{"type":"bundle","id":"bundle--bc207ed7-ff04-5222-878d-93f36b6df516","objects":[{"type":"intrusion-set","id":"intrusion-set--6599ddd5-27e3-59cf-8492-743eef659b05","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","name":"APT73","description":"APT73 is a state-sponsored advanced persistent threat actor whose precise national origin remains unattributed or undisclosed, operating under the designation assigned by Mandiant. The group conducts cyber espionage operations consistent with nation-state objectives, focusing on the collection of sensitive information to support government or strategic interests. Their targeting profile and specific victim sectors remain insufficiently documented in open-source reporting, making detailed characterization of their operational scope uncertain at this time.","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/apt73"}],"labels":["nation-state"]},{"type":"attack-pattern","id":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","name":"OS Credential Dumping","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003","url":"https://attack.mitre.org/techniques/T1003"}]},{"type":"relationship","id":"relationship--3dd09522-3121-5a4f-93d0-f3e92a892441","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","relationship_type":"uses","source_ref":"intrusion-set--6599ddd5-27e3-59cf-8492-743eef659b05","target_ref":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56"},{"type":"attack-pattern","id":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","name":"Obfuscated Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027","url":"https://attack.mitre.org/techniques/T1027"}]},{"type":"relationship","id":"relationship--96bc9e55-361f-5dc6-b102-695892e759cd","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","relationship_type":"uses","source_ref":"intrusion-set--6599ddd5-27e3-59cf-8492-743eef659b05","target_ref":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f"},{"type":"attack-pattern","id":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","name":"Exfiltration Over C2 Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1041","url":"https://attack.mitre.org/techniques/T1041"}]},{"type":"relationship","id":"relationship--3d5cdd5e-9a6e-5aac-bc05-68b1a7bc561d","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","relationship_type":"uses","source_ref":"intrusion-set--6599ddd5-27e3-59cf-8492-743eef659b05","target_ref":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d"},{"type":"attack-pattern","id":"attack-pattern--f8b681a6-c01a-53c9-a3b0-83ea21e8823b","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","name":"Application Layer Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071","url":"https://attack.mitre.org/techniques/T1071"}]},{"type":"relationship","id":"relationship--73f5567f-2b01-53f9-917d-757bff81e24b","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","relationship_type":"uses","source_ref":"intrusion-set--6599ddd5-27e3-59cf-8492-743eef659b05","target_ref":"attack-pattern--f8b681a6-c01a-53c9-a3b0-83ea21e8823b"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--80e62a94-4e5c-5c56-80c0-70949ce05434","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","relationship_type":"uses","source_ref":"intrusion-set--6599ddd5-27e3-59cf-8492-743eef659b05","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--7ca4bc31-3cbc-5fa2-9a5d-1b7dc17bb602","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","name":"System Information Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1082","url":"https://attack.mitre.org/techniques/T1082"}]},{"type":"relationship","id":"relationship--a9114f61-ba9a-5d0d-bfd8-6930493a2021","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","relationship_type":"uses","source_ref":"intrusion-set--6599ddd5-27e3-59cf-8492-743eef659b05","target_ref":"attack-pattern--7ca4bc31-3cbc-5fa2-9a5d-1b7dc17bb602"},{"type":"attack-pattern","id":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","name":"Archive Collected Data","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560","url":"https://attack.mitre.org/techniques/T1560"}]},{"type":"relationship","id":"relationship--32bf26fd-f081-5262-9f0a-30763b59005b","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","relationship_type":"uses","source_ref":"intrusion-set--6599ddd5-27e3-59cf-8492-743eef659b05","target_ref":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80"},{"type":"attack-pattern","id":"attack-pattern--183774af-4c33-54de-8d3d-aaf04646d481","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","name":"Phishing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566","url":"https://attack.mitre.org/techniques/T1566"}]},{"type":"relationship","id":"relationship--e2f2d53d-789a-50e4-9a46-e7ac54728c09","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","relationship_type":"uses","source_ref":"intrusion-set--6599ddd5-27e3-59cf-8492-743eef659b05","target_ref":"attack-pattern--183774af-4c33-54de-8d3d-aaf04646d481"},{"type":"attack-pattern","id":"attack-pattern--112fb2d7-85f2-528f-98b7-c446712039b6","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","name":"Encrypted Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1573","url":"https://attack.mitre.org/techniques/T1573"}]},{"type":"relationship","id":"relationship--a3756354-4c8d-592d-b2f5-097ad43bb28f","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","relationship_type":"uses","source_ref":"intrusion-set--6599ddd5-27e3-59cf-8492-743eef659b05","target_ref":"attack-pattern--112fb2d7-85f2-528f-98b7-c446712039b6"},{"type":"attack-pattern","id":"attack-pattern--0f0cc6d7-1ffa-5b47-8f22-758cc19b400b","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","name":"Acquire Infrastructure","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583","url":"https://attack.mitre.org/techniques/T1583"}]},{"type":"relationship","id":"relationship--ef51f0a0-7a6a-50e2-bf4e-66266e309856","spec_version":"2.1","created":"2026-05-20T09:50:19.106695+00:00","modified":"2026-05-20T15:12:51.008+00:00","relationship_type":"uses","source_ref":"intrusion-set--6599ddd5-27e3-59cf-8492-743eef659b05","target_ref":"attack-pattern--0f0cc6d7-1ffa-5b47-8f22-758cc19b400b"}]}