{"type":"bundle","id":"bundle--0e8a3eaa-d7b8-5386-b731-84574251d976","objects":[{"type":"intrusion-set","id":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"APT40","aliases":["Temp.Jumper","Gingham Typhoon","Temp.Periscope","Mudcarp","ITG09","ISLANDDREAMS","Leviathan","Feverdream","GADOLINIUM","KRYPTONITE PANDA","BRONZE MOHAWK"],"first_seen":"2013-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt40"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"OS Credential Dumping","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003","url":"https://attack.mitre.org/techniques/T1003"}]},{"type":"relationship","id":"relationship--ed9f9c7e-790d-53e4-af7f-197e4ebfc971","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56"},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--2b4922ab-8bbe-557b-a4ee-fd5c6186ac1c","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--734020dd-284b-5ec7-aa67-1f46f8011a56","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"SSH","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.004","url":"https://attack.mitre.org/techniques/T1021/004"}]},{"type":"relationship","id":"relationship--94be9ebe-4037-5d5f-81d0-2334f263cdcd","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce"},{"type":"attack-pattern","id":"attack-pattern--6aa1111e-c29d-5cd6-91d5-69ab9b7c0d27","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Steganography","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.003","url":"https://attack.mitre.org/techniques/T1027/003"}]},{"type":"relationship","id":"relationship--19c3aeb3-ecf8-5fcd-97be-42d662d3ea51","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--6aa1111e-c29d-5cd6-91d5-69ab9b7c0d27"},{"type":"attack-pattern","id":"attack-pattern--99b8c048-0605-5793-9909-0e09d734c944","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Compression","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.015","url":"https://attack.mitre.org/techniques/T1027/015"}]},{"type":"relationship","id":"relationship--2dda8540-c2df-505b-80b5-a62b9e807f13","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--99b8c048-0605-5793-9909-0e09d734c944"},{"type":"attack-pattern","id":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Exfiltration Over C2 Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1041","url":"https://attack.mitre.org/techniques/T1041"}]},{"type":"relationship","id":"relationship--e33756df-a673-5b17-9b51-2242f18e582f","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--582ddd86-2451-5893-9817-c30b78c0f89f","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--b097873f-481b-5882-9241-8fcd529dcc80","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Dynamic-link Library Injection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1055.001","url":"https://attack.mitre.org/techniques/T1055/001"}]},{"type":"relationship","id":"relationship--76b5d69d-59be-5232-b255-d0628e49455d","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--b097873f-481b-5882-9241-8fcd529dcc80"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--ff88b875-dffd-5c3d-8f2f-9a0caecc0434","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--6503a3e6-719c-5f6f-9a8e-3cd69ffa3952","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--9ac70e00-6c15-5c2d-8268-59d73c0a76dc","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--9f7c0857-0baa-5755-b5ec-486a7e742002","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Multi-hop Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090.003","url":"https://attack.mitre.org/techniques/T1090/003"}]},{"type":"relationship","id":"relationship--a5da6c49-2213-5960-9471-cd371197c23f","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--9f7c0857-0baa-5755-b5ec-486a7e742002"},{"type":"attack-pattern","id":"attack-pattern--8f6cd6af-2139-5895-ab2d-499acd2869b6","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"One-Way Communication","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102.003","url":"https://attack.mitre.org/techniques/T1102/003"}]},{"type":"relationship","id":"relationship--e5ef0748-0b5a-551a-833b-da12f77adade","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--8f6cd6af-2139-5895-ab2d-499acd2869b6"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--523f74d8-04f7-5075-a89c-736dbc346beb","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--404df6e5-3218-56ad-b54a-51615ff8920b","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--c6a372bc-f139-543c-a0c0-5ee5366f538e","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--f515b5a1-1482-5e6c-a102-b1e6e21a9846","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--3131bfb2-9d10-5fff-8de0-31bccba3d19d","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"BITS Jobs","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1197","url":"https://attack.mitre.org/techniques/T1197"}]},{"type":"relationship","id":"relationship--29bc3e34-d853-5aa4-9eed-ca7b336dd098","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--3131bfb2-9d10-5fff-8de0-31bccba3d19d"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--e2a9045d-86a9-5814-8946-dbf91988df20","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--1f9557fd-bb9f-5dce-935b-bf9ef25abe9c","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--651509f5-52f0-5c8e-af73-dea9c8dd5f85","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Regsvr32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.010","url":"https://attack.mitre.org/techniques/T1218/010"}]},{"type":"relationship","id":"relationship--29a4eebf-5fa3-562f-baa5-e2532d8a0e50","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--651509f5-52f0-5c8e-af73-dea9c8dd5f85"},{"type":"attack-pattern","id":"attack-pattern--63d8c962-180c-5950-9517-58314638d441","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Internal Spearphishing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1534","url":"https://attack.mitre.org/techniques/T1534"}]},{"type":"relationship","id":"relationship--965bc9ad-48f0-5520-8904-1a5bdc64247d","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--63d8c962-180c-5950-9517-58314638d441"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--1ffc8994-494a-5b14-9fa9-5f805d281fc5","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--93b9fdc5-96a1-5597-b954-ad863beb879a","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Shortcut