{"type":"bundle","id":"bundle--2f501bf4-1a86-5211-a7c5-85a33e6a193e","objects":[{"type":"intrusion-set","id":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Mustang Panda","description":"China-aligned cyber-espionage group targeting NGOs, religious orgs, and governments across Asia and Europe.","aliases":["Camaro Dragon","Stately Taurus","HoneyMyte","BASIN","Earth Preta","PKPLUG","Temp.Hex","Twill Typhoon","G0129","TA416","RedDelta","BRONZE PRESIDENT"],"first_seen":"2014-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/mustang-panda"},{"source_name":"mitre-attack","external_id":"G0129","url":"https://attack.mitre.org/groups/G0129/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--2b0ec276-8f24-5179-acff-400e553aff1a","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Protocol or Service Impersonation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1001.003","url":"https://attack.mitre.org/techniques/T1001/003"}]},{"type":"relationship","id":"relationship--d64d0554-30c7-512a-85fc-2cf77d3babcd","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--2b0ec276-8f24-5179-acff-400e553aff1a"},{"type":"attack-pattern","id":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"OS Credential Dumping","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003","url":"https://attack.mitre.org/techniques/T1003"}]},{"type":"relationship","id":"relationship--95f0dfd4-0ba4-5f0d-8aec-3b600df05fb6","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56"},{"type":"attack-pattern","id":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"LSASS Memory","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.001","url":"https://attack.mitre.org/techniques/T1003/001"}]},{"type":"relationship","id":"relationship--906316d6-f73e-516a-95b0-0aca8fdab993","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--ff67c6e7-4b63-5760-9243-37b5fa26fab0"},{"type":"attack-pattern","id":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"NTDS","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.003","url":"https://attack.mitre.org/techniques/T1003/003"}]},{"type":"relationship","id":"relationship--57ad6756-8dc6-555a-bee5-aa4a47aad89e","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--396444db-9966-5532-9205-61e00ecccc14"},{"type":"attack-pattern","id":"attack-pattern--2811a611-0886-5012-92dc-07928c2ac5ab","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"DCSync","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003.006","url":"https://attack.mitre.org/techniques/T1003/006"}]},{"type":"relationship","id":"relationship--f5078519-b021-5627-96bb-9938cbad3d28","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--2811a611-0886-5012-92dc-07928c2ac5ab"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--2b253ed8-0d44-5fc7-bdf6-12b095c863b2","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--899f44f4-12c7-5604-915a-132186dbec27","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"attack-pattern","id":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Obfuscated Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027","url":"https://attack.mitre.org/techniques/T1027"}]},{"type":"relationship","id":"relationship--182cfba3-9919-5259-95c1-a14f2c8746c9","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f"},{"type":"attack-pattern","id":"attack-pattern--116b8c87-d813-5286-89e6-ffcf57ca2284","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Dynamic API Resolution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.007","url":"https://attack.mitre.org/techniques/T1027/007"}]},{"type":"relationship","id":"relationship--e0fb4fa8-8f46-56c0-bb70-9254fb89e03e","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--116b8c87-d813-5286-89e6-ffcf57ca2284"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--81ae7ccd-a81a-5f7b-b964-46afa0b7b404","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--6baefaf6-a4fc-5606-bc3f-cac26787eda1","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Double File Extension","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.007","url":"https://attack.mitre.org/techniques/T1036/007"}]},{"type":"relationship","id":"relationship--d71b840f-653d-5d76-acc2-709116b9c78e","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--6baefaf6-a4fc-5606-bc3f-cac26787eda1"},{"type":"attack-pattern","id":"attack-pattern--4b033756-276a-5e1d-acf1-f44fb3874fc5","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Masquerade File Type","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.008","url":"https://attack.mitre.org/techniques/T1036/008"}]},{"type":"relationship","id":"relationship--626d3144-879d-5e53-9744-f1560f718a07","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--4b033756-276a-5e1d-acf1-f44fb3874fc5"},{"type":"attack-pattern","id":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Exfiltration