{"type":"bundle","id":"bundle--9a7210eb-f034-5a15-95ca-d586afeea002","objects":[{"type":"intrusion-set","id":"intrusion-set--0ced95e0-7c86-520c-962d-062e39d35397","spec_version":"2.1","created":"2026-05-20T09:50:12.752187+00:00","modified":"2026-07-29T07:05:12.219+00:00","name":"APT22","aliases":["Barista","Suckfly","BARISTA PANDA","G0014"],"first_seen":"2014-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt22"},{"source_name":"mitre-attack","external_id":"G0014","url":"https://attack.mitre.org/groups/G0014/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56","spec_version":"2.1","created":"2026-05-20T09:50:12.752187+00:00","modified":"2026-07-29T07:05:12.219+00:00","name":"OS Credential Dumping","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003","url":"https://attack.mitre.org/techniques/T1003"}]},{"type":"relationship","id":"relationship--c08bd122-1387-5376-b3fc-f7060ef7b9e9","spec_version":"2.1","created":"2026-05-20T09:50:12.752187+00:00","modified":"2026-07-29T07:05:12.219+00:00","relationship_type":"uses","source_ref":"intrusion-set--0ced95e0-7c86-520c-962d-062e39d35397","target_ref":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:50:12.752187+00:00","modified":"2026-07-29T07:05:12.219+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--6ba5483f-8db8-5438-a794-d508e468bd7f","spec_version":"2.1","created":"2026-05-20T09:50:12.752187+00:00","modified":"2026-07-29T07:05:12.219+00:00","relationship_type":"uses","source_ref":"intrusion-set--0ced95e0-7c86-520c-962d-062e39d35397","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:12.752187+00:00","modified":"2026-07-29T07:05:12.219+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--fb6e0580-50dc-57b8-a058-ba77cb8b81e0","spec_version":"2.1","created":"2026-05-20T09:50:12.752187+00:00","modified":"2026-07-29T07:05:12.219+00:00","relationship_type":"uses","source_ref":"intrusion-set--0ced95e0-7c86-520c-962d-062e39d35397","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:50:12.752187+00:00","modified":"2026-07-29T07:05:12.219+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--bbdefe69-4505-52bf-b097-698ffa4f751d","spec_version":"2.1","created":"2026-05-20T09:50:12.752187+00:00","modified":"2026-07-29T07:05:12.219+00:00","relationship_type":"uses","source_ref":"intrusion-set--0ced95e0-7c86-520c-962d-062e39d35397","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"}]}