Modification","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.009","url":"https://attack.mitre.org/techniques/T1547/009"}]},{"type":"relationship","id":"relationship--3e149f47-af88-5e04-8971-65fdc97bf651","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--93b9fdc5-96a1-5597-b954-ad863beb879a"},{"type":"attack-pattern","id":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Archive Collected Data","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560","url":"https://attack.mitre.org/techniques/T1560"}]},{"type":"relationship","id":"relationship--c81d0a3c-cf89-5176-b997-abd83e3aaa3d","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--3c38c514-0113-551f-a2c1-99893ca0c6b0","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--50ef68ca-eec4-54be-88b9-edd2d74f5898","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Exfiltration to Cloud Storage","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1567.002","url":"https://attack.mitre.org/techniques/T1567/002"}]},{"type":"relationship","id":"relationship--8e2ff8e5-abe5-52c6-be00-cc4b8e490f28","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221"},{"type":"attack-pattern","id":"attack-pattern--d98743a3-e45f-571b-adcd-56ebe0b72d45","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Credentials","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1589.001","url":"https://attack.mitre.org/techniques/T1589/001"}]},{"type":"relationship","id":"relationship--e3023eb5-0850-5ece-80eb-e24f8251a18a","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"uses","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"attack-pattern--d98743a3-e45f-571b-adcd-56ebe0b72d45"},{"type":"location","id":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Austria","country":"AT","region":"europe"},{"type":"relationship","id":"relationship--fb5b3c4e-92e2-5b10-bd7c-6247db8c242e","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25"},{"type":"location","id":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Australia","country":"AU","region":"oceania"},{"type":"relationship","id":"relationship--5694d2f5-710d-5ed8-bd45-6f794369e7d0","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a"},{"type":"location","id":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Belgium","country":"BE","region":"europe"},{"type":"relationship","id":"relationship--6928ae86-871b-5aa6-8871-09d8f98fa431","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5"},{"type":"location","id":"location--28c31ddb-f375-5682-8697-e338a5f5d82f","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Switzerland","country":"CH","region":"europe"},{"type":"relationship","id":"relationship--49521e80-5daa-50a7-97a3-fd5b002ccc36","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--28c31ddb-f375-5682-8697-e338a5f5d82f"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--8514b763-f438-599d-be46-4229f26b42a5","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--51cab206-2e94-5698-9d8b-a1839a74a637","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Hong Kong","country":"HK","region":"asia"},{"type":"relationship","id":"relationship--b151d3cc-4262-5a38-a799-78395a3db2ee","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff"},{"type":"location","id":"location--28697960-8769-586b-b87b-b9c4e8e68b1d","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Indonesia","country":"ID","region":"asia"},{"type":"relationship","id":"relationship--a7e9b3ca-47c8-5034-a56c-1705d03d07a0","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--28697960-8769-586b-b87b-b9c4e8e68b1d"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--4446f62a-c7a6-56e4-89a3-3c47e97ea3c5","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--fd2f1d6f-f5f5-55a3-b0f3-a25b36c28f54","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Cambodia","country":"KH","region":"asia"},{"type":"relationship","id":"relationship--93fc6829-ec29-5890-b177-80da127b3521","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--fd2f1d6f-f5f5-55a3-b0f3-a25b36c28f54"},{"type":"location","id":"location--61a56adf-7f12-5e96-b6c9-0cabef6c6315","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Myanmar","country":"MM","region":"asia"},{"type":"relationship","id":"relationship--d270576c-81b6-5474-8f25-2db0885d1c83","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--61a56adf-7f12-5e96-b6c9-0cabef6c6315"},{"type":"location","id":"location--51edd19f-4bd7-545d-9666-eb05f15cda9d","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Malaysia","country":"MY","region":"asia"},{"type":"relationship","id":"relationship--4afbf1c8-4108-5c31-83f9-a47a71e9f815","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--51edd19f-4bd7-545d-9666-eb05f15cda9d"},{"type":"location","id":"location--88c9fb6c-f398-559f-b18e-422cbb386901","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Norway","country":"NO","region":"europe"},{"type":"relationship","id":"relationship--9cc839a6-bc7e-5dea-9250-9e003a9d8135","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--88c9fb6c-f398-559f-b18e-422cbb386901"},{"type":"location","id":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Philippines","country":"PH","region":"asia"},{"type":"relationship","id":"relationship--25aee105-647b-547b-9d06-5e5978141e6b","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822"},{"type":"location","id":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Saudi Arabia","country":"SA","region":"asia"},{"type":"relationship","id":"relationship--70b1a761-f8cb-5aa9-913d-7cbe14484c8d","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a"},{"type":"location","id":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"Taiwan","country":"TW","region":"asia"},{"type":"relationship","id":"relationship--ac9bbcce-1d2f-57e0-a6db-cf66fa8f31a1","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--d2d7423f-e33e-56f1-b4bd-4648fc5860c5","spec_version":"2.1","created":"2026-05-20T09:50:17.361862+00:00","modified":"2026-05-20T09:50:17.361862+00:00","relationship_type":"targets","source_ref":"intrusion-set--9faa932e-4382-56ff-99b4-1417263b462f","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}