{"type":"bundle","id":"bundle--5de503c9-a48f-55c3-8e43-e61953ae4304","objects":[{"type":"intrusion-set","id":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"APT36","aliases":["C-Major","ProjectM","Transparent Tribe","Earth Karkaddan","TMP.Lapis","MYTHIC LEOPARD","Chinstrap Spider","G0134","TA456","COPPER FIELDSTONE"],"first_seen":"2013-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt36"},{"source_name":"mitre-attack","external_id":"G0134","url":"https://attack.mitre.org/groups/G0134/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--b0f61a7b-e6f2-5091-bcb8-d1008ae40bb9","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"uses","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--35864a15-ac12-5b9e-93d9-3ae788cd4047","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"uses","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--20bf3b9d-e222-56dd-be9f-2f955573ec06","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"uses","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--4f5a4125-311f-5654-a7d2-d8dbb3d45de1","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"uses","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--395aeb20-152e-5925-81af-90e843681f1b","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"uses","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Hidden Files and Directories","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.001","url":"https://attack.mitre.org/techniques/T1564/001"}]},{"type":"relationship","id":"relationship--15b80699-38cf-5525-9a4e-0ee9e023e2a7","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"uses","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--6c48d3cc-9e4c-5133-b303-2ada48ebb829","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"uses","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--32a90e4b-c392-554a-a495-42e696451fb0","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"uses","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--69420771-365d-5078-846c-cbcc0ba9f63d","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Dynamic Resolution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1568","url":"https://attack.mitre.org/techniques/T1568"}]},{"type":"relationship","id":"relationship--705a7b89-bb13-5fa8-9d98-66ce024eb5e2","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"uses","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"attack-pattern--69420771-365d-5078-846c-cbcc0ba9f63d"},{"type":"location","id":"location--ae85030d-69cb-536c-8f14-e4336359104d","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Afghanistan","country":"AF","region":"asia"},{"type":"relationship","id":"relationship--0f3a5eb4-21bb-5b34-ae64-4f09d997be60","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--ae85030d-69cb-536c-8f14-e4336359104d"},{"type":"location","id":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Austria","country":"AT","region":"europe"},{"type":"relationship","id":"relationship--947fa9e5-e453-5cb9-8894-533a3ba744c6","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25"},{"type":"location","id":"location--a162b21a-e4f9-56d7-9d2c-b77b4154e783","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Bangladesh","country":"BD","region":"asia"},{"type":"relationship","id":"relationship--646ca193-c3bc-57f8-9f6f-e7c0242681bd","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--a162b21a-e4f9-56d7-9d2c-b77b4154e783"},{"type":"location","id":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Belgium","country":"BE","region":"europe"},{"type":"relationship","id":"relationship--006c504c-a611-5e85-b12f-849b3cff5f58","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5"},{"type":"location","id":"location--3db98014-8434-54ef-b886-ae0fb482b920","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Bahrain","country":"BH","region":"asia"},{"type":"relationship","id":"relationship--7a9166ba-1b94-5e4f-8292-bf3235be8d6f","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--3db98014-8434-54ef-b886-ae0fb482b920"},{"type":"location","id":"location--28c31ddb-f375-5682-8697-e338a5f5d82f","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Switzerland","country":"CH","region":"europe"},{"type":"relationship","id":"relationship--9f029e2f-ba1b-5052-8762-b066dcf7fc51","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--28c31ddb-f375-5682-8697-e338a5f5d82f"},{"type":"location","id":"location--4a5069fe-25e6-586d-834e-c4723e81277a","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Czechia","country":"CZ","region":"europe"},{"type":"relationship","id":"relationship--44e747ed-f074-594e-a2d7-491a34a5c07f","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--4a5069fe-25e6-586d-834e-c4723e81277a"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--46f4387e-d722-5229-9070-5815d14bac00","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--94ee4568-f4ff-5be3-a27f-9e1376e29e3e","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--ceb3cdea-557f-530b-a8aa-1c7f3b8acc64","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Kazakhstan","country":"KZ","region":"asia"},{"type":"relationship","id":"relationship--05828fae-0bb7-5593-9075-19bac02551f8","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--ceb3cdea-557f-530b-a8aa-1c7f3b8acc64"},{"type":"location","id":"location--51edd19f-4bd7-545d-9666-eb05f15cda9d","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Malaysia","country":"MY","region":"asia"},{"type":"relationship","id":"relationship--897f5a8c-7f78-54cd-9bac-da1fb6218b13","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--51edd19f-4bd7-545d-9666-eb05f15cda9d"},{"type":"location","id":"location--88c9fb6c-f398-559f-b18e-422cbb386901","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Norway","country":"NO","region":"europe"},{"type":"relationship","id":"relationship--f0528143-16eb-5804-a226-333ae9515dde","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--88c9fb6c-f398-559f-b18e-422cbb386901"},{"type":"location","id":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Pakistan","country":"PK","region":"asia"},{"type":"relationship","id":"relationship--b3e4d347-6d61-5112-be87-aa1dd2dbaebe","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77"},{"type":"location","id":"location--3cd79224-9615-55ee-8547-35f3201b8c4c","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Qatar","country":"QA","region":"asia"},{"type":"relationship","id":"relationship--8db192aa-732e-5d24-9d48-cf8f2268367f","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--3cd79224-9615-55ee-8547-35f3201b8c4c"},{"type":"location","id":"location--64282129-6afb-5607-8988-27d394389a0e","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"Sweden","country":"SE","region":"europe"},{"type":"relationship","id":"relationship--a850a78a-2b28-5a09-b03e-0276cf87d2c1","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--64282129-6afb-5607-8988-27d394389a0e"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--a5c302b1-f01e-58c1-b543-3745e4086a3f","spec_version":"2.1","created":"2026-05-20T09:50:16.292425+00:00","modified":"2026-07-29T07:05:32.531+00:00","relationship_type":"targets","source_ref":"intrusion-set--8a702163-02d2-5b13-a610-29106f307bd2","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}