{"type":"bundle","id":"bundle--283e061a-e78a-532c-b15f-a194d0fa7734","objects":[{"type":"intrusion-set","id":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"APT29","description":"Russian SVR cyber-espionage group; perpetrators of the SolarWinds supply-chain compromise.","aliases":["BlueBravo","Dark Halo","NobleBaron","Office Monkeys","The Dukes","NOBELIUM","IRON HEMLOCK","YTTRIUM","SilverFish","StellarParticle","EuroAPT","Group 100","ITG11","UNC2452","COZY BEAR","Dukes","CozyDuke","Midnight Blizzard","G0016","TA421","Blue Kitsune","IRON RITUAL"],"first_seen":"2008-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt29"},{"source_name":"mitre-attack","external_id":"G0016","url":"https://attack.mitre.org/groups/G0016/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--12812afa-d011-50ee-ba2f-46d6a1cfbcc0","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Security Account Manager","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.002","url":"https://attack.mitre.org/techniques/T1003/002"}]},{"type":"relationship","id":"relationship--112eae18-9479-5890-8396-4826e0eb8d8e","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--12812afa-d011-50ee-ba2f-46d6a1cfbcc0"},{"type":"attack-pattern","id":"attack-pattern--e730ac3e-024f-5cae-9dc2-e3cbabd3637e","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"LSA Secrets","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.004","url":"https://attack.mitre.org/techniques/T1003/004"}]},{"type":"relationship","id":"relationship--db49be78-e873-50db-a108-acbe858a8729","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--e730ac3e-024f-5cae-9dc2-e3cbabd3637e"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--f5e5219c-a47b-5ddf-8457-36ba3a90ab16","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--58a62067-a993-51de-9517-59c767f1bec9","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Cloud Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.007","url":"https://attack.mitre.org/techniques/T1021/007"}]},{"type":"relationship","id":"relationship--0c8428b1-f167-584f-830d-aa8d1e9a6a6a","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--58a62067-a993-51de-9517-59c767f1bec9"},{"type":"attack-pattern","id":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Software Packing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.002","url":"https://attack.mitre.org/techniques/T1027/002"}]},{"type":"relationship","id":"relationship--753cfc71-46d6-5f2e-b142-195adbbbba5f","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d"},{"type":"attack-pattern","id":"attack-pattern--3014dc00-7fa9-5856-a5e4-74d41be65422","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"HTML Smuggling","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.006","url":"https://attack.mitre.org/techniques/T1027/006"}]},{"type":"relationship","id":"relationship--84c63ef7-3ee9-562a-b70d-a369fef95994","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--3014dc00-7fa9-5856-a5e4-74d41be65422"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--10040159-6638-500c-b1e7-264947c657f5","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--213fdaf9-de7d-5a6a-a68f-d4a627869ff6","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Boot or Logon Initialization Scripts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1037","url":"https://attack.mitre.org/techniques/T1037"}]},{"type":"relationship","id":"relationship--823ea595-944c-5616-8aac-6d9eeeb08290","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--213fdaf9-de7d-5a6a-a68f-d4a627869ff6"},{"type":"attack-pattern","id":"attack-pattern--7ec24f15-d35d-53a6-b9fe-f86be9c208b4","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"RC Scripts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1037.004","url":"https://attack.mitre.org/techniques/T1037/004"}]},{"type":"relationship","id":"relationship--8cdb4723-c552-5a72-a0f0-010b95291031","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--7ec24f15-d35d-53a6-b9fe-f86be9c208b4"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--a05f5234-11e9-55da-be2c-10ce49d28c03","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--59b7ff29-8eaf-5fac-b73b-34c534046823","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--2bdd41ec-e6a0-51d5-bc76-a31398f7f8c8","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Python","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.006","url":"https://attack.mitre.org/techniques/T1059/006"}]},{"type":"relationship","id":"relationship--a4d3b3b1-29b6-5391-8fe0-393990f94bda","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8"},{"type":"attack-pattern","id":"attack-pattern--39e53027-3db7-5a7e-b953-254153905848","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Cloud API","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.009","url":"https://attack.mitre.org/techniques/T1059/009"}]},{"type":"relationship","id":"relationship--85a27c9e-8299-5187-8a52-02445c49f2b2","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--39e53027-3db7-5a7e-b953-254153905848"},{"type":"attack-pattern","id":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Exploitation for Privilege Escalation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Privilege