{"type":"bundle","id":"bundle--953111f7-7918-5f31-94d3-fd8e739a21cc","objects":[{"type":"intrusion-set","id":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"DEV-0537","description":"DEV-0537, widely known as Lapsus$, is an extortion-focused cybercriminal collective active since 2021, composed of members spanning multiple countries and notable for including younger individuals among its ranks. The group primarily pursues financial gain and notoriety by compromising high-profile organizations through social engineering, credential theft, and insider recruitment rather than traditional malware-heavy intrusion methods. Their targeting is broad and opportunistic, spanning sectors such as technology, telecommunications, government, finance, and retail across North America, South America, Europe, and Asia.","aliases":["Lapsus","Lapsus$","Strawberry Tempest","SLIPPY SPIDER","G1004"],"first_seen":"2021-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/dev-0537"},{"source_name":"mitre-attack","external_id":"G1004","url":"https://attack.mitre.org/groups/G1004/"}],"labels":["cybercrime","extortion"]},{"type":"attack-pattern","id":"attack-pattern--3ebedc8b-9bd2-5406-9f65-a5324fbece58","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Password Managers","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.005","url":"https://attack.mitre.org/techniques/T1555/005"}]},{"type":"relationship","id":"relationship--662b7002-99d8-5073-8e90-6a191a4c80ce","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--3ebedc8b-9bd2-5406-9f65-a5324fbece58"},{"type":"attack-pattern","id":"attack-pattern--58902cf1-d2d9-5220-a3bc-e970ebd72256","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Service Stop","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1489","url":"https://attack.mitre.org/techniques/T1489"}]},{"type":"relationship","id":"relationship--aadb312c-c0ff-50fc-afc3-fae40960458c","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--58902cf1-d2d9-5220-a3bc-e970ebd72256"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--885cde9f-584e-56c4-948a-8fda6d29a462","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Email Addresses","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1589.002","url":"https://attack.mitre.org/techniques/T1589/002"}]},{"type":"relationship","id":"relationship--c49ca4b0-32ab-526e-97fe-02af207227f2","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9"},{"type":"attack-pattern","id":"attack-pattern--9f24d2f3-25c3-594a-8ce1-4958a0eef7bf","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Delete Cloud Instance","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1578.003","url":"https://attack.mitre.org/techniques/T1578/003"}]},{"type":"relationship","id":"relationship--2cc9f748-1ca5-5e92-b336-d429311d6b2b","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--9f24d2f3-25c3-594a-8ce1-4958a0eef7bf"},{"type":"attack-pattern","id":"attack-pattern--31a1f6e6-1aff-5ad3-920e-170a66554e9d","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Multi-Factor Authentication Request Generation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1621","url":"https://attack.mitre.org/techniques/T1621"}]},{"type":"relationship","id":"relationship--6fbb5190-920d-5fc0-b734-068f3d4e2a0e","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--31a1f6e6-1aff-5ad3-920e-170a66554e9d"},{"type":"attack-pattern","id":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Credentials from Web Browsers","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.003","url":"https://attack.mitre.org/techniques/T1555/003"}]},{"type":"relationship","id":"relationship--26db93d6-2000-516a-9e7a-f11c6889cee1","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070"},{"type":"attack-pattern","id":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090","url":"https://attack.mitre.org/techniques/T1090"}]},{"type":"relationship","id":"relationship--a7a41ec7-ec39-52d2-ba50-39fec39fabb5","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--08068dd3-9292-5d8e-927c-16b8177b7125"},{"type":"attack-pattern","id":"attack-pattern--86b4204a-e345-53c9-9ddb-6dae61da0b09","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Chat Messages","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1552.008","url":"https://attack.mitre.org/techniques/T1552/008"}]},{"type":"relationship","id":"relationship--0c6e3692-f3f6-52ff-a8e0-3aac225eb5eb","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--86b4204a-e345-53c9-9ddb-6dae61da0b09"},{"type":"attack-pattern","id":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Exploitation for Privilege Escalation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Privilege