{"type":"bundle","id":"bundle--6eeab39a-e162-55a9-a1f6-2c0f0f94eda1","objects":[{"type":"intrusion-set","id":"intrusion-set--2b173e8d-1665-54bd-9006-d632b8e76dc3","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","name":"FIN10","aliases":["ANTHROPOID SPIDER","G0051"],"first_seen":"2013-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/fin10"},{"source_name":"mitre-attack","external_id":"G0051","url":"https://attack.mitre.org/groups/G0051/"}],"labels":["cybercrime","extortion"]},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--c4386077-bc9d-5fd3-87e6-5a5247a91580","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2b173e8d-1665-54bd-9006-d632b8e76dc3","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--37e60dd2-2a5e-58ef-b405-ca7e379b423f","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2b173e8d-1665-54bd-9006-d632b8e76dc3","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--49f99fc7-f341-5c47-bb11-3546ad75f781","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2b173e8d-1665-54bd-9006-d632b8e76dc3","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--1d58d2c7-db7e-559f-a37d-0afd2f3357a8","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2b173e8d-1665-54bd-9006-d632b8e76dc3","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","name":"Lateral Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1570","url":"https://attack.mitre.org/techniques/T1570"}]},{"type":"relationship","id":"relationship--87014633-a0a1-5a22-b3f8-7e3ffcfb4fc3","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2b173e8d-1665-54bd-9006-d632b8e76dc3","target_ref":"attack-pattern--41a703a2-96b9-5caa-8498-1515f24a9807"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--334d8104-0e5e-5134-9ca8-3b6cc700d090","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2b173e8d-1665-54bd-9006-d632b8e76dc3","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--f3e28ae7-3e71-5644-90e4-2a7e97ff99ce","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2b173e8d-1665-54bd-9006-d632b8e76dc3","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--5e26888e-e228-5319-bc2b-f332ad8865ed","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2b173e8d-1665-54bd-9006-d632b8e76dc3","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--dd2a19a1-f635-54c4-8735-8f60e21cc56c","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2b173e8d-1665-54bd-9006-d632b8e76dc3","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--f24fc6c6-3264-561f-bc0a-66bcf7a136d1","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","name":"Local Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.003","url":"https://attack.mitre.org/techniques/T1078/003"}]},{"type":"relationship","id":"relationship--7139e2d7-0268-5544-ba09-a00dba08a0a4","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2b173e8d-1665-54bd-9006-d632b8e76dc3","target_ref":"attack-pattern--f24fc6c6-3264-561f-bc0a-66bcf7a136d1"},{"type":"location","id":"location--df32d83f-5f4c-5118-a126-3f5c603db260","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","name":"Canada","country":"CA","region":"americas"},{"type":"relationship","id":"relationship--91371e3b-a736-5348-b6e6-5d01e4fb0e03","spec_version":"2.1","created":"2026-05-20T09:50:21.659846+00:00","modified":"2026-07-29T08:52:51.031+00:00","relationship_type":"targets","source_ref":"intrusion-set--2b173e8d-1665-54bd-9006-d632b8e76dc3","target_ref":"location--df32d83f-5f4c-5118-a126-3f5c603db260"}]}