{"type":"bundle","id":"bundle--315d72e8-1de0-5b39-af85-ee65aaa88bf9","objects":[{"type":"intrusion-set","id":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Lazarus Group","description":"DPRK RGB cyber unit responsible for high-impact financial heists and espionage.","aliases":["HIDDEN COBRA","Diamond Sleet","NewRomanic Cyber Army Team","Appleworm","WHOis Team","Guardians of Peace","Zinc","Labyrinth Chollima","Lazarus","APT38","G0032","IRON HIGHLAND"],"first_seen":"2009-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/lazarus-group"},{"source_name":"mitre-attack","external_id":"G0032","url":"https://attack.mitre.org/groups/G0032/"}],"labels":["nation-state","esp","fin"]},{"type":"attack-pattern","id":"attack-pattern--2b0ec276-8f24-5179-acff-400e553aff1a","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Protocol or Service Impersonation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1001.003","url":"https://attack.mitre.org/techniques/T1001/003"}]},{"type":"relationship","id":"relationship--412d5abb-1d7f-5d8f-b128-42c871d3dac6","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--2b0ec276-8f24-5179-acff-400e553aff1a"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--64e845c9-e1f3-56c5-8be4-aea2c2bc48e2","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--5e0b1b50-6119-570b-a798-c42998207c1c","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Fallback Channels","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1008","url":"https://attack.mitre.org/techniques/T1008"}]},{"type":"relationship","id":"relationship--e052ef3a-677c-511b-a407-92161b00b01e","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--5e0b1b50-6119-570b-a798-c42998207c1c"},{"type":"attack-pattern","id":"attack-pattern--d3a72a68-0e23-51d2-b55e-474dbe704534","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Application Window Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1010","url":"https://attack.mitre.org/techniques/T1010"}]},{"type":"relationship","id":"relationship--9f7f770e-5da7-5587-a6b5-8df0e24b7e93","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--d3a72a68-0e23-51d2-b55e-474dbe704534"},{"type":"attack-pattern","id":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Query Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1012","url":"https://attack.mitre.org/techniques/T1012"}]},{"type":"relationship","id":"relationship--ac2c9f02-49cd-5dcc-bd3c-c8626b3ec5d0","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--5bfe4343-c487-5e87-aaea-ea03587fdde5","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--8d3848a5-c813-5876-9d13-8dd535137aba","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"SMB/Windows Admin Shares","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.002","url":"https://attack.mitre.org/techniques/T1021/002"}]},{"type":"relationship","id":"relationship--180d999f-2984-58f5-9c0f-474b3bcc868c","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--612b5431-a4c9-5063-ba66-dcddfd42fb75"},{"type":"attack-pattern","id":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"SSH","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.004","url":"https://attack.mitre.org/techniques/T1021/004"}]},{"type":"relationship","id":"relationship--c9be0d78-32fa-585f-8643-c00151044630","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--f9d9ed8a-3f4a-5391-ad4c-6bb5ecbc88ce"},{"type":"attack-pattern","id":"attack-pattern--116b8c87-d813-5286-89e6-ffcf57ca2284","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Dynamic API Resolution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.007","url":"https://attack.mitre.org/techniques/T1027/007"}]},{"type":"relationship","id":"relationship--360ae2e4-5db0-5c41-acfc-0258c6cc7334","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--116b8c87-d813-5286-89e6-ffcf57ca2284"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--9e901b0b-aa0b-5973-bb6c-7da09dbb0f86","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--28cfd681-fb93-581c-b94c-7fd82528d106","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Rename Legitimate Utilities","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.003","url":"https://attack.mitre.org/techniques/T1036/003"}]},{"type":"relationship","id":"relationship--ebbf44be-66d8-5fdb-a930-afa2bb5a0f19","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--28cfd681-fb93-581c-b94c-7fd82528d106"},{"type":"attack-pattern","id":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Masquerade Task or Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.004","url":"https://attack.mitre.org/techniques/T1036/004"}]},{"type":"relationship","id":"relationship--ca931658-b6df-569e-8f39-d8828714ac62","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--ff0f256f-63d9-573c-9bb8-576a5ba1ed99","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Exfiltration