Escalation"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1068","url":"https://attack.mitre.org/techniques/T1068"}]},{"type":"relationship","id":"relationship--1458e01d-b8f2-56fa-b614-8f2d96b4eb5f","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d"},{"type":"attack-pattern","id":"attack-pattern--2811a611-0886-5012-92dc-07928c2ac5ab","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"DCSync","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.006","url":"https://attack.mitre.org/techniques/T1003/006"}]},{"type":"relationship","id":"relationship--1315b40a-ee63-551c-a7a5-e4200d91ac0a","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--2811a611-0886-5012-92dc-07928c2ac5ab"},{"type":"attack-pattern","id":"attack-pattern--f3fcca7a-d631-55d5-bcad-b6435cb281ba","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Trusted Relationship","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1199","url":"https://attack.mitre.org/techniques/T1199"}]},{"type":"relationship","id":"relationship--3bd1ddc9-a0a1-57d5-90f7-59ab32f23c4f","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--f3fcca7a-d631-55d5-bcad-b6435cb281ba"},{"type":"attack-pattern","id":"attack-pattern--1c89af45-1778-583b-b49b-a298fb61761a","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Account Access Removal","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1531","url":"https://attack.mitre.org/techniques/T1531"}]},{"type":"relationship","id":"relationship--10e64878-dc1c-5685-882a-8a664fc17c10","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--1c89af45-1778-583b-b49b-a298fb61761a"},{"type":"attack-pattern","id":"attack-pattern--d98743a3-e45f-571b-adcd-56ebe0b72d45","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Credentials","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1589.001","url":"https://attack.mitre.org/techniques/T1589/001"}]},{"type":"relationship","id":"relationship--d5c2faca-6e9e-5716-b171-a21e420bbd91","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--d98743a3-e45f-571b-adcd-56ebe0b72d45"},{"type":"attack-pattern","id":"attack-pattern--abc6446a-b100-5237-80e0-21c49b39bf62","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Impersonation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1684.001","url":"https://attack.mitre.org/techniques/T1684/001"}]},{"type":"relationship","id":"relationship--966efb50-69a7-5342-bdcc-527652c2fc8a","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--abc6446a-b100-5237-80e0-21c49b39bf62"},{"type":"attack-pattern","id":"attack-pattern--52399137-d959-529c-8061-fedfc08ec60e","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Identify Roles","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1591.004","url":"https://attack.mitre.org/techniques/T1591/004"}]},{"type":"relationship","id":"relationship--1c0ed61a-c1c1-567a-8ab0-c458fbb1fe28","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--52399137-d959-529c-8061-fedfc08ec60e"},{"type":"attack-pattern","id":"attack-pattern--72efb1f7-de6a-505c-92c5-6fa3be73a7ff","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Cloud Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.004","url":"https://attack.mitre.org/techniques/T1078/004"}]},{"type":"relationship","id":"relationship--7adaaf3d-98e7-5289-8fb3-1437af3d1a9c","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--72efb1f7-de6a-505c-92c5-6fa3be73a7ff"},{"type":"attack-pattern","id":"attack-pattern--01e78736-d9f3-5f3a-b7c8-a0c7abdd7c33","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Messaging Applications","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1213.005","url":"https://attack.mitre.org/techniques/T1213/005"}]},{"type":"relationship","id":"relationship--f9ff4623-b81d-5af3-bec0-c189ec9155c3","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--01e78736-d9f3-5f3a-b7c8-a0c7abdd7c33"},{"type":"attack-pattern","id":"attack-pattern--5c5d6856-aa2e-5c7c-a7d6-1d924aed5e71","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Virtual Private Server","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.003","url":"https://attack.mitre.org/techniques/T1583/003"}]},{"type":"relationship","id":"relationship--73c5412c-20e0-5721-979e-3159f0a94daf","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--5c5d6856-aa2e-5c7c-a7d6-1d924aed5e71"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--524a9902-881a-5d4d-8fdc-d9db09bdc52d","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--d963ab27-bbcf-5733-9b3e-d42f9f7895d2","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Multi-Factor Authentication