{"type":"bundle","id":"bundle--50ba40ad-4cee-5db1-80d7-c3c979ac53fe","objects":[{"type":"intrusion-set","id":"intrusion-set--21cd551a-1d8b-5c7d-a473-337535913db0","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","name":"BlackTech","aliases":["BlackTech","RADIO PANDA","Palmerworm","HUAPI","Manga Taurus","T-APT-03","CIRCUIT PANDA","APT41","Circuit Typhoon","G0098"],"first_seen":"2010-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/blacktech"},{"source_name":"mitre-attack","external_id":"G0098","url":"https://attack.mitre.org/groups/G0098/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","name":"SSH","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.004","url":"https://attack.mitre.org/techniques/T1021/004"}]},{"type":"relationship","id":"relationship--3dee9383-a74e-5ca1-b2cc-c5c009308aec","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","relationship_type":"uses","source_ref":"intrusion-set--21cd551a-1d8b-5c7d-a473-337535913db0","target_ref":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce"},{"type":"attack-pattern","id":"attack-pattern--19b25059-65bd-56b5-997e-4e9286196787","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","name":"Right-to-Left Override","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.002","url":"https://attack.mitre.org/techniques/T1036/002"}]},{"type":"relationship","id":"relationship--8dc51080-d62c-506c-a850-17f1bce83298","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","relationship_type":"uses","source_ref":"intrusion-set--21cd551a-1d8b-5c7d-a473-337535913db0","target_ref":"attack-pattern--19b25059-65bd-56b5-997e-4e9286196787"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--bc41fd6c-a142-5597-ad51-db3ac31627aa","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","relationship_type":"uses","source_ref":"intrusion-set--21cd551a-1d8b-5c7d-a473-337535913db0","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","name":"Native API","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1106","url":"https://attack.mitre.org/techniques/T1106"}]},{"type":"relationship","id":"relationship--30759396-4f02-5516-a093-92f309b0e888","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","relationship_type":"uses","source_ref":"intrusion-set--21cd551a-1d8b-5c7d-a473-337535913db0","target_ref":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--ec33114b-62c8-598d-9cdd-c5a80496d913","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","relationship_type":"uses","source_ref":"intrusion-set--21cd551a-1d8b-5c7d-a473-337535913db0","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--fff30be8-2db5-5066-84b1-34bb7f211b73","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","relationship_type":"uses","source_ref":"intrusion-set--21cd551a-1d8b-5c7d-a473-337535913db0","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--bc1b9afc-b0e7-5fb6-a356-4602ff36c500","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","relationship_type":"uses","source_ref":"intrusion-set--21cd551a-1d8b-5c7d-a473-337535913db0","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--e7a78844-d5d8-567f-97dc-c1ea3dae8aa7","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","relationship_type":"uses","source_ref":"intrusion-set--21cd551a-1d8b-5c7d-a473-337535913db0","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--17ca007c-c346-58a8-9ffd-fe71bc0b46a4","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","relationship_type":"uses","source_ref":"intrusion-set--21cd551a-1d8b-5c7d-a473-337535913db0","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"location","id":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","name":"Hong Kong","country":"HK","region":"asia"},{"type":"relationship","id":"relationship--f06e3c51-ba02-51be-b9a6-5f11e63200bd","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","relationship_type":"targets","source_ref":"intrusion-set--21cd551a-1d8b-5c7d-a473-337535913db0","target_ref":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff"},{"type":"location","id":"location--168ae1d8-d8eb-5440-9d21-d02292700adf","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","name":"Japan","country":"JP","region":"asia"},{"type":"relationship","id":"relationship--25435a30-8ba6-5446-8e1f-ba33e4a055bb","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","relationship_type":"targets","source_ref":"intrusion-set--21cd551a-1d8b-5c7d-a473-337535913db0","target_ref":"location--168ae1d8-d8eb-5440-9d21-d02292700adf"},{"type":"location","id":"location--9f915047-365b-5d02-ac33-38528c38eb92","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","name":"Singapore","country":"SG","region":"asia"},{"type":"relationship","id":"relationship--46dfb094-0e27-5bb1-869b-5a953d47e576","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","relationship_type":"targets","source_ref":"intrusion-set--21cd551a-1d8b-5c7d-a473-337535913db0","target_ref":"location--9f915047-365b-5d02-ac33-38528c38eb92"},{"type":"location","id":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","name":"Taiwan","country":"TW","region":"asia"},{"type":"relationship","id":"relationship--7b28d24f-1d35-5427-8b55-2216067d6d4c","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","relationship_type":"targets","source_ref":"intrusion-set--21cd551a-1d8b-5c7d-a473-337535913db0","target_ref":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--19be3da7-1c97-5694-88e9-a7db62590d48","spec_version":"2.1","created":"2026-05-20T09:52:18.743564+00:00","modified":"2026-07-28T19:54:50.787+00:00","relationship_type":"targets","source_ref":"intrusion-set--21cd551a-1d8b-5c7d-a473-337535913db0","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}