{"type":"bundle","id":"bundle--bc639df7-3ab6-5bb5-95ed-023554b2db1f","objects":[{"type":"intrusion-set","id":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"APT39","aliases":["ITG07","Chafer","Remexi","REMIX KITTEN","PHOSPHORUS","G0087","COBALT HICKMAN"],"first_seen":"2014-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt39"},{"source_name":"mitre-attack","external_id":"G0087","url":"https://attack.mitre.org/groups/G0087/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"OS Credential Dumping","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003","url":"https://attack.mitre.org/techniques/T1003"}]},{"type":"relationship","id":"relationship--1b8bc5ac-eb58-592e-9feb-48f2398ca4bf","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56"},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--811e6e26-a278-530f-9c5c-850de290c4d5","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--5a95e8fb-935b-5023-8661-4ab12ad23b89","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Query Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1012","url":"https://attack.mitre.org/techniques/T1012"}]},{"type":"relationship","id":"relationship--db695d0d-433c-5c5b-bf89-d809f7f1df93","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--e04bdbe1-74ec-5b70-8973-598fa0c037c2","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--e0ebd271-1dd7-5a63-a10b-8d56a5a122ae","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"SMB/Windows Admin Shares","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.002","url":"https://attack.mitre.org/techniques/T1021/002"}]},{"type":"relationship","id":"relationship--9b143d2e-9158-55fe-9cd9-2146449eb6f4","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75"},{"type":"attack-pattern","id":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"SSH","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.004","url":"https://attack.mitre.org/techniques/T1021/004"}]},{"type":"relationship","id":"relationship--6f791f34-50ea-5447-a3c7-87af340a1aea","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce"},{"type":"attack-pattern","id":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Software Packing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.002","url":"https://attack.mitre.org/techniques/T1027/002"}]},{"type":"relationship","id":"relationship--1f445fce-0e00-5b6d-aab4-f51edc7dd482","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--9f24276b-15c9-57fb-93c9-b5f3112ccd36","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--bae787cf-5090-5eaa-8ac6-a698a1050255","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Exfiltration Over C2 Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1041","url":"https://attack.mitre.org/techniques/T1041"}]},{"type":"relationship","id":"relationship--30e5a34b-e921-5a41-b04b-4a57aab4b46f","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--9e95963b-b1dc-5db4-88e4-b77ebeb9f6c6","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--839ee701-6204-5194-93f8-652eb97f1d14","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--35909444-08fc-544d-8336-75309b7e3884","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Input Capture","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1056","url":"https://attack.mitre.org/techniques/T1056"}]},{"type":"relationship","id":"relationship--9cd47cc9-2455-5ae9-b2ab-6ebc8a30aa09","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--35909444-08fc-544d-8336-75309b7e3884"},{"type":"attack-pattern","id":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Command and Scripting Interpreter","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059","url":"https://attack.mitre.org/techniques/T1059"}]},{"type":"relationship","id":"relationship--e79e103f-5c44-5d79-add8-5ed8469cb2b3","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--43690bfd-0fd4-5fcf-a19f-7ffa6adc849d","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--a27d4f74-d1f2-5c26-9fa8-db5bbb937c8c","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Python","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.006","url":"https://attack.mitre.org/techniques/T1059/006"}]},{"type":"relationship","id":"relationship--0b050595-7ce9-5406-8a30-12ad0cb5031c","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8"},{"type":"attack-pattern","id":"attack-pattern--6995bdc1-e28e-56cc-8c91-26e963e51129","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"AutoHotKey & AutoIT","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.010","url":"https://attack.mitre.org/techniques/T1059/010"}]},{"type":"relationship","id":"relationship--673454b0-d88d-52d7-a35d-ddb0dd98f286","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--6995bdc1-e28e-56cc-8c91-26e963e51129"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--6b467e31-ac98-58be-8037-3a3b60a989dc","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--dd320779-faf7-5231-8d44-824cebfc3acb","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--2492c2c0-56e3-5899-95e9-0b2c77e76d40","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"DNS","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.004","url":"https://attack.mitre.org/techniques/T1071/004"}]},{"type":"relationship","id":"relationship--68b33a5b-65c7-5638-be02-a0cb0a32