Over C2 Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1041","url":"https://attack.mitre.org/techniques/T1041"}]},{"type":"relationship","id":"relationship--bfc9e047-cf03-5e13-8f1f-6b983486bdb5","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--edb58be7-038c-5677-b137-5ac7745c80e9","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--27a4f9b2-5b48-5804-bf88-46ba107ff5b5","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--92c0e7ee-fdf3-57fb-8e0e-ff6257fb8b43","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Exfiltration Over Unencrypted Non-C2 Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1048.003","url":"https://attack.mitre.org/techniques/T1048/003"}]},{"type":"relationship","id":"relationship--cbcd2b34-7395-5a4d-9352-116c5b58672c","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--92c0e7ee-fdf3-57fb-8e0e-ff6257fb8b43"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--3e368912-206f-5108-8021-f570d6b233dc","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--f3eaff66-1ed1-5ecc-a1b5-74ed7fa593df","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--b097873f-481b-5882-9241-8fcd529dcc80","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Dynamic-link Library Injection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1055.001","url":"https://attack.mitre.org/techniques/T1055/001"}]},{"type":"relationship","id":"relationship--fecfbf54-fc80-51e4-9c84-ed974b710cd1","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--b097873f-481b-5882-9241-8fcd529dcc80"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--94527189-1cb9-5b0a-8916-7cfae1fb9064","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--c82b4aaa-964a-560f-81b8-01e547ee397e","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--e1057584-4f49-5e79-bcb7-51d0805ed0ba","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--6ba98934-8a0a-59c2-8e9f-d76c7143b19e","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--fa09ca33-6c9b-5e18-b561-a4a583e84fe5","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Indicator Removal","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070","url":"https://attack.mitre.org/techniques/T1070"}]},{"type":"relationship","id":"relationship--ae73c49a-856a-57bc-8993-1153df92d63c","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--fa09ca33-6c9b-5e18-b561-a4a583e84fe5"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--8a4f8364-a815-5234-bfc7-cef0ea99a918","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--db941ab9-ab9f-554b-b225-51bd4fde2ed2","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--fe00893c-3bb2-51f7-9310-62f94fa86325","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--b98d9aed-6644-5f83-b6de-859da657c3cf","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--095c8370-1a29-5c07-90e3-91411b9d0edc","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Internal Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090.001","url":"https://attack.mitre.org/techniques/T1090/001"}]},{"type":"relationship","id":"relationship--3028b6c3-78f1-5786-afe1-6ff60ea767db","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--095c8370-1a29-5c07-90e3-91411b9d0edc"},{"type":"attack-pattern","id":"attack-pattern--5f432704-b439-5c2a-9f49-8ea122a46cda","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Account Manipulation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1098","url":"https://attack.mitre.org/techniques/T1098"}]},{"type":"relationship","id":"relationship--0a37e2ec-59a0-5a90-86fb-21906ead8bd1","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--5f432704-b439-5c2a-9f49-8ea122a46cda"},{"type":"attack-pattern","id":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Bidirectional Communication","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102.002","url":"https://attack.mitre.org/techniques/T1102/002"}]},{"type":"relationship","id":"relationship--86d8a1b6-1594-51d6-87d9-ca7b52fb435e","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--54df49f1-527d-56ab-b837-e35ba7de521b"},{"type":"attack-pattern","id":"attack-pattern--4735949b-820b-52b9-8b5e-cf303a624484","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Multi-Stage Channels","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1104","url":"https://attack.mitre.org/techniques/T1104"}]},{"type":"relationship","id":"relationship--2b60e4ce-80b5-5610-b0a9-31f5512d9596","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--4735949b-820b-52b9-8b5e-cf303a624484"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--79f0bc11-3375-598c-ac6b-63eaae6489ee","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Native