Escalation"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1068","url":"https://attack.mitre.org/techniques/T1068"}]},{"type":"relationship","id":"relationship--c526707e-070c-5a5b-af31-ccaf43ed59a9","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--147aa390-da16-52f7-9fdf-12a5db9859e0","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--46b886a3-4cc4-54b7-92de-8f15b3420e60","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--f24fc6c6-3264-561f-bc0a-66bcf7a136d1","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Local Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.003","url":"https://attack.mitre.org/techniques/T1078/003"}]},{"type":"relationship","id":"relationship--042508b3-650f-5f72-9c12-0a60265fbd6a","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--f24fc6c6-3264-561f-bc0a-66bcf7a136d1"},{"type":"attack-pattern","id":"attack-pattern--72efb1f7-de6a-505c-92c5-6fa3be73a7ff","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Cloud Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.004","url":"https://attack.mitre.org/techniques/T1078/004"}]},{"type":"relationship","id":"relationship--e33c2f61-7470-5718-83dd-b02ef9c7c09e","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--72efb1f7-de6a-505c-92c5-6fa3be73a7ff"},{"type":"attack-pattern","id":"attack-pattern--c3b792ac-e8f6-5efc-a44e-6285b6c26efe","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Cloud Account","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1087.004","url":"https://attack.mitre.org/techniques/T1087/004"}]},{"type":"relationship","id":"relationship--fb1fc68d-7ff8-5be8-84e6-4169b9a06d0b","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--c3b792ac-e8f6-5efc-a44e-6285b6c26efe"},{"type":"attack-pattern","id":"attack-pattern--9f7c0857-0baa-5755-b5ec-486a7e742002","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Multi-hop Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090.003","url":"https://attack.mitre.org/techniques/T1090/003"}]},{"type":"relationship","id":"relationship--2cd6ab04-aed1-50a1-b184-b274ccdb612d","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--9f7c0857-0baa-5755-b5ec-486a7e742002"},{"type":"attack-pattern","id":"attack-pattern--839df4c5-26f3-5937-8704-edcae80d86f2","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Domain Fronting","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090.004","url":"https://attack.mitre.org/techniques/T1090/004"}]},{"type":"relationship","id":"relationship--531c1ab9-437f-5e05-abf3-cb1752c17ace","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--839df4c5-26f3-5937-8704-edcae80d86f2"},{"type":"attack-pattern","id":"attack-pattern--9b5f4d42-a295-5972-84c3-adc1cfdb016e","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Additional Email Delegate Permissions","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1098.002","url":"https://attack.mitre.org/techniques/T1098/002"}]},{"type":"relationship","id":"relationship--9544062b-fe45-5111-b303-076f16495e32","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--9b5f4d42-a295-5972-84c3-adc1cfdb016e"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--8adf67ff-0487-54e0-861a-7d6342d25be4","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--17aa8f39-b715-569f-acd8-521a0da1ac7b","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Remote Email Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1114.002","url":"https://attack.mitre.org/techniques/T1114/002"}]},{"type":"relationship","id":"relationship--df25c4bb-576f-5a49-9b51-339a347da5a4","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--17aa8f39-b715-569f-acd8-521a0da1ac7b"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--9cfe374c-db76-5f8a-8ba9-bd0ba54351ab","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--f3fcca7a-d631-55d5-bcad-b6435cb281ba","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Trusted Relationship","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1199","url":"https://attack.mitre.org/techniques/T1199"}]},{"type":"relationship","id":"relationship--6c656c6d-ee95-5e48-9988-479091fed2b8","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--f3fcca7a-d631-55d5-bcad-b6435cb281ba"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--a14314da-3002-5ed5-8ea4-63cd1fe4495d","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--f620caa8-c0d7-5b27-90c9-6fb722b34e1a","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Mshta","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.005","url":"https://attack.mitre.org/techniques/T1218/005"}]},{"type":"relationship","id":"relationship--916854e3-49f2-582b-ba2e-658a747e1d0f","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda"},{"type":"attack-pattern","id":"attack-pattern--d4ea0b7e-fb73-5b3b-a10a-b196577fff20","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Steal Application Access Token","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1528","url":"https://attack.mitre.org/techniques/T1528"}]},{"type":"relationship","id":"relationship--c6ee438c-b5c8-5b16-aa8e-2457f4eeef19","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--d4ea0b7e-fb73-5b3b-a10a-b196577fff20"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--66c05bb3-ca03-592a-8f10-d73ea122116b","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--f695f35b-8401-5c0d-9f29-b29f2fcb29cb","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Pass the Ticket","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1550.003","url":"https://attack.mitre.org/techniques/T1550/003"}]},{"type":"relationship","id":"relationship--d3debfb9-49e5-57e7-940e-4f35576e01f8","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--f695f35b-8401-5c0d-9f29-b29f2fcb29cb"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--41ab4a58-6f71-5693-82ac-eaf274547186","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--ae0f3297-507a-51a3-ac03-7593bd07e0ce","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--9eb184f4-55af-53a7-97c4-5f226ca51dd7","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Spearphishing via Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.003","url":"https://attack.mitre.org/techniques/T1566/003"}]},{"type":"relationship","id":"relationship--83cd645f-a591-5201-b46c-4bf8862e8fdd","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--9eb184f4-55af-53a7-97c4-5f226ca51dd7"},{"type":"attack-pattern","id":"attack-pattern--69420771-365d-5078-846c-cbcc0ba9f63d","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Dynamic Resolution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1568","url":"https://attack.mitre.org/techniques/T1568"}]},{"type":"relationship","id":"relationship--2b9bdb60-9b4f-5b61-8712-a4421746bc62","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--69420771-365d-5078-846c-cbcc0ba9f63d"},{"type":"attack-pattern","id":"attack-pattern--112fb2d7-85f2-528f-98b7-c446712039b6","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Encrypted Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1573","url":"https://attack.mitre.org/techniques/T1573"}]},{"type":"relationship","id":"relationship--0f4d8643-bed5-56c4-a8f4-a8c83e9ac8a2","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--112fb2d7-85f2-528f-98b7-c446712039b6"},{"type":"attack-pattern","id":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Web Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.006","url":"https://attack.mitre.org/techniques/T1583/006"}]},{"type":"relationship","id":"relationship--14b6578c-3dba-5b79-b4d0-be2a14804a19","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd"},{"type":"attack-pattern","id":"attack-pattern--31a1f6e6-1aff-5ad3-920e-170a66554e9d","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Multi-Factor Authentication Request Generation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1621","url":"https://attack.mitre.org/techniques/T1621"}]},{"type":"relationship","id":"relationship--ae48c1b0-0767-5057-9769-8c222ca1609f","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--31a1f6e6-1aff-5ad3-920e-170a66554e9d"},{"type":"attack-pattern","id":"attack-pattern--bdb25709-49e8-59b9-bc24-2a9f6882019b","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Steal or Forge Authentication Certificates","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1649","url":"https://attack.mitre.org/techniques/T1649"}]},{"type":"relationship","id":"relationship--062f75ee-83a7-5155-b389-9dda7712cb17","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--bdb25709-49e8-59b9-bc24-2a9f6882019b"},{"type":"attack-pattern","id":"attack-pattern--976f5a63-9082-5922-b0f1-ebb005c96bcb","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Cloud Administration Command","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1651","url":"https://attack.mitre.org/techniques/T1651"}]},{"type":"relationship","id":"relationship--e3af1372-214b-5b3f-9c20-85ce39588a75","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--976f5a63-9082-5922-b0f1-ebb005c96bcb"},{"type":"attack-pattern","id":"attack-pattern--173d4a21-d769-5268-ab41-8e1ab73cfa19","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Hide Infrastructure","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1665","url":"https://attack.mitre.org/techniques/T1665"}]},{"type":"relationship","id":"relationship--6e3c1740-6f60-581f-81f5-5bbac3dc8f93","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"uses","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"attack-pattern--173d4a21-d769-5268-ab41-8e1ab73cfa19"},{"type":"location","id":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Austria","country":"AT","region":"europe"},{"type":"relationship","id":"relationship--4276b31b-b8b1-5022-9dce-ec80d17b6090","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25"},{"type":"location","id":"location--0b52720f-a42f-5bec-bac1-5784de12282c","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Brazil","country":"BR","region":"americas"},{"type":"relationship","id":"relationship--d4cc13e9-ef86-5d5e-9891-35191883aa24","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--0b52720f-a42f-5bec-bac1-5784de12282c"},{"type":"location","id":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"China","country":"CN","region":"asia"},{"type":"relationship","id":"relationship--c18a5b1c-38cb-5319-8fa3-687443f52833","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--ceec0a4c-33af-5e23-8390-53671ef27047","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--bb45582d-2e27-5828-aa2f-343b24630f35","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Denmark","country":"DK","region":"europe"},{"type":"relationship","id":"relationship--1fa78e78-a85c-5059-b069-80f0d873c41d","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--bb45582d-2e27-5828-aa2f-343b24630f35"},{"type":"location","id":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Spain","country":"ES","region":"europe"},{"type":"relationship","id":"relationship--daa441b1-2175-5e50-97ec-b4ea52705a94","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--13cf634b-ce16-5836-bab1-c5a66969f642","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--1babfda1-5d52-5fc9-a64f-bdef035282ad","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--9cc80d10-4fe5-5958-aaea-36a6dcfef122","