{"type":"bundle","id":"bundle--93cbaaec-36dc-53f4-bde6-bc53b87ab04e","objects":[{"type":"intrusion-set","id":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"FIN8","aliases":["Syssphinx","GRACEFUL SPIDER","G0061","GOLD SNOWFLAKE"],"first_seen":"2016-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/fin8"},{"source_name":"mitre-attack","external_id":"G0061","url":"https://attack.mitre.org/groups/G0061/"}],"labels":["cybercrime","fin","ran"]},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--5af6af62-c658-5527-8f3e-4dfc138e9292","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--b6bf1236-d6c1-5cc9-b386-55b9bf7908de","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--d2f2c1eb-e15b-5d89-8872-ff7781a30c33","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--4ae8999e-bf06-5dc0-87d2-474f967db057","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--d60882fa-09c7-555a-b24a-7fab61cf38f6","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--1e0781ed-493c-583d-a224-148f0d4f7787","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"SMB/Windows Admin Shares","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.002","url":"https://attack.mitre.org/techniques/T1021/002"}]},{"type":"relationship","id":"relationship--f6c8fc41-74dd-56de-b645-4c7e2c33a591","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75"},{"type":"attack-pattern","id":"attack-pattern--71acd09f-f268-5b79-ad8f-97c12d5a9c6e","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Domain Trust Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1482","url":"https://attack.mitre.org/techniques/T1482"}]},{"type":"relationship","id":"relationship--938b5473-63ba-5a68-a8f1-f75470b3ff58","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--71acd09f-f268-5b79-ad8f-97c12d5a9c6e"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--7bf432b8-8886-59aa-9f89-9db7af1a6913","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Command Obfuscation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.010","url":"https://attack.mitre.org/techniques/T1027/010"}]},{"type":"relationship","id":"relationship--fae5e2dd-d4a2-5007-a3ae-6ef42caec1de","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486"},{"type":"attack-pattern","id":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Modify Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1112","url":"https://attack.mitre.org/techniques/T1112"}]},{"type":"relationship","id":"relationship--7949cf8d-23f6-5efd-8959-72cd48c3fce5","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--590568ac-9783-573d-ba73-2b7e534b8d42","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Exploitation for Privilege Escalation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Privilege Escalation"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1068","url":"https://attack.mitre.org/techniques/T1068"}]},{"type":"relationship","id":"relationship--12b26e8d-62be-5a08-9ce7-eb8956c4d6f0","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d"},{"type":"attack-pattern","id":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Data Encrypted for Impact","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1486","url":"https://attack.mitre.org/techniques/T1486"}]},{"type":"relationship","id":"relationship--a743d223-351d-543b-b89d-8e2bbba4dc27","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2"},{"type":"attack-pattern","id":"attack-pattern--3cce4469-d3b2-5b83-8e3d-53e78f7e9c6d","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Web Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102","url":"https://attack.mitre.org/techniques/T1102"}]},{"type":"relationship","id":"relationship--b0cf9684-f62c-55c5-849e-4c93fb986ed7","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--3cce4469-d3b2-5b83-8e3d-53e78f7e9c6d"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--aaa67408-9196-560a-8ae9-54f46270f6b1","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--8758e20e-377a-501c-82f0-51d59c923cb0","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--859fd8a5-4d9e-5fb2-9d46-bb1e20ff6728","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Asynchronous Procedure Call","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1055.004","url":"https://attack.mitre.org/techniques/T1055/004"}]},{"type":"relationship","id":"relationship--b10d9fd2-70d2-5ce2-9a7f-055392d4b33d","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--859fd8a5-4d9e-5fb2-9d46-bb1e20ff6728"},{"type":"attack-pattern","id":"attack-pattern--92c0e7ee-fdf3-57fb-8e0e-ff6257fb8b43","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Exfiltration Over Unencrypted Non-C2 Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1048.003","url":"https://attack.mitre.org/techniques/T1048/003"}]},{"type":"relationship","id":"relationship--6afdaf3d-2542-5413-abd4-394093b18607","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--92c0e7ee-fdf3-57fb-8e0e-ff6257fb8b43"},{"type":"attack-pattern","id":"attack-pattern--b435b427-55ef-5941-9f2a-40db66a08276","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Asymmetric Cryptography","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1573.002","url":"https://attack.mitre.org/techniques/T1573/002"}]},{"type":"relationship","id":"relationship--adbf0b1b-ec20-50f5-923c-d6889db21626","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--b435b427-55ef-5941-9f2a-40db66a08276"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--e006d069-c1a4-52d6-89fa-119ced232179","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--a6ad0d44-29e4-5dd3-a540-67fb69008530","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--93db1816-866f-57d3-a2a9-5b27e0b3da9e","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--b7d757c6-00ce-5cd3-a923-f45785fabb49","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--8f5d254a-7d3c-5818-b57e-e9246d8cf2f7","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--321eb6ed-1776-5262-95b3-66212cd8f6f2","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"uses","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"location","id":"location--df32d83f-5f4c-5118-a126-3f5c603db260","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Canada","country":"CA","region":"americas"},{"type":"relationship","id":"relationship--6a4d3b96-052f-5d42-888b-53bef95b3791","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"targets","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"location--df32d83f-5f4c-5118-a126-3f5c603db260"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--05395a44-98c2-5f93-b996-5ce5dbcf5f72","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"targets","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--265ea869-25b9-5fdf-a7d0-2241fe5912f0","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"targets","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Hong Kong","country":"HK","region":"asia"},{"type":"relationship","id":"relationship--54084359-e112-568c-b5b5-d7df5bb3c50d","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"targets","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff"},{"type":"location","id":"location--fd98b554-2d31-56db-8bc0-812e65009813","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Italy","country":"IT","region":"europe"},{"type":"relationship","id":"relationship--e5d729fc-41a0-58b7-b83a-c1084d8e6905","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"targets","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"location--fd98b554-2d31-56db-8bc0-812e65009813"},{"type":"location","id":"location--168ae1d8-d8eb-5440-9d21-d02292700adf","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Japan","country":"JP","region":"asia"},{"type":"relationship","id":"relationship--c89d3616-66cc-5275-9d54-b4f489b1a724","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"targets","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"location--168ae1d8-d8eb-5440-9d21-d02292700adf"},{"type":"location","id":"location--9f915047-365b-5d02-ac33-38528c38eb92","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"Singapore","country":"SG","region":"asia"},{"type":"relationship","id":"relationship--37381c4d-0557-5495-8d81-f8e668ef7d9c","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"targets","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"location--9f915047-365b-5d02-ac33-38528c38eb92"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--9b0ac432-3eb8-5932-816a-a7f990ba746e","spec_version":"2.1","created":"2026-05-20T09:50:21.410698+00:00","modified":"2026-07-28T19:57:10.113+00:00","relationship_type":"targets","source_ref":"intrusion-set--59604e02-5d9d-563f-a5d4-a478b5d05554","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}