808f","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--2492c2c0-56e3-5899-95e9-0b2c77e76d40"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--d56a03be-ee24-58c9-844d-d7236a3347f7","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--49c88e47-2974-5580-81c9-c52473e7bdbf","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--095c8370-1a29-5c07-90e3-91411b9d0edc","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Internal Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090.001","url":"https://attack.mitre.org/techniques/T1090/001"}]},{"type":"relationship","id":"relationship--b1ff13c6-60da-5446-9cef-96d8124778fe","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--095c8370-1a29-5c07-90e3-91411b9d0edc"},{"type":"attack-pattern","id":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Bidirectional Communication","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102.002","url":"https://attack.mitre.org/techniques/T1102/002"}]},{"type":"relationship","id":"relationship--f1ce1705-1ba3-5e55-94e1-df7c5d1101a8","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--0151b28f-9ede-5b9e-ab14-4975bef083d3","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Brute Force","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1110","url":"https://attack.mitre.org/techniques/T1110"}]},{"type":"relationship","id":"relationship--9dee8cbd-cfad-5408-a0db-c3fa14a48202","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429"},{"type":"attack-pattern","id":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Screen Capture","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1113","url":"https://attack.mitre.org/techniques/T1113"}]},{"type":"relationship","id":"relationship--4b49f878-1da6-5fa9-93be-4812c7ba49cf","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--b23af926-ff12-565c-bc7a-1e3018ceb544"},{"type":"attack-pattern","id":"attack-pattern--418ea7e5-19e7-573d-a868-31349e7cd91c","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Clipboard Data","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1115","url":"https://attack.mitre.org/techniques/T1115"}]},{"type":"relationship","id":"relationship--0b43859f-1c9a-5796-866b-60b7505a160a","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--418ea7e5-19e7-573d-a868-31349e7cd91c"},{"type":"attack-pattern","id":"attack-pattern--ef38b7e3-123c-503b-97ec-7915e8882375","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Network Share Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1135","url":"https://attack.mitre.org/techniques/T1135"}]},{"type":"relationship","id":"relationship--6d2188af-0007-5221-9bee-0219c2981228","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--ef38b7e3-123c-503b-97ec-7915e8882375"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--ae3c96d7-8ead-5be8-8453-94662c3ed3cb","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--5c626d84-7a77-5717-a3cf-76762b5c8d5b","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--3131bfb2-9d10-5fff-8de0-31bccba3d19d","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"BITS Jobs","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1197","url":"https://attack.mitre.org/techniques/T1197"}]},{"type":"relationship","id":"relationship--35ab612a-ef4b-5653-b26a-56a094ee3ed3","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--3131bfb2-9d10-5fff-8de0-31bccba3d19d"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--a2b5df77-0c4d-518c-b15e-b2362930c6e1","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--a359899d-c53b-5072-9567-d5d398f65e53","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--93b9fdc5-96a1-5597-b954-ad863beb879a","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Shortcut Modification","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.009","url":"https://attack.mitre.org/techniques/T1547/009"}]},{"type":"relationship","id":"relationship--a7ce2a33-f1dd-5e50-82e1-fad903ece16d","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--93b9fdc5-96a1-5597-b954-ad863beb879a"},{"type":"attack-pattern","id":"attack-pattern--a1a15eb3-a4bb-557d-b092-f8d561456cc7","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Credentials from Password Stores","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555","url":"https://attack.mitre.org/techniques/T1555"}]},{"type":"relationship","id":"relationship--935b0325-ce6e-5618-bd09-6ded82a963dd","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--a1a15eb3-a4bb-557d-b092-f8d561456cc7"},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--d924db57-2254-5314-8d28-bef20c2ee236","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--8a13bd1a-8c33-556b-986c-d09890c73f73","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--0d29b11e-fa5e-5f62-940f-334c7669095f","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"uses","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"location","id":"location--1375b154-0a19-561b-b92a-50fd99cbdd99","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"United Arab