{"type":"bundle","id":"bundle--49228af7-96f1-515b-b850-481510ae3f37","objects":[{"type":"intrusion-set","id":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Lotus Blossom","aliases":["Lotus Blossom","Billbug","Esile","DRAGONFISH","RAFFLES PANDA","Thrip","Spring Dragon","APT51","Raspberry Typhoon","G0030","BRONZE ELGIN"],"first_seen":"2007-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/lotus-blossom"},{"source_name":"mitre-attack","external_id":"G0030","url":"https://attack.mitre.org/groups/G0030/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--3957d7fb-1b6b-599a-abab-82afb6067a1f","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--e0b97c00-04a8-5444-bc79-e759fd4a6d7c","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--174170f7-6bf5-5f70-919e-af37fa6a7714","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Archive via Custom Method","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.003","url":"https://attack.mitre.org/techniques/T1560/003"}]},{"type":"relationship","id":"relationship--33b1afad-84e4-5af4-bcd9-2daf2a6063ce","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--174170f7-6bf5-5f70-919e-af37fa6a7714"},{"type":"attack-pattern","id":"attack-pattern--71acd09f-f268-5b79-ad8f-97c12d5a9c6e","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Domain Trust Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1482","url":"https://attack.mitre.org/techniques/T1482"}]},{"type":"relationship","id":"relationship--7b130539-5f12-55d0-b257-5f3163c49dab","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--71acd09f-f268-5b79-ad8f-97c12d5a9c6e"},{"type":"attack-pattern","id":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Windows Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1543.003","url":"https://attack.mitre.org/techniques/T1543/003"}]},{"type":"relationship","id":"relationship--2f0b3e16-a741-5dca-a6e4-913ff66831e8","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--96d5f4f4-cc05-5750-bc7b-cbed22084b9d"},{"type":"attack-pattern","id":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Modify Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1112","url":"https://attack.mitre.org/techniques/T1112"}]},{"type":"relationship","id":"relationship--2cd2e707-6c01-518e-b1cf-e566532d3d2e","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--0b3eaec4-a86d-5c02-b2cb-49b2489a1cb1","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--ed0c14a4-6a09-5d77-b81e-f244892dd33d","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--b0e27b64-96c5-580f-872a-4f315436c376","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--6e63cfbd-a9d7-5aec-add4-888465258911","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Remote Desktop Software","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1219.002","url":"https://attack.mitre.org/techniques/T1219/002"}]},{"type":"relationship","id":"relationship--e717ae2f-f459-5679-94fb-1f5fe80c2ac1","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--6e63cfbd-a9d7-5aec-add4-888465258911"},{"type":"attack-pattern","id":"attack-pattern--92c0e7ee-fdf3-57fb-8e0e-ff6257fb8b43","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Exfiltration Over Unencrypted Non-C2 Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1048.003","url":"https://attack.mitre.org/techniques/T1048/003"}]},{"type":"relationship","id":"relationship--d09444a0-3692-58c2-90a8-2363cdb9ec9a","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--92c0e7ee-fdf3-57fb-8e0e-ff6257fb8b43"},{"type":"attack-pattern","id":"attack-pattern--9f7c0857-0baa-5755-b5ec-486a7e742002","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Multi-hop Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090.003","url":"https://attack.mitre.org/techniques/T1090/003"}]},{"type":"relationship","id":"relationship--4a60becb-4fa1-589c-864f-b36cdb55cf06","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--9f7c0857-0baa-5755-b5ec-486a7e742002"},{"type":"attack-pattern","id":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Query Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1012","url":"https://attack.mitre.org/techniques/T1012"}]},{"type":"relationship","id":"relationship--1096c26f-40ef-5408-b48f-b1cd4d67ea42","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--7e7f2426-c693-5d79-ba21-1e42372901bb"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--f8a2293a-9f2f-5777-9da5-28f7fa2cc3d0","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--095c8370-1a29-5c07-90e3-91411b9d0edc","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Internal Proxy","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1090.001","url":"https://attack.mitre.org/techniques/T1090/001"}]},{"type":"relationship","id":"relationship--dadad6b1-89a9-5cd1-a96c-e23f0402b670","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--095c8370-1a29-5c07-90e3-91411b9d0edc"},{"type":"attack-pattern","id":"attack-pattern--cd5fa483-3558-51d4-96f4-3b3afd54828c","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Access Token Manipulation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1134","url":"https://attack.mitre.org/techniques/T1134"}]},{"type":"relationship","id":"relationship--8611d4f4-e1ce-546b-9b52-feadb75bdc3f","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--cd5fa483-3558-51d4-96f4-3b3afd54828c"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--a7d2a1a5-ec14-5864-8782-63792260fbc6","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--3fa5e27e-79b0-5d90-8387-5a725aae721b","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"uses","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"location","id":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Hong Kong","country":"HK","region":"asia"},{"type":"relationship","id":"relationship--f5e941d5-c0a9-571e-8945-f399143099f3","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"targets","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff"},{"type":"location","id":"location--28697960-8769-586b-b87b-b9c4e8e68b1d","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Indonesia","country":"ID","region":"asia"},{"type":"relationship","id":"relationship--0bd50715-68b9-5e2a-873d-1527f7065534","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"targets","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"location--28697960-8769-586b-b87b-b9c4e8e68b1d"},{"type":"location","id":"location--01638614-d673-58f9-9e1c-5fcfb1c0a4d3","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Macau","country":"MO","region":"asia"},{"type":"relationship","id":"relationship--c2d3c0c9-e097-5e24-9428-4255148d6a40","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"targets","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"location--01638614-d673-58f9-9e1c-5fcfb1c0a4d3"},{"type":"location","id":"location--51edd19f-4bd7-545d-9666-eb05f15cda9d","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Malaysia","country":"MY","region":"asia"},{"type":"relationship","id":"relationship--3de676cd-4aaa-574d-8632-b559e3e297c3","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"targets","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"location--51edd19f-4bd7-545d-9666-eb05f15cda9d"},{"type":"location","id":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Philippines","country":"PH","region":"asia"},{"type":"relationship","id":"relationship--c595bf41-1fc0-52f1-b723-422dc020eb45","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"targets","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822"},{"type":"location","id":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Taiwan","country":"TW","region":"asia"},{"type":"relationship","id":"relationship--a186e453-b6a6-5117-9336-12a8285c7faa","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"targets","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--fec23458-eed5-5c8a-8a9a-b31de9776d55","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"targets","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"},{"type":"location","id":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","name":"Vietnam","country":"VN","region":"asia"},{"type":"relationship","id":"relationship--5ce7adf0-f6a9-502e-8936-3b94c7c5d223","spec_version":"2.1","created":"2026-05-20T09:52:23.079819+00:00","modified":"2026-07-29T07:06:33.279+00:00","relationship_type":"targets","source_ref":"intrusion-set--a83530cc-f960-54c0-92cc-34c124ad062f","target_ref":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9"}]}