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Greece","country":"GR","region":"europe"},{"type":"relationship","id":"relationship--f8eb50ab-c23e-5764-93a1-9885cdc4bafe","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--9cc80d10-4fe5-5958-aaea-36a6dcfef122"},{"type":"location","id":"location--382d5ccf-5b08-5a14-b75e-b8f55bfacbae","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Hungary","country":"HU","region":"europe"},{"type":"relationship","id":"relationship--92616e4b-5a60-51c1-8968-a5979949c935","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--382d5ccf-5b08-5a14-b75e-b8f55bfacbae"},{"type":"location","id":"location--a010f9b5-f121-5125-a684-6dd58c48d368","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Israel","country":"IL","region":"asia"},{"type":"relationship","id":"relationship--a25865e3-5e8a-5e61-aeeb-3e9d4e794c6a","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--a010f9b5-f121-5125-a684-6dd58c48d368"},{"type":"location","id":"location--168ae1d8-d8eb-5440-9d21-d02292700adf","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Japan","country":"JP","region":"asia"},{"type":"relationship","id":"relationship--d1802ed0-36c7-5819-bad9-2deb2662e161","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--168ae1d8-d8eb-5440-9d21-d02292700adf"},{"type":"location","id":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"South Korea","country":"KR","region":"asia"},{"type":"relationship","id":"relationship--d67c5964-7c2a-5908-a61c-dcd469df79c2","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451"},{"type":"location","id":"location--947724ed-c15a-532c-b2d0-82a6dc7ef55d","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Montenegro","country":"ME","region":"europe"},{"type":"relationship","id":"relationship--4f1c0cd9-5dd8-536b-afe9-5b46b56f7cff","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--947724ed-c15a-532c-b2d0-82a6dc7ef55d"},{"type":"location","id":"location--e6a15e3d-a6f4-57b1-8ecb-a2a326fbe2f4","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Mongolia","country":"MN","region":"asia"},{"type":"relationship","id":"relationship--dd71e5d1-a283-5763-9c99-9bbf4ce421d5","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--e6a15e3d-a6f4-57b1-8ecb-a2a326fbe2f4"},{"type":"location","id":"location--65f9d1ed-f890-5422-9b80-26fc28964f39","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Mexico","country":"MX","region":"americas"},{"type":"relationship","id":"relationship--33859411-f313-59aa-89c5-e44135f5c9aa","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--65f9d1ed-f890-5422-9b80-26fc28964f39"},{"type":"location","id":"location--688e8d70-71a7-5dbf-9456-491580df260f","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Netherlands","country":"NL","region":"europe"},{"type":"relationship","id":"relationship--ad7dd251-699e-5733-9181-65cb46a55ec7","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--688e8d70-71a7-5dbf-9456-491580df260f"},{"type":"location","id":"location--88c9fb6c-f398-559f-b18e-422cbb386901","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Norway","country":"NO","region":"europe"},{"type":"relationship","id":"relationship--5c2ee881-d807-50fe-a912-b6afdc407f35","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--88c9fb6c-f398-559f-b18e-422cbb386901"},{"type":"location","id":"location--74c4c4a2-e626-5e3e-adcf-be8b651868c4","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"New Zealand","country":"NZ","region":"oceania"},{"type":"relationship","id":"relationship--4715c530-d89f-5baa-ae1a-5619e0cfae55","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--74c4c4a2-e626-5e3e-adcf-be8b651868c4"},{"type":"location","id":"location--28af571d-efb5-5547-b4c0-f5be348ac20a","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Poland","country":"PL","region":"europe"},{"type":"relationship","id":"relationship--d0c47fc5-6f54-5b5b-ada6-f9a1dde21fa0","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--28af571d-efb5-5547-b4c0-f5be348ac20a"},{"type":"location","id":"location--b9003050-1590-5985-af03-7404b1026324","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Portugal","country":"PT","region":"europe"},{"type":"relationship","id":"relationship--206f8138-acd7-52fd-9503-d6563cd2d7a3","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--b9003050-1590-5985-af03-7404b1026324"},{"type":"location","id":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Türkiye","country":"TR","region":"asia"},{"type":"relationship","id":"relationship--e3d7f946-c2e9-5e3b-8014-a6f539a7e6b4","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe"},{"type":"location","id":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Ukraine","country":"UA","region":"europe"},{"type":"relationship","id":"relationship--adb9223b-93e9-5b55-a65b-bb93855c1f2a","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--3bb67a36-9c55-5c0a-827f-d43b8c970b83","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"},{"type":"location","id":"location--c101610e-3c82-519e-8943-ba6bf39ac87e","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","name":"Uzbekistan","country":"UZ","region":"asia"},{"type":"relationship","id":"relationship--c3dcdd7b-a4a8-5ba3-a8ed-380544d8272d","spec_version":"2.1","created":"2026-05-20T09:50:14.526193+00:00","modified":"2026-07-29T07:05:23.684+00:00","relationship_type":"targets","source_ref":"intrusion-set--b44f5e4a-5df1-5aff-981b-e6bada3a5ac7","target_ref":"location--c101610e-3c82-519e-8943-ba6bf39ac87e"}]}