Emirates","country":"AE","region":"asia"},{"type":"relationship","id":"relationship--c95ec50f-e625-5019-8347-7693b0ab2370","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"targets","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"location--1375b154-0a19-561b-b92a-50fd99cbdd99"},{"type":"location","id":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Australia","country":"AU","region":"oceania"},{"type":"relationship","id":"relationship--63cba8e7-6ae5-51b1-8db9-6b1f50b19c58","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"targets","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a"},{"type":"location","id":"location--3db98014-8434-54ef-b886-ae0fb482b920","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Bahrain","country":"BH","region":"asia"},{"type":"relationship","id":"relationship--700284ce-9813-5c62-b5fa-9ff017dfe0b4","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"targets","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"location--3db98014-8434-54ef-b886-ae0fb482b920"},{"type":"location","id":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Spain","country":"ES","region":"europe"},{"type":"relationship","id":"relationship--1f485f46-c705-5e7a-b058-e68be94b15de","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"targets","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5"},{"type":"location","id":"location--a010f9b5-f121-5125-a684-6dd58c48d368","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Israel","country":"IL","region":"asia"},{"type":"relationship","id":"relationship--377855c0-fd9e-53c3-bb1f-5d2d200f9ae7","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"targets","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"location--a010f9b5-f121-5125-a684-6dd58c48d368"},{"type":"location","id":"location--9e28a5f4-2866-5976-9e35-5b8180d7aa80","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Iraq","country":"IQ","region":"asia"},{"type":"relationship","id":"relationship--c9359380-9507-57f6-bbad-df74f8c568e7","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"targets","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"location--9e28a5f4-2866-5976-9e35-5b8180d7aa80"},{"type":"location","id":"location--ad0e2a15-cb2b-5914-9739-1fecfc18450f","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Iran","country":"IR","region":"asia"},{"type":"relationship","id":"relationship--b238d4cd-f34d-5761-929e-0ba4f583750f","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"targets","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"location--ad0e2a15-cb2b-5914-9739-1fecfc18450f"},{"type":"location","id":"location--6191aea2-8287-579c-b33a-22258b590363","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Jordan","country":"JO","region":"asia"},{"type":"relationship","id":"relationship--e620e4cb-583d-5722-a0ab-96a357078476","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"targets","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"location--6191aea2-8287-579c-b33a-22258b590363"},{"type":"location","id":"location--956f84e8-0fa8-5cb1-88a4-3334c3634b76","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Kuwait","country":"KW","region":"asia"},{"type":"relationship","id":"relationship--5b6217d6-cbfc-5661-b760-2289a1caafa9","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"targets","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"location--956f84e8-0fa8-5cb1-88a4-3334c3634b76"},{"type":"location","id":"location--01638614-d673-58f9-9e1c-5fcfb1c0a4d3","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Macau","country":"MO","region":"asia"},{"type":"relationship","id":"relationship--112efb2d-5183-504e-8007-3505b4f40a3e","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"targets","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"location--01638614-d673-58f9-9e1c-5fcfb1c0a4d3"},{"type":"location","id":"location--3cd79224-9615-55ee-8547-35f3201b8c4c","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Qatar","country":"QA","region":"asia"},{"type":"relationship","id":"relationship--c0ad70d2-0521-5ee8-881a-2172ba14f333","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"targets","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"location--3cd79224-9615-55ee-8547-35f3201b8c4c"},{"type":"location","id":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Saudi Arabia","country":"SA","region":"asia"},{"type":"relationship","id":"relationship--e43b6aa8-b604-5025-96cb-b30e982bbcf1","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"targets","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a"},{"type":"location","id":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Thailand","country":"TH","region":"asia"},{"type":"relationship","id":"relationship--2b16e319-3f64-5115-80af-34851724ac4a","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"targets","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186"},{"type":"location","id":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"Türkiye","country":"TR","region":"asia"},{"type":"relationship","id":"relationship--7362a885-70b3-58f8-b208-114a7c281c4e","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"targets","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--0e5009a9-c822-5ecf-9447-178e7337ea42","spec_version":"2.1","created":"2026-05-20T09:50:17.109355+00:00","modified":"2026-07-29T07:05:38.242+00:00","relationship_type":"targets","source_ref":"intrusion-set--e14f334e-b804-558a-980a-cfe923593cc8","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}