8316f35-bfe4-5877-8ea4-4be351a01635","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"uses","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--99984fb2-318d-5d99-8d03-d9f165f252ca","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"uses","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--008b3c94-048b-5d09-8fee-e3bd7798323e","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"uses","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"Web Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.006","url":"https://attack.mitre.org/techniques/T1583/006"}]},{"type":"relationship","id":"relationship--1d7fc100-67ce-516d-9172-10f9449caa20","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"uses","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd"},{"type":"attack-pattern","id":"attack-pattern--529e32a9-c7b9-5de6-80b2-120cba6c2c76","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"Establish Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1585","url":"https://attack.mitre.org/techniques/T1585"}]},{"type":"relationship","id":"relationship--7dcea2b2-bef7-517f-a005-e5ce8166cf16","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"uses","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"attack-pattern--529e32a9-c7b9-5de6-80b2-120cba6c2c76"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--91ec0249-c348-50dd-819b-08794cb18b26","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"uses","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"Software Packing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.002","url":"https://attack.mitre.org/techniques/T1027/002"}]},{"type":"relationship","id":"relationship--84328805-6231-5bda-b642-9532f57bcfef","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"uses","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d"},{"type":"location","id":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"China","country":"CN","region":"asia"},{"type":"relationship","id":"relationship--0a56f5fb-e3c2-502d-b41c-39024ec6fc25","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"targets","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--5ebf10b7-54af-5d1b-bb5f-3e0c32df6525","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"targets","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--3608af70-5830-52be-8f4a-32b3e7e52fd8","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"targets","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--fdd2b200-8433-5c8c-bf67-4f516f1985d8","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"targets","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--fd98b554-2d31-56db-8bc0-812e65009813","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"Italy","country":"IT","region":"europe"},{"type":"relationship","id":"relationship--9229b684-146d-5111-a292-06dbe3347ef1","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"targets","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"location--fd98b554-2d31-56db-8bc0-812e65009813"},{"type":"location","id":"location--168ae1d8-d8eb-5440-9d21-d02292700adf","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"Japan","country":"JP","region":"asia"},{"type":"relationship","id":"relationship--2138a52d-8acf-578c-a6ae-27dfbbf79530","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"targets","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"location--168ae1d8-d8eb-5440-9d21-d02292700adf"},{"type":"location","id":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"South Korea","country":"KR","region":"asia"},{"type":"relationship","id":"relationship--7416bfac-987a-5882-8c5c-b4dfbbcffcdd","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"targets","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451"},{"type":"location","id":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"Saudi Arabia","country":"SA","region":"asia"},{"type":"relationship","id":"relationship--47fce664-e576-5965-8b98-a1972b570713","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"targets","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a"},{"type":"location","id":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"Taiwan","country":"TW","region":"asia"},{"type":"relationship","id":"relationship--174a4adb-16aa-5c00-8809-cc04363180da","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"targets","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--3754705e-5487-59df-beaa-c8330c27dede","spec_version":"2.1","created":"2026-05-20T09:50:11.477283+00:00","modified":"2026-07-28T19:36:36.27+00:00","relationship_type":"targets","source_ref":"intrusion-set--1373528b-de51-59e4-831f-2dc229e9bd3d","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}