API","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1106","url":"https://attack.mitre.org/techniques/T1106"}]},{"type":"relationship","id":"relationship--f69d6279-4fb6-53c6-97a0-ed1af5206973","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8"},{"type":"attack-pattern","id":"attack-pattern--ea08d1dc-9cbf-5a71-b1d6-79749217bb8e","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"System Time Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1124","url":"https://attack.mitre.org/techniques/T1124"}]},{"type":"relationship","id":"relationship--35c0ee25-bcbb-5b76-86f3-8e72ff980d90","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--ea08d1dc-9cbf-5a71-b1d6-79749217bb8e"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--1fe5e42b-176e-563f-9349-5a1ea86c2ffb","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--d3e4cf12-bb1b-5fb0-b0ae-60d75113a88d","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--bbcbe26e-dae1-56d4-ab5e-3a45f9817ef0","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Indirect Command Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1202","url":"https://attack.mitre.org/techniques/T1202"}]},{"type":"relationship","id":"relationship--52761d6c-b5a7-5744-9614-8cc2c2d8bd59","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--bbcbe26e-dae1-56d4-ab5e-3a45f9817ef0"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--1a372178-c603-5aa8-acda-b32db1938361","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--224a5d85-2eda-5836-b231-7aa509e0987d","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"System Binary Proxy Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218","url":"https://attack.mitre.org/techniques/T1218"}]},{"type":"relationship","id":"relationship--b50a0f53-cb83-51e0-996c-b7e8b9830bd8","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--224a5d85-2eda-5836-b231-7aa509e0987d"},{"type":"attack-pattern","id":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Mshta","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.005","url":"https://attack.mitre.org/techniques/T1218/005"}]},{"type":"relationship","id":"relationship--92a76e3b-5e66-53f7-9d64-1a5fc09d15f8","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda"},{"type":"attack-pattern","id":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Rundll32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.011","url":"https://attack.mitre.org/techniques/T1218/011"}]},{"type":"relationship","id":"relationship--66aa08be-d0d4-5ea0-881a-2949310d747b","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44"},{"type":"attack-pattern","id":"attack-pattern--238682fd-85c9-5e3d-a68b-e3c26eb57381","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Data Destruction","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1485","url":"https://attack.mitre.org/techniques/T1485"}]},{"type":"relationship","id":"relationship--cc6a0633-55fd-52df-87a9-0982604d44c6","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--238682fd-85c9-5e3d-a68b-e3c26eb57381"},{"type":"attack-pattern","id":"attack-pattern--58902cf1-d2d9-5220-a3bc-e970ebd72256","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Service Stop","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1489","url":"https://attack.mitre.org/techniques/T1489"}]},{"type":"relationship","id":"relationship--c37f1a81-2629-5a58-9f0a-3ebd0d8198a6","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--58902cf1-d2d9-5220-a3bc-e970ebd72256"},{"type":"attack-pattern","id":"attack-pattern--8f1d05d6-7cf5-5858-a1e5-4e0e5db87250","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"System Shutdown/Reboot","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1529","url":"https://attack.mitre.org/techniques/T1529"}]},{"type":"relationship","id":"relationship--8ba37250-a539-58b1-85fc-df893133e516","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--8f1d05d6-7cf5-5858-a1e5-4e0e5db87250"},{"type":"attack-pattern","id":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Windows Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1543.003","url":"https://attack.mitre.org/techniques/T1543/003"}]},{"type":"relationship","id":"relationship--e820306a-dbb0-5e20-9a2a-73adf54729b1","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--2ebb455c-68bd-52b4-add0-a2af2a104fd4","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--93b9fdc5-96a1-5597-b954-ad863beb879a","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Shortcut Modification","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.009","url":"https://attack.mitre.org/techniques/T1547/009"}]},{"type":"relationship","id":"relationship--51767079-9488-580c-a16a-f7b17c1f1506","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--93b9fdc5-96a1-5597-b954-ad863beb879a"},{"type":"attack-pattern","id":"attack-pattern--a1a3681f-e145-5d06-9916-5558993eed42","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Name