Over C2 Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1041","url":"https://attack.mitre.org/techniques/T1041"}]},{"type":"relationship","id":"relationship--3f80169d-ab16-5712-92d9-9cdfdb0bbdb8","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--5cd52fbf-9cb2-5512-96c2-8981fc71aeed","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--63bb58e4-63d5-52e1-bf9a-5e68876f5aec","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--92c0e7ee-fdf3-57fb-8e0e-ff6257fb8b43","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Exfiltration Over Unencrypted Non-C2 Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1048.003","url":"https://attack.mitre.org/techniques/T1048/003"}]},{"type":"relationship","id":"relationship--3eee7489-f882-5f88-99c1-c8d65bb9ee47","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--92c0e7ee-fdf3-57fb-8e0e-ff6257fb8b43"},{"type":"attack-pattern","id":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"System Network Connections Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1049","url":"https://attack.mitre.org/techniques/T1049"}]},{"type":"relationship","id":"relationship--62376454-a463-501b-b1bc-9e58261f40fc","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--b730e53d-ffa0-5fdf-8e96-aa28fed05612"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--60ff1232-ed5b-51c8-b179-12bdaf3d7e7f","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Process Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1057","url":"https://attack.mitre.org/techniques/T1057"}]},{"type":"relationship","id":"relationship--4f2facd6-89f2-5e09-b95d-c7304aaa0be2","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--066a6ad0-0ff2-5b7e-8067-db3caf20a2f4"},{"type":"attack-pattern","id":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Command and Scripting Interpreter","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059","url":"https://attack.mitre.org/techniques/T1059"}]},{"type":"relationship","id":"relationship--891e499e-b259-59ee-bd82-d4f2e549a597","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--988228f7-e237-50c1-b05d-ed766e5bf103","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--50c1d4c5-7ce2-5217-99c2-86249c14cd3c","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--84182277-6273-5d08-bb7e-11db71bfcb40","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"JavaScript","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.007","url":"https://attack.mitre.org/techniques/T1059/007"}]},{"type":"relationship","id":"relationship--28f3c05a-1ff2-5c15-afff-b160e5aa073d","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc"},{"type":"attack-pattern","id":"attack-pattern--fa09ca33-6c9b-5e18-b561-a4a583e84fe5","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Indicator Removal","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070","url":"https://attack.mitre.org/techniques/T1070"}]},{"type":"relationship","id":"relationship--1cc83e3e-3cfe-552e-9051-a8b8c41f634c","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--fa09ca33-6c9b-5e18-b561-a4a583e84fe5"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--36a90729-3933-597d-85f2-b7289b6c4916","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--6d757b32-747e-5f8d-b087-8e42145e03a3","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--3eddfd3e-3390-5a5e-b673-3f20b96d3b16","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Software Deployment Tools","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1072","url":"https://attack.mitre.org/techniques/T1072"}]},{"type":"relationship","id":"relationship--80c7d203-4a62-5d38-9e93-2c599c758dee","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--3eddfd3e-3390-5a5e-b673-3f20b96d3b16"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--fa2a447b-e61d-5326-b348-d4051c5e8ca0","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--cd45a30a-2430-5b59-8824-63c81e1a846b","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Replication Through Removable Media","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1091","url":"https://attack.mitre.org/techniques/T1091"}]},{"type":"relationship","id":"relationship--e831b267-3ea0-56c5-b50a-ead3fa4452eb","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--cd45a30a-2430-5b59-8824-63c81e1a846b"},{"type":"attack-pattern","id":"attack-pattern--948a3131-b9eb-5fd9-9e5b-37081e8f5a85","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Non-Application