{"type":"bundle","id":"bundle--8ced6a8c-24fc-510e-ae1a-ae32139fe7fd","objects":[{"type":"intrusion-set","id":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"APT18","aliases":["Wekby","DYNAMITE PANDA","SCANDIUM","G0026","TG-0416"],"first_seen":"2009-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt18"},{"source_name":"mitre-attack","external_id":"G0026","url":"https://attack.mitre.org/groups/G0026/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--719620c4-ec11-5d41-b87a-2bd7444da224","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"At","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.002","url":"https://attack.mitre.org/techniques/T1053/002"}]},{"type":"relationship","id":"relationship--33051614-a2dd-54ee-b4ed-9fedb721cdd9","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"uses","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"attack-pattern--719620c4-ec11-5d41-b87a-2bd7444da224"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--a2cb6c1e-63b0-5bb4-8691-1f2eba491589","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"uses","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--cf8957e1-5e19-5b06-a2c4-6a39ec3870e0","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"uses","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--b2a4c884-2d55-5e85-9dd3-95d826b53316","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"uses","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--2492c2c0-56e3-5899-95e9-0b2c77e76d40","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"DNS","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.004","url":"https://attack.mitre.org/techniques/T1071/004"}]},{"type":"relationship","id":"relationship--30f4fc04-d61a-53bf-a203-b59cb44633a3","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"uses","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"attack-pattern--2492c2c0-56e3-5899-95e9-0b2c77e76d40"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--f841beae-c438-55bc-a468-1d10241aeebd","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"uses","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--be1d2c99-dffa-5f6a-a424-7603665a80f3","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"uses","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--ac4259ca-6ee5-53ae-9bc2-a6c5fdb7568d","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"uses","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--3f890294-f1be-5f0e-8fdf-a708c2c28dc9","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"uses","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"location","id":"location--a162b21a-e4f9-56d7-9d2c-b77b4154e783","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Bangladesh","country":"BD","region":"asia"},{"type":"relationship","id":"relationship--89cf9638-d160-5506-8289-bbdd750fa9cb","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--a162b21a-e4f9-56d7-9d2c-b77b4154e783"},{"type":"location","id":"location--df32d83f-5f4c-5118-a126-3f5c603db260","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Canada","country":"CA","region":"americas"},{"type":"relationship","id":"relationship--75cde172-c2ef-54cc-85b2-bfed220cec73","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--df32d83f-5f4c-5118-a126-3f5c603db260"},{"type":"location","id":"location--28c31ddb-f375-5682-8697-e338a5f5d82f","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Switzerland","country":"CH","region":"europe"},{"type":"relationship","id":"relationship--869e4c5e-df26-56fb-a7e6-7346a291ed36","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--28c31ddb-f375-5682-8697-e338a5f5d82f"},{"type":"location","id":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"China","country":"CN","region":"asia"},{"type":"relationship","id":"relationship--09498eaf-8b31-5ea7-a73b-03665632b4d5","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--e8590516-5e81-5499-b49c-f54f727a0655","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--bb45582d-2e27-5828-aa2f-343b24630f35","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Denmark","country":"DK","region":"europe"},{"type":"relationship","id":"relationship--26510d73-e239-5d07-a4be-a10c77cbfd73","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--bb45582d-2e27-5828-aa2f-343b24630f35"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--26ab10c7-85d7-5917-af6b-b3b23dd139f3","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--22995377-d1eb-5cb0-a092-2755bfe07958","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--a010f9b5-f121-5125-a684-6dd58c48d368","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Israel","country":"IL","region":"asia"},{"type":"relationship","id":"relationship--7d672eb5-b5ed-5aa9-a945-f12eba298c38","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--a010f9b5-f121-5125-a684-6dd58c48d368"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--8cbcc090-9b30-5fff-a858-c960e16bf79f","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--fd98b554-2d31-56db-8bc0-812e65009813","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Italy","country":"IT","region":"europe"},{"type":"relationship","id":"relationship--b1425995-affb-58ac-84b3-f193a1f4adba","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--fd98b554-2d31-56db-8bc0-812e65009813"},{"type":"location","id":"location--688e8d70-71a7-5dbf-9456-491580df260f","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Netherlands","country":"NL","region":"europe"},{"type":"relationship","id":"relationship--9bc67b55-3df2-59c6-9453-6c27be945e3c","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--688e8d70-71a7-5dbf-9456-491580df260f"},{"type":"location","id":"location--88c9fb6c-f398-559f-b18e-422cbb386901","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Norway","country":"NO","region":"europe"},{"type":"relationship","id":"relationship--cdad0169-5d3b-5d8e-942b-df12019f2b0f","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--88c9fb6c-f398-559f-b18e-422cbb386901"},{"type":"location","id":"location--94b84d12-7dfb-58a3-beee-9675b5717b84","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Romania","country":"RO","region":"europe"},{"type":"relationship","id":"relationship--1aeef79e-0f4a-511c-b6a5-085cdc2de439","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--94b84d12-7dfb-58a3-beee-9675b5717b84"},{"type":"location","id":"location--64282129-6afb-5607-8988-27d394389a0e","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"Sweden","country":"SE","region":"europe"},{"type":"relationship","id":"relationship--d9736bdb-80ec-5269-b07b-bf42d3b74971","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--64282129-6afb-5607-8988-27d394389a0e"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--8acfe700-bcb0-52eb-99bc-df2838b9412c","spec_version":"2.1","created":"2026-05-20T09:50:11.732081+00:00","modified":"2026-07-28T19:36:38.581+00:00","relationship_type":"targets","source_ref":"intrusion-set--b0d415db-8313-5e8d-aeb0-b4d32f792fa3","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}