Resolution Poisoning and SMB Relay","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1557.001","url":"https://attack.mitre.org/techniques/T1557/001"}]},{"type":"relationship","id":"relationship--6cecfe54-e569-55dd-84af-50d05c5785af","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--a1a3681f-e145-5d06-9916-5558993eed42"},{"type":"attack-pattern","id":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Archive Collected Data","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560","url":"https://attack.mitre.org/techniques/T1560"}]},{"type":"relationship","id":"relationship--cb23b8df-8eb9-5fd1-8d65-51567653d0e9","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80"},{"type":"attack-pattern","id":"attack-pattern--6476deb6-37b2-5a6a-8c17-8ea4bbac68f2","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Archive via Library","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.002","url":"https://attack.mitre.org/techniques/T1560/002"}]},{"type":"relationship","id":"relationship--a181292c-e174-59c2-8af9-f33e96189305","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--6476deb6-37b2-5a6a-8c17-8ea4bbac68f2"},{"type":"attack-pattern","id":"attack-pattern--174170f7-6bf5-5f70-919e-af37fa6a7714","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Archive via Custom Method","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.003","url":"https://attack.mitre.org/techniques/T1560/003"}]},{"type":"relationship","id":"relationship--cd23298c-7d3a-5f3b-b86e-4a4786e39975","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--174170f7-6bf5-5f70-919e-af37fa6a7714"},{"type":"attack-pattern","id":"attack-pattern--c8686df2-ed74-589b-9192-fb92b29f7270","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Disk Content Wipe","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1561.001","url":"https://attack.mitre.org/techniques/T1561/001"}]},{"type":"relationship","id":"relationship--9212acec-9ab3-59df-b8c6-86970085a7b8","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--c8686df2-ed74-589b-9192-fb92b29f7270"},{"type":"attack-pattern","id":"attack-pattern--f59d7eb7-48ba-5568-a6b4-1e19ec2e8223","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Disk Structure Wipe","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1561.002","url":"https://attack.mitre.org/techniques/T1561/002"}]},{"type":"relationship","id":"relationship--121a608c-9322-5815-800e-c22b0e89ed6b","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--f59d7eb7-48ba-5568-a6b4-1e19ec2e8223"},{"type":"attack-pattern","id":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Hidden Files and Directories","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.001","url":"https://attack.mitre.org/techniques/T1564/001"}]},{"type":"relationship","id":"relationship--80812e7e-8f46-56d6-99d3-89f8a2396e25","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--e2d8e823-5d08-5925-99af-22d8405d1b26","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--a2d3e34b-1b8a-5cf7-824b-af5b34f1a8a5","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--9eb184f4-55af-53a7-97c4-5f226ca51dd7","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Spearphishing via Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.003","url":"https://attack.mitre.org/techniques/T1566/003"}]},{"type":"relationship","id":"relationship--a7cf607c-41c2-50b9-8b72-85637e2173af","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--9eb184f4-55af-53a7-97c4-5f226ca51dd7"},{"type":"attack-pattern","id":"attack-pattern--a971326e-6221-55ba-9aa3-d558e2370978","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Non-Standard Port","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1571","url":"https://attack.mitre.org/techniques/T1571"}]},{"type":"relationship","id":"relationship--2b0d3622-b36d-5a04-9576-f2b0d9f152af","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--a971326e-6221-55ba-9aa3-d558e2370978"},{"type":"attack-pattern","id":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Web Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.006","url":"https://attack.mitre.org/techniques/T1583/006"}]},{"type":"relationship","id":"relationship--8831da97-86b7-5550-9a9f-67f89f52336e","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd"},{"type":"attack-pattern","id":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Email Addresses","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1589.002","url":"https://attack.mitre.org/techniques/T1589/002"}]},{"type":"relationship","id":"relationship--bc7c3db7-9948-59b6-9719-09028c8a0b7b","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9"},{"type":"attack-pattern","id":"attack-pattern--bf65956a-96f7-5514-9bf2-b18865da3e15","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Gather