{"type":"bundle","id":"bundle--4efdf2da-28a6-5541-91e6-3ddbef68f2a9","objects":[{"type":"intrusion-set","id":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"APT37","aliases":["RICOCHET CHOLLIMA","ScarCruft","Group 123","Reaper Group","ATK4","Operation Daybreak","InkySquid","Geumseong121","VELVET CHOLLIMA","Reaper","Ruby Sleet","G0067","TA406","IRON TILDEN"],"first_seen":"2012-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt37"},{"source_name":"mitre-attack","external_id":"G0067","url":"https://attack.mitre.org/groups/G0067/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--48ecf023-701f-5fe6-9391-3bac5f4d207b","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Obfuscated Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027","url":"https://attack.mitre.org/techniques/T1027"}]},{"type":"relationship","id":"relationship--9fe4f3e9-65e1-52cc-a47a-96843799dda0","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f"},{"type":"attack-pattern","id":"attack-pattern--6aa1111e-c29d-5cd6-91d5-69ab9b7c0d27","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Steganography","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.003","url":"https://attack.mitre.org/techniques/T1027/003"}]},{"type":"relationship","id":"relationship--14e3018c-0a94-5a14-8a88-762fb841efb8","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--6aa1111e-c29d-5cd6-91d5-69ab9b7c0d27"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--2cf62fee-43c5-5263-8a2a-9217a3fce70c","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--901e3ee7-fbb7-5030-8ed3-f2a219a543ba","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Invalid Code Signature","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.001","url":"https://attack.mitre.org/techniques/T1036/001"}]},{"type":"relationship","id":"relationship--9a780362-5d5b-5241-9574-d832deec0cb2","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--901e3ee7-fbb7-5030-8ed3-f2a219a543ba"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--8d9fa9cb-1719-5443-94e9-b72f98c14ced","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--0728d173-d841-5e1a-9bc7-74797f2e9d73","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Process Injection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1055","url":"https://attack.mitre.org/techniques/T1055"}]},{"type":"relationship","id":"relationship--da66ff36-beab-501c-abba-0da1ffb22cd5","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--0728d173-d841-5e1a-9bc7-74797f2e9d73"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--52d9fec4-2de4-5d5e-80ca-6a30785d9c3a","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Command and Scripting Interpreter","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059","url":"https://attack.mitre.org/techniques/T1059"}]},{"type":"relationship","id":"relationship--c3826669-fdc7-5f96-82e3-fadee83951c7","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--e20a02dd-5816-5185-95d4-913dc1772c66","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--c5968997-fb2d-5667-81bb-ffca157bae2b","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Python","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.006","url":"https://attack.mitre.org/techniques/T1059/006"}]},{"type":"relationship","id":"relationship--86a4cddb-1463-568a-84c1-44a3ae6f6cd6","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--8c92efe5-27c7-54e6-accb-36b3c8945bd0","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Bidirectional Communication","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102.002","url":"https://attack.mitre.org/techniques/T1102/002"}]},{"type":"relationship","id":"relationship--fa5f84ae-56bb-5c44-b406-25007fdff0b2","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--9709c043-c235-5ed6-a3c2-b2dafa12e12f","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Native API","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1106","url":"https://attack.mitre.org/techniques/T1106"}]},{"type":"relationship","id":"relationship--00e2533c-15bf-5fdf-9300-231b8060194c","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8"},{"type":"attack-pattern","id":"attack-pattern--a44e3e33-3fff-56cd-9c7b-cf1eecd8bdae","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Peripheral Device Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1120","url":"https://attack.mitre.org/techniques/T1120"}]},{"type":"relationship","id":"relationship--9e821fed-ac06-54e5-8e9d-57a888fdd559","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--a44e3e33-3fff-56cd-9c7b-cf1eecd8bdae"},{"type":"attack-pattern","id":"attack-pattern--03fc00df-d0c3-5c8d-90ef-f0edf6acc7c0","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Audio Capture","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1123","url":"https://attack.mitre.org/techniques/T1123"}]},{"type":"relationship","id":"relationship--3a396198-d5c8-5ecb-a7e0-627ecadde0ef","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--03fc00df-d0c3-5c8d-90ef-f0edf6acc7c0"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--055f53bf-41f3-5df9-be3b-50c992c6fae7","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--d195a757-6e75-5a28-8c62-6e91dbf29da1","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--8f1d05d6-7cf5-5858-a1e5-4e0e5db87250","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"System