Layer Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1095","url":"https://attack.mitre.org/techniques/T1095"}]},{"type":"relationship","id":"relationship--e7c498dc-c683-510c-9167-396589d85f42","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--948a3131-b9eb-5fd9-9e5b-37081e8f5a85"},{"type":"attack-pattern","id":"attack-pattern--3cce4469-d3b2-5b83-8e3d-53e78f7e9c6d","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Web Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102","url":"https://attack.mitre.org/techniques/T1102"}]},{"type":"relationship","id":"relationship--c8928d75-df74-51d4-ad95-8b367bc324d9","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--3cce4469-d3b2-5b83-8e3d-53e78f7e9c6d"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--ecca5b8b-87fd-53e6-b8d6-c6a5efd93e3a","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Native API","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1106","url":"https://attack.mitre.org/techniques/T1106"}]},{"type":"relationship","id":"relationship--eacb72d4-721d-540f-a517-f44a28c4fdca","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--97f03df4-8d90-5c9d-baf3-f1d6dbf82dc8"},{"type":"attack-pattern","id":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Automated Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1119","url":"https://attack.mitre.org/techniques/T1119"}]},{"type":"relationship","id":"relationship--8668beb5-8ccd-5b8a-b16a-029f2407394f","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3"},{"type":"attack-pattern","id":"attack-pattern--8bb5a105-3d72-5972-9541-897623f5839a","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Shared Modules","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1129","url":"https://attack.mitre.org/techniques/T1129"}]},{"type":"relationship","id":"relationship--7cc60968-913d-55c5-8de7-29873d6ba11d","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--8bb5a105-3d72-5972-9541-897623f5839a"},{"type":"attack-pattern","id":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Deobfuscate/Decode Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1140","url":"https://attack.mitre.org/techniques/T1140"}]},{"type":"relationship","id":"relationship--d39d0494-c48f-5f31-9208-52cfe3b1c040","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--8ffaad6b-1a62-541e-bcc5-c2a263f5d9e5"},{"type":"attack-pattern","id":"attack-pattern--20a1caf1-7b2d-52d6-b867-82019812a7a6","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"IDE Extensions","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1176.002","url":"https://attack.mitre.org/techniques/T1176/002"}]},{"type":"relationship","id":"relationship--4c63b8c9-48c0-5a4e-a511-d2b56c245476","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--20a1caf1-7b2d-52d6-b867-82019812a7a6"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--4d97f32f-71ab-5525-8df8-e2c2d0b4397c","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--78918776-8ee2-565f-a3db-fe4cc42031f3","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--845b5574-8835-593b-ab56-0c8ff18ea65e","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Traffic Signaling","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1205","url":"https://attack.mitre.org/techniques/T1205"}]},{"type":"relationship","id":"relationship--f425b312-133f-5a99-9378-7f6ca9641129","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--845b5574-8835-593b-ab56-0c8ff18ea65e"},{"type":"attack-pattern","id":"attack-pattern--151b5acf-15e9-5578-9780-6f61fb9f8b80","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"InstallUtil","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.004","url":"https://attack.mitre.org/techniques/T1218/004"}]},{"type":"relationship","id":"relationship--2d9cf548-37ef-5470-8a6a-29a7e698e4ed","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--151b5acf-15e9-5578-9780-6f61fb9f8b80"},{"type":"attack-pattern","id":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Mshta","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.005","url":"https://attack.mitre.org/techniques/T1218/005"}]},{"type":"relationship","id":"relationship--316a9256-ac41-59a2-8bdf-41e3c12d430d","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda"},{"type":"attack-pattern","id":"attack-pattern--e4275873-45d9-5f64-9fe9-0ec91eb9763d","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"IDE Tunneling","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1219.001","url":"https://attack.mitre.org/techniques/T1219/001"}]},{"type":"relationship","id":"relationship--6b1a54f7-3890-5ac9-bed5-9e507ad398ca","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--e4275873-45d9-5f64-9fe9-0ec91eb9763d"},{"type":"attack-pattern","id":"attack-pattern--6e63cfbd-a9d7-5aec-add4-888465258911","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Remote Desktop