{"type":"bundle","id":"bundle--c74126a5-fda6-550a-931c-d6205563f52b","objects":[{"type":"intrusion-set","id":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Confucius","aliases":["Confucius","Confucius APT","PANDA SPIDER","G0142"],"first_seen":"2013-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/confucius"},{"source_name":"mitre-attack","external_id":"G0142","url":"https://attack.mitre.org/groups/G0142/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--907592e0-339b-5339-9f48-9468845379c3","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--90deb88f-e032-5057-9e46-24bc885f490d","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Automated Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1119","url":"https://attack.mitre.org/techniques/T1119"}]},{"type":"relationship","id":"relationship--7c656953-4c6a-5ae0-937d-9844b58fec91","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3"},{"type":"attack-pattern","id":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Exfiltration Over C2 Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1041","url":"https://attack.mitre.org/techniques/T1041"}]},{"type":"relationship","id":"relationship--baf7f397-21ad-5112-b8ac-ad645f0b1303","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--c83fe301-a02e-53be-83d8-568ce60709f5","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--7979c5fa-1fa9-5914-ac3c-2d9a3938cca2","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Exfiltration to Cloud Storage","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1567.002","url":"https://attack.mitre.org/techniques/T1567/002"}]},{"type":"relationship","id":"relationship--00893f7e-c810-57c8-bea6-47d93a5b39d7","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--1d5ea6ab-ddda-512c-af0e-d8ca63d62e19","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--02a7f37c-7d3a-594e-be6f-c36766ff80b1","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--1b77f13e-ecdb-50be-aafc-ee4c2c1536a0","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--bcaff06f-3dcd-5a6a-82e9-761bae511c10","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--079f2444-5623-529d-9cbe-3aff5eff8a58","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Template Injection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1221","url":"https://attack.mitre.org/techniques/T1221"}]},{"type":"relationship","id":"relationship--5a56a5df-aec8-55b1-8667-74386d10aaf8","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--079f2444-5623-529d-9cbe-3aff5eff8a58"},{"type":"attack-pattern","id":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Mshta","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.005","url":"https://attack.mitre.org/techniques/T1218/005"}]},{"type":"relationship","id":"relationship--be48274c-151b-5d00-8336-99a75478406e","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--3d118832-8387-5910-8a75-2a24383b2081","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Web Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.006","url":"https://attack.mitre.org/techniques/T1583/006"}]},{"type":"relationship","id":"relationship--34618b0a-830d-592d-8b75-99062243f230","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--41398dde-1203-5196-af68-0013403d1df9","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--48cff8ea-442a-5ffd-922e-0253c838fe8d","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--6b587822-f319-5e97-a60e-749521b0fbe7","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Local Storage Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1680","url":"https://attack.mitre.org/techniques/T1680"}]},{"type":"relationship","id":"relationship--533056ff-fc4c-5b10-8851-6b2fdc3e7e4b","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"uses","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"attack-pattern--6b587822-f319-5e97-a60e-749521b0fbe7"},{"type":"location","id":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","name":"Pakistan","country":"PK","region":"asia"},{"type":"relationship","id":"relationship--41e818e5-ffee-5fe1-bb37-46d73438eb98","spec_version":"2.1","created":"2026-05-20T09:52:19.241922+00:00","modified":"2026-07-29T07:05:49.543+00:00","relationship_type":"targets","source_ref":"intrusion-set--298ad236-9112-590f-99b7-8366649cdc57","target_ref":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77"}]}