Interception","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1111","url":"https://attack.mitre.org/techniques/T1111"}]},{"type":"relationship","id":"relationship--ab1a3b84-a5c4-56ea-9ced-4fb475f26c41","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--d963ab27-bbcf-5733-9b3e-d42f9f7895d2"},{"type":"attack-pattern","id":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"NTDS","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.003","url":"https://attack.mitre.org/techniques/T1003/003"}]},{"type":"relationship","id":"relationship--fc9868ee-d0af-5b92-bd00-1d0fd23504be","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14"},{"type":"attack-pattern","id":"attack-pattern--312a9eff-8dc8-5ca1-a077-9c426b1f2ad1","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"User Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204","url":"https://attack.mitre.org/techniques/T1204"}]},{"type":"relationship","id":"relationship--bfa0bac0-d1e1-5cb1-b739-533f0547c007","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--312a9eff-8dc8-5ca1-a077-9c426b1f2ad1"},{"type":"attack-pattern","id":"attack-pattern--5b7f2d2f-3b95-560f-ac5b-229e1ae02877","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Create Cloud Instance","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1578.002","url":"https://attack.mitre.org/techniques/T1578/002"}]},{"type":"relationship","id":"relationship--46fd2c42-a795-5bc4-a169-4bd6fe3f0a48","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--5b7f2d2f-3b95-560f-ac5b-229e1ae02877"},{"type":"attack-pattern","id":"attack-pattern--238682fd-85c9-5e3d-a68b-e3c26eb57381","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Data Destruction","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1485","url":"https://attack.mitre.org/techniques/T1485"}]},{"type":"relationship","id":"relationship--11aa3015-4adf-53b8-8301-8ed785872300","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--238682fd-85c9-5e3d-a68b-e3c26eb57381"},{"type":"attack-pattern","id":"attack-pattern--e17aa47c-232f-576d-bfd6-e0e04e7369db","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Email Forwarding Rule","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1114.003","url":"https://attack.mitre.org/techniques/T1114/003"}]},{"type":"relationship","id":"relationship--9395e49a-0f96-55a1-b1e8-7bfa9b538760","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"uses","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"attack-pattern--e17aa47c-232f-576d-bfd6-e0e04e7369db"},{"type":"location","id":"location--c3b339e1-0c64-5686-aade-0841bebd1798","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Argentina","country":"AR","region":"americas"},{"type":"relationship","id":"relationship--01ab285d-7545-5a3f-9bcf-d88758b5bd30","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"targets","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"location--c3b339e1-0c64-5686-aade-0841bebd1798"},{"type":"location","id":"location--0b52720f-a42f-5bec-bac1-5784de12282c","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Brazil","country":"BR","region":"americas"},{"type":"relationship","id":"relationship--e3de381b-ad66-547e-aa69-6f2e5f94794d","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"targets","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"location--0b52720f-a42f-5bec-bac1-5784de12282c"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--dc2cb938-cd29-5d26-bd08-73cd08e7b1bb","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"targets","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--b2ef97c5-969f-5895-868f-95b5ab4a97e4","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"targets","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"South Korea","country":"KR","region":"asia"},{"type":"relationship","id":"relationship--f7bac68c-20d2-51a2-90b5-6e719ef9524d","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"targets","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451"},{"type":"location","id":"location--b9003050-1590-5985-af03-7404b1026324","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"Portugal","country":"PT","region":"europe"},{"type":"relationship","id":"relationship--f0dbdb52-0bdb-50cc-9ba9-2e3cbd6dad81","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"targets","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"location--b9003050-1590-5985-af03-7404b1026324"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--e7767e8c-acd9-58e2-8d9f-641eaa3006d9","spec_version":"2.1","created":"2026-05-20T09:52:19.738931+00:00","modified":"2026-07-28T19:54:54.038+00:00","relationship_type":"targets","source_ref":"intrusion-set--a39b60eb-f31e-5a64-836b-54b486156c4f","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}