{"type":"bundle","id":"bundle--331d38ed-9770-591a-be29-d7fbc412a1ed","objects":[{"type":"intrusion-set","id":"intrusion-set--8c7ec099-aeb1-5caf-9903-5fee123b4a3f","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","name":"FIN4","aliases":["WOLF SPIDER","G0085"],"first_seen":"2013-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/fin4"},{"source_name":"mitre-attack","external_id":"G0085","url":"https://attack.mitre.org/groups/G0085/"}],"labels":["cybercrime","fin"]},{"type":"attack-pattern","id":"attack-pattern--17aa8f39-b715-569f-acd8-521a0da1ac7b","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","name":"Remote Email Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1114.002","url":"https://attack.mitre.org/techniques/T1114/002"}]},{"type":"relationship","id":"relationship--a7cb8804-b2e7-5077-949b-9921dedfdee2","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","relationship_type":"uses","source_ref":"intrusion-set--8c7ec099-aeb1-5caf-9903-5fee123b4a3f","target_ref":"attack-pattern--17aa8f39-b715-569f-acd8-521a0da1ac7b"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--b2bd79af-8e4c-5008-9ce7-71a26ead1ab1","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","relationship_type":"uses","source_ref":"intrusion-set--8c7ec099-aeb1-5caf-9903-5fee123b4a3f","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--dedcd86d-52fc-51a8-af81-33a63ccbe289","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","relationship_type":"uses","source_ref":"intrusion-set--8c7ec099-aeb1-5caf-9903-5fee123b4a3f","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--ab812207-18d4-5978-b9f6-6a5d4a4b5f28","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","relationship_type":"uses","source_ref":"intrusion-set--8c7ec099-aeb1-5caf-9903-5fee123b4a3f","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--cf54b03c-f2cb-5027-bd94-aedd19928bfd","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","relationship_type":"uses","source_ref":"intrusion-set--8c7ec099-aeb1-5caf-9903-5fee123b4a3f","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--9f7c0857-0baa-5755-b5ec-486a7e742002","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","name":"Multi-hop Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090.003","url":"https://attack.mitre.org/techniques/T1090/003"}]},{"type":"relationship","id":"relationship--cc7283c8-1378-5961-a1d1-12276e50f9de","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","relationship_type":"uses","source_ref":"intrusion-set--8c7ec099-aeb1-5caf-9903-5fee123b4a3f","target_ref":"attack-pattern--9f7c0857-0baa-5755-b5ec-486a7e742002"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--32760519-e02a-5baf-a5ff-eff67a7a4850","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","relationship_type":"uses","source_ref":"intrusion-set--8c7ec099-aeb1-5caf-9903-5fee123b4a3f","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--23c6f213-23cb-5bdb-bf9e-2d5b3ab9037d","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","relationship_type":"uses","source_ref":"intrusion-set--8c7ec099-aeb1-5caf-9903-5fee123b4a3f","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"location","id":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","name":"Australia","country":"AU","region":"oceania"},{"type":"relationship","id":"relationship--b036575d-3bed-5d68-9627-21dc554135fd","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","relationship_type":"targets","source_ref":"intrusion-set--8c7ec099-aeb1-5caf-9903-5fee123b4a3f","target_ref":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a"},{"type":"location","id":"location--7446f5d8-6188-5abc-bf87-34a1f04bed24","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","name":"Chile","country":"CL","region":"americas"},{"type":"relationship","id":"relationship--afb54896-96c6-5d8d-9a25-cf4e587ce02a","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","relationship_type":"targets","source_ref":"intrusion-set--8c7ec099-aeb1-5caf-9903-5fee123b4a3f","target_ref":"location--7446f5d8-6188-5abc-bf87-34a1f04bed24"},{"type":"location","id":"location--760995dc-62de-5ef6-9bc7-faf52bf1b952","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","name":"Ireland","country":"IE","region":"europe"},{"type":"relationship","id":"relationship--18b7a810-6257-5f6b-aef3-1f7b4d27e0ad","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","relationship_type":"targets","source_ref":"intrusion-set--8c7ec099-aeb1-5caf-9903-5fee123b4a3f","target_ref":"location--760995dc-62de-5ef6-9bc7-faf52bf1b952"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--c67d9d4d-253a-546d-840b-d32dcd263c8d","spec_version":"2.1","created":"2026-05-20T09:50:20.384155+00:00","modified":"2026-07-29T07:06:14.797+00:00","relationship_type":"targets","source_ref":"intrusion-set--8c7ec099-aeb1-5caf-9903-5fee123b4a3f","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}