Software","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1219.002","url":"https://attack.mitre.org/techniques/T1219/002"}]},{"type":"relationship","id":"relationship--a11b816d-e916-5e7d-8156-94accbc0fd6f","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--6e63cfbd-a9d7-5aec-add4-888465258911"},{"type":"attack-pattern","id":"attack-pattern--6bc23961-1631-5f3d-8eac-6d2d27bed39d","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Software Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1518","url":"https://attack.mitre.org/techniques/T1518"}]},{"type":"relationship","id":"relationship--9fe23e55-b604-5e82-99b8-e7bd7babbb4b","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--6bc23961-1631-5f3d-8eac-6d2d27bed39d"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--36acd36f-1bf8-50fd-a278-c02fa9613830","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--33f877cd-158d-5f77-a584-174096537ee7","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Adversary-in-the-Middle","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1557","url":"https://attack.mitre.org/techniques/T1557"}]},{"type":"relationship","id":"relationship--a44d178e-20f5-56cf-904c-7b4d23a88fd8","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--33f877cd-158d-5f77-a584-174096537ee7"},{"type":"attack-pattern","id":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Archive via Utility","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.001","url":"https://attack.mitre.org/techniques/T1560/001"}]},{"type":"relationship","id":"relationship--82c144d8-47cb-5f40-832c-48085ef78b4a","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--3967f9cd-acf5-5561-98b5-7387276a956f"},{"type":"attack-pattern","id":"attack-pattern--174170f7-6bf5-5f70-919e-af37fa6a7714","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Archive via Custom Method","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560.003","url":"https://attack.mitre.org/techniques/T1560/003"}]},{"type":"relationship","id":"relationship--21b7b6c6-80ca-5320-be57-cdbcb5eb2914","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--174170f7-6bf5-5f70-919e-af37fa6a7714"},{"type":"attack-pattern","id":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Hidden Files and Directories","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1564.001","url":"https://attack.mitre.org/techniques/T1564/001"}]},{"type":"relationship","id":"relationship--4bdd6015-8af7-54e6-ba84-299152b5076c","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--9bfa8d1d-1083-51fd-9225-0095a5f6c4b4"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--08010c3f-c7c6-5e6a-8474-96a4b003984b","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--7f15427a-5d55-5a41-a5f5-bbd0c0f30721","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Exfiltration to Cloud Storage","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1567.002","url":"https://attack.mitre.org/techniques/T1567/002"}]},{"type":"relationship","id":"relationship--a8ad2abd-bab6-5215-9a01-aeba0ec2d162","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--49d7248e-1d9a-57f2-9fd0-72c06ad01221"},{"type":"attack-pattern","id":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Web Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.006","url":"https://attack.mitre.org/techniques/T1583/006"}]},{"type":"relationship","id":"relationship--69ca5c09-1476-569c-981a-d9ac82bfa2c0","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--1d523d04-c887-53e2-9090-24cd5c2641dd"},{"type":"attack-pattern","id":"attack-pattern--10fd0857-f024-537b-b356-654bb4ca4c2e","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Search Open Websites/Domains","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1593","url":"https://attack.mitre.org/techniques/T1593"}]},{"type":"relationship","id":"relationship--9fd17576-b759-5275-b49d-2b7cdf1f5a9b","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--10fd0857-f024-537b-b356-654bb4ca4c2e"},{"type":"attack-pattern","id":"attack-pattern--655162c9-489b-5dd2-bd9b-fecd633e3c30","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Stage Capabilities","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1608","url":"https://attack.mitre.org/techniques/T1608"}]},{"type":"relationship","id":"relationship--9bca1943-c2bc-5ded-a841-10f196d6e707","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--655162c9-489b-5dd2-bd9b-fecd633e3c30"},{"type":"attack-pattern","id":"attack-pattern--1e14925c-9e01-5814-8d11-0f7624194308","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Debugger Evasion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1622","url":"https://attack.mitre.org/techniques/T1622"}]},{"type":"relationship","id":"relationship--684163a9-29ba-5408-812b-51cbdd2026b3","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--1e14925c-9e01-5814-8d11-0f7624194308"},{"type":"attack-pattern","id":"attack-pattern--13f3ccee-8f92-557e-9ba8-850945b7b4f3","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Log