{"type":"bundle","id":"bundle--2f9398f9-19b4-59b3-a2f5-b11377bb1a2e","objects":[{"type":"intrusion-set","id":"intrusion-set--e08e4816-8a4d-5734-8c8a-e9e178098cf1","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","name":"FIN5","aliases":["Sundown","GRACEFUL SPIDER","G0053"],"first_seen":"2008-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/fin5"},{"source_name":"mitre-attack","external_id":"G0053","url":"https://attack.mitre.org/groups/G0053/"}],"labels":["cybercrime","fin"]},{"type":"attack-pattern","id":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","name":"Automated Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1119","url":"https://attack.mitre.org/techniques/T1119"}]},{"type":"relationship","id":"relationship--b0985c0f-d6e4-5887-a013-dee78e2936ae","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","relationship_type":"uses","source_ref":"intrusion-set--e08e4816-8a4d-5734-8c8a-e9e178098cf1","target_ref":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3"},{"type":"attack-pattern","id":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","name":"Command and Scripting Interpreter","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059","url":"https://attack.mitre.org/techniques/T1059"}]},{"type":"relationship","id":"relationship--7a347def-e182-5cdd-83b4-d9ddf6ca158a","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","relationship_type":"uses","source_ref":"intrusion-set--e08e4816-8a4d-5734-8c8a-e9e178098cf1","target_ref":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf"},{"type":"attack-pattern","id":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","name":"Brute Force","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1110","url":"https://attack.mitre.org/techniques/T1110"}]},{"type":"relationship","id":"relationship--98b3aad4-0235-56f3-b0d1-6d6b2849fe19","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","relationship_type":"uses","source_ref":"intrusion-set--e08e4816-8a4d-5734-8c8a-e9e178098cf1","target_ref":"attack-pattern--2e398f9d-3934-5391-b478-4c6b76173429"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--fb1df6fc-e540-5ec2-8a6f-23d5ab7c561b","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","relationship_type":"uses","source_ref":"intrusion-set--e08e4816-8a4d-5734-8c8a-e9e178098cf1","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--43c9f922-4317-524b-b3f4-7ad696f7af53","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","relationship_type":"uses","source_ref":"intrusion-set--e08e4816-8a4d-5734-8c8a-e9e178098cf1","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--a7b2cb25-74ac-536a-9794-6ad48404b3f4","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","relationship_type":"uses","source_ref":"intrusion-set--e08e4816-8a4d-5734-8c8a-e9e178098cf1","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"location","id":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","name":"Australia","country":"AU","region":"oceania"},{"type":"relationship","id":"relationship--ed7f14e3-93d4-51d0-a17d-2b9a330f4578","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","relationship_type":"targets","source_ref":"intrusion-set--e08e4816-8a4d-5734-8c8a-e9e178098cf1","target_ref":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a"},{"type":"location","id":"location--c765e734-0df7-5ebd-9c36-9a00585c346d","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","name":"Bahamas","country":"BS","region":"americas"},{"type":"relationship","id":"relationship--d297d9a1-1589-592b-8cf4-e07ef79820d4","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","relationship_type":"targets","source_ref":"intrusion-set--e08e4816-8a4d-5734-8c8a-e9e178098cf1","target_ref":"location--c765e734-0df7-5ebd-9c36-9a00585c346d"},{"type":"location","id":"location--df32d83f-5f4c-5118-a126-3f5c603db260","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","name":"Canada","country":"CA","region":"americas"},{"type":"relationship","id":"relationship--a09fd7e3-4a30-5240-bd29-71526ce3a9cb","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","relationship_type":"targets","source_ref":"intrusion-set--e08e4816-8a4d-5734-8c8a-e9e178098cf1","target_ref":"location--df32d83f-5f4c-5118-a126-3f5c603db260"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--102d390c-5009-56f2-8b8a-e98913f0177a","spec_version":"2.1","created":"2026-05-20T09:50:20.634142+00:00","modified":"2026-07-29T07:06:17.571+00:00","relationship_type":"targets","source_ref":"intrusion-set--e08e4816-8a4d-5734-8c8a-e9e178098cf1","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}