Victim Org Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1591","url":"https://attack.mitre.org/techniques/T1591"}]},{"type":"relationship","id":"relationship--1a9fba5d-d68c-5010-b3cf-117697742775","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--bf65956a-96f7-5514-9bf2-b18865da3e15"},{"type":"attack-pattern","id":"attack-pattern--91082435-6499-50af-8289-66deab3c3048","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Reflective Code Loading","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1620","url":"https://attack.mitre.org/techniques/T1620"}]},{"type":"relationship","id":"relationship--75526fb2-4a1c-5587-aedb-7cdbd188f9f3","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--91082435-6499-50af-8289-66deab3c3048"},{"type":"attack-pattern","id":"attack-pattern--6b587822-f319-5e97-a60e-749521b0fbe7","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Local Storage Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1680","url":"https://attack.mitre.org/techniques/T1680"}]},{"type":"relationship","id":"relationship--90d8cef3-a2ae-5088-8ee2-20b89a69bc97","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--6b587822-f319-5e97-a60e-749521b0fbe7"},{"type":"attack-pattern","id":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Disable or Modify Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1685","url":"https://attack.mitre.org/techniques/T1685"}]},{"type":"relationship","id":"relationship--675514b6-b24a-5c2b-9ce6-0a7c7018dfbc","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"uses","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"attack-pattern--60160beb-ac1a-5d8b-8ed6-16753d57de3f"},{"type":"location","id":"location--a162b21a-e4f9-56d7-9d2c-b77b4154e783","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Bangladesh","country":"BD","region":"asia"},{"type":"relationship","id":"relationship--15e2a814-edbd-5902-b5b3-e33d43fed49c","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--a162b21a-e4f9-56d7-9d2c-b77b4154e783"},{"type":"location","id":"location--0b52720f-a42f-5bec-bac1-5784de12282c","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Brazil","country":"BR","region":"americas"},{"type":"relationship","id":"relationship--27308278-3c88-52a6-925e-522958cf3abb","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--0b52720f-a42f-5bec-bac1-5784de12282c"},{"type":"location","id":"location--1bdd5b06-6a7b-5f78-85be-da8f79982d69","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Belarus","country":"BY","region":"europe"},{"type":"relationship","id":"relationship--dbab1894-75c3-5a46-b80a-f28c67299cca","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--1bdd5b06-6a7b-5f78-85be-da8f79982d69"},{"type":"location","id":"location--7446f5d8-6188-5abc-bf87-34a1f04bed24","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Chile","country":"CL","region":"americas"},{"type":"relationship","id":"relationship--7a98e5e3-50f7-540b-9809-ca88ff19932d","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--7446f5d8-6188-5abc-bf87-34a1f04bed24"},{"type":"location","id":"location--d8f97962-e60f-580e-80c7-bb324614e41b","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Colombia","country":"CO","region":"americas"},{"type":"relationship","id":"relationship--09dfbe83-114e-587e-a860-94294af57c0b","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--d8f97962-e60f-580e-80c7-bb324614e41b"},{"type":"location","id":"location--4a5069fe-25e6-586d-834e-c4723e81277a","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Czechia","country":"CZ","region":"europe"},{"type":"relationship","id":"relationship--52fabe9b-eb10-52c0-a732-9dd7f88935fe","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--4a5069fe-25e6-586d-834e-c4723e81277a"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--4a56bff6-5c12-5284-a493-b3877ff9edb5","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--549bcd45-a7e0-5fe7-9032-448edae150eb","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Ecuador","country":"EC","region":"americas"},{"type":"relationship","id":"relationship--27275013-414f-5775-81d9-d4497999c75e","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--549bcd45-a7e0-5fe7-9032-448edae150eb"},{"type":"location","id":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Spain","country":"ES","region":"europe"},{"type":"relationship","id":"relationship--99f94464-4abc-5143-8960-e1ec53db6132","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--6ee49119-9c76-57b4-b10a-de8f817f7ad5"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--f136cd73-e949-5ed8-bee2-7fc2ae0c48cd","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--f0b0e35f-3b78-5c45-bb02-617dafa9b19d","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Guatemala","country":"GT","region":"americas"},{"type":"relationship","id":"relationship--fc972201-c5db-5235-a0cf-8a7328ca3402","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--f0b0e35f-3b78-5c45-bb02-617dafa9b19d"},{"type":"location","id":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Hong