Shutdown/Reboot","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1529","url":"https://attack.mitre.org/techniques/T1529"}]},{"type":"relationship","id":"relationship--b8c15e96-1cac-59da-aeec-8dd1c4867b35","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--8f1d05d6-7cf5-5858-a1e5-4e0e5db87250"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--a53853c6-ab0d-52fa-ab36-5623ca8c70cf","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Credentials from Web Browsers","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.003","url":"https://attack.mitre.org/techniques/T1555/003"}]},{"type":"relationship","id":"relationship--58b8b18a-96fe-5d7b-8e03-474891fc4592","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070"},{"type":"attack-pattern","id":"attack-pattern--f59d7eb7-48ba-5568-a6b4-1e19ec2e8223","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Disk Structure Wipe","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1561.002","url":"https://attack.mitre.org/techniques/T1561/002"}]},{"type":"relationship","id":"relationship--5c203fb2-6789-5e4b-a6fc-2d9b78e4a326","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--f59d7eb7-48ba-5568-a6b4-1e19ec2e8223"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--6b82359d-0915-567c-9813-5d86c66abf74","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"uses","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"location","id":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"China","country":"CN","region":"asia"},{"type":"relationship","id":"relationship--5770268c-a10d-5c35-a8e5-72cf4b343d1b","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--b89fd5d6-6ac9-555e-a23e-f305e2cdf56c","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--fe5915e8-c6cf-5230-9d81-da8132a006fa","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Egypt","country":"EG","region":"africa"},{"type":"relationship","id":"relationship--7c165775-d609-544d-a884-ee911a26da1f","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--fe5915e8-c6cf-5230-9d81-da8132a006fa"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--12627225-101f-50f6-8176-151d3bd88360","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--f5b2a17c-fd88-5c13-a1d6-5eb706553e8b","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Hong Kong","country":"HK","region":"asia"},{"type":"relationship","id":"relationship--69b40129-6b1b-5c10-8727-10d466f17a51","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff"},{"type":"location","id":"location--28697960-8769-586b-b87b-b9c4e8e68b1d","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Indonesia","country":"ID","region":"asia"},{"type":"relationship","id":"relationship--a08e37f4-0161-55a9-b3c8-864a57d3d315","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--28697960-8769-586b-b87b-b9c4e8e68b1d"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--11a380c2-3142-5b61-9625-b59ed5208369","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--168ae1d8-d8eb-5440-9d21-d02292700adf","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Japan","country":"JP","region":"asia"},{"type":"relationship","id":"relationship--4cff3af5-54a4-551d-ba53-1c079e7e10f2","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--168ae1d8-d8eb-5440-9d21-d02292700adf"},{"type":"location","id":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"South Korea","country":"KR","region":"asia"},{"type":"relationship","id":"relationship--fc04a455-6445-53b8-855b-51e2eb9718c1","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451"},{"type":"location","id":"location--657f368a-bd77-5f31-84cf-340236190da3","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Russia","country":"RU","region":"europe"},{"type":"relationship","id":"relationship--bb524713-1881-5a37-875f-068ada89e540","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--657f368a-bd77-5f31-84cf-340236190da3"},{"type":"location","id":"location--5335c49c-6927-5649-8a2c-06f868a6e189","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Slovakia","country":"SK","region":"europe"},{"type":"relationship","id":"relationship--7bc783ec-4114-511b-8dd4-e3301a838c85","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--5335c49c-6927-5649-8a2c-06f868a6e189"},{"type":"location","id":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Ukraine","country":"UA","region":"europe"},{"type":"relationship","id":"relationship--925bb850-c50a-5497-9c31-127d4ec53248","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--6033d7df-a951-572f-89fb-fd2de0834968","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"},{"type":"location","id":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"Vietnam","country":"VN","region":"asia"},{"type":"relationship","id":"relationship--5f3b4de2-2a73-5420-80ed-d899cc7eae04","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9"},{"type":"location","id":"location--6a5fb4e5-83ad-5007-b5fc-c682a5a9c285","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","name":"South Africa","country":"ZA","region":"africa"},{"type":"relationship","id":"relationship--989a5593-ef31-5522-89d4-c6fa961429ac","spec_version":"2.1","created":"2026-05-20T09:50:16.565199+00:00","modified":"2026-07-28T19:52:14.995+00:00","relationship_type":"targets","source_ref":"intrusion-set--8be7d845-c8ee-5862-a8a2-1eef2377cee3","target_ref":"location--6a5fb4e5-83ad-5007-b5fc-c682a5a9c285"}]}