Kong","country":"HK","region":"asia"},{"type":"relationship","id":"relationship--ddcf625d-fe94-5500-a37d-fd5e1c13c28f","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff"},{"type":"location","id":"location--28697960-8769-586b-b87b-b9c4e8e68b1d","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Indonesia","country":"ID","region":"asia"},{"type":"relationship","id":"relationship--da50f5ee-d9bd-5e83-b6c7-a682eea7d8a2","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--28697960-8769-586b-b87b-b9c4e8e68b1d"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--6ade0422-fd78-5d49-a25a-d528d42bdb67","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--671536e6-945a-50d2-812e-660a03c3dd58","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Lebanon","country":"LB","region":"asia"},{"type":"relationship","id":"relationship--6b3c53aa-aced-5681-bf4d-b6e6271ac417","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--671536e6-945a-50d2-812e-660a03c3dd58"},{"type":"location","id":"location--4b5da789-7ef3-52c4-a852-3377ba238cb4","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Liberia","country":"LR","region":"africa"},{"type":"relationship","id":"relationship--01ebda50-5886-58db-9f5a-054a19c6c338","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--4b5da789-7ef3-52c4-a852-3377ba238cb4"},{"type":"location","id":"location--65f9d1ed-f890-5422-9b80-26fc28964f39","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Mexico","country":"MX","region":"americas"},{"type":"relationship","id":"relationship--0c855702-ea4c-5256-8368-93d9e9edbaf5","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--65f9d1ed-f890-5422-9b80-26fc28964f39"},{"type":"location","id":"location--28af571d-efb5-5547-b4c0-f5be348ac20a","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Poland","country":"PL","region":"europe"},{"type":"relationship","id":"relationship--6d7845a4-e9d4-5746-8c7c-af9c875d7929","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--28af571d-efb5-5547-b4c0-f5be348ac20a"},{"type":"location","id":"location--657f368a-bd77-5f31-84cf-340236190da3","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Russia","country":"RU","region":"europe"},{"type":"relationship","id":"relationship--68002e8e-20d4-5cc5-a18e-357f2db47760","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--657f368a-bd77-5f31-84cf-340236190da3"},{"type":"location","id":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Thailand","country":"TH","region":"asia"},{"type":"relationship","id":"relationship--7d7badd1-8bd7-5b7c-901a-561b37519201","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186"},{"type":"location","id":"location--8ed8256a-aa56-5d8e-987a-d6411af504b8","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Tunisia","country":"TN","region":"africa"},{"type":"relationship","id":"relationship--7cec1ba1-e1af-5705-97dc-f1561440068c","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--8ed8256a-aa56-5d8e-987a-d6411af504b8"},{"type":"location","id":"location--8f34f33b-92b3-51fa-baaa-707cc2d2e440","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Uruguay","country":"UY","region":"americas"},{"type":"relationship","id":"relationship--67f5ad84-ee5f-567a-b1a9-115d43c05a7e","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--8f34f33b-92b3-51fa-baaa-707cc2d2e440"},{"type":"location","id":"location--a293772c-40a3-5fb8-81f0-095e6ea6d938","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Venezuela","country":"VE","region":"americas"},{"type":"relationship","id":"relationship--3eceac10-18bf-56e4-b89f-378bc0e642a9","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--a293772c-40a3-5fb8-81f0-095e6ea6d938"},{"type":"location","id":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"Vietnam","country":"VN","region":"asia"},{"type":"relationship","id":"relationship--ce15ac1a-0f98-5201-b537-3a044b648d75","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9"},{"type":"location","id":"location--6a5fb4e5-83ad-5007-b5fc-c682a5a9c285","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","name":"South Africa","country":"ZA","region":"africa"},{"type":"relationship","id":"relationship--c2a8d1b4-c84e-59cf-948e-2ae557413c49","spec_version":"2.1","created":"2026-05-20T09:52:22.818623+00:00","modified":"2026-07-28T19:55:10.915+00:00","relationship_type":"targets","source_ref":"intrusion-set--65254e1c-596d-5bc0-8da1-7e46fe0c4703","target_ref":"location--6a5fb4e5-83ad-5007-b5fc-c682a5a9c285"}]}