Enumeration","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1654","url":"https://attack.mitre.org/techniques/T1654"}]},{"type":"relationship","id":"relationship--d72a9d63-39e8-5781-8024-55abbadebd9f","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--13f3ccee-8f92-557e-9ba8-850945b7b4f3"},{"type":"attack-pattern","id":"attack-pattern--571eb5ee-433d-525b-9fc4-b23eb335561b","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Delay Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1678","url":"https://attack.mitre.org/techniques/T1678"}]},{"type":"relationship","id":"relationship--6167187c-0450-57a6-9a71-93d162d0b088","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"uses","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"attack-pattern--571eb5ee-433d-525b-9fc4-b23eb335561b"},{"type":"location","id":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Belgium","country":"BE","region":"europe"},{"type":"relationship","id":"relationship--55dca946-81b6-5d46-8db6-f93a26d1b163","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--2a0210fd-890b-5862-bd01-f2cd5e77b2a5"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--e69d3c3d-47fa-5abe-b6bd-7da0b4479131","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--ffc4b03b-48ab-5ed9-a602-62ee1babaa8e","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--382d5ccf-5b08-5a14-b75e-b8f55bfacbae","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Hungary","country":"HU","region":"europe"},{"type":"relationship","id":"relationship--4a681e06-820f-5016-8d79-3a9b217cd265","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--382d5ccf-5b08-5a14-b75e-b8f55bfacbae"},{"type":"location","id":"location--a010f9b5-f121-5125-a684-6dd58c48d368","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Israel","country":"IL","region":"asia"},{"type":"relationship","id":"relationship--fc5d8138-615a-53ee-9f57-e22e70a55786","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--a010f9b5-f121-5125-a684-6dd58c48d368"},{"type":"location","id":"location--fd98b554-2d31-56db-8bc0-812e65009813","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Italy","country":"IT","region":"europe"},{"type":"relationship","id":"relationship--c0d0b1f1-9fa3-5c27-90c5-73dad3e27c09","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--fd98b554-2d31-56db-8bc0-812e65009813"},{"type":"location","id":"location--ceb3cdea-557f-530b-a8aa-1c7f3b8acc64","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Kazakhstan","country":"KZ","region":"asia"},{"type":"relationship","id":"relationship--79ad00c3-d7fa-5007-b3a6-d4d73cacf6b2","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--ceb3cdea-557f-530b-a8aa-1c7f3b8acc64"},{"type":"location","id":"location--947724ed-c15a-532c-b2d0-82a6dc7ef55d","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Montenegro","country":"ME","region":"europe"},{"type":"relationship","id":"relationship--9349093f-2c64-5bbb-a592-c42e124766f0","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--947724ed-c15a-532c-b2d0-82a6dc7ef55d"},{"type":"location","id":"location--61a56adf-7f12-5e96-b6c9-0cabef6c6315","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Myanmar","country":"MM","region":"asia"},{"type":"relationship","id":"relationship--cf7132a9-7f89-5574-83e9-211e5d27019a","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--61a56adf-7f12-5e96-b6c9-0cabef6c6315"},{"type":"location","id":"location--e6a15e3d-a6f4-57b1-8ecb-a2a326fbe2f4","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Mongolia","country":"MN","region":"asia"},{"type":"relationship","id":"relationship--4a23c762-3f01-5a20-8882-9284171759d3","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--e6a15e3d-a6f4-57b1-8ecb-a2a326fbe2f4"},{"type":"location","id":"location--388b3c77-9b12-5466-8c1e-195673038612","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Mauritius","country":"MU","region":"africa"},{"type":"relationship","id":"relationship--061f9d24-2244-5b2f-84d4-521254f1745d","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--388b3c77-9b12-5466-8c1e-195673038612"},{"type":"location","id":"location--51edd19f-4bd7-545d-9666-eb05f15cda9d","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Malaysia","country":"MY","region":"asia"},{"type":"relationship","id":"relationship--b5abf335-35e1-5a00-8602-2d22d3ce2415","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--51edd19f-4bd7-545d-9666-eb05f15cda9d"},{"type":"location","id":"location--6d6013c1-d310-5f19-8421-72317ffd6ee7","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Nepal","country":"NP","region":"asia"},{"type":"relationship","id":"relationship--98bd9211-d65f-532d-b2ad-c7f85d1feaf8","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--6d6013c1-d310-5f19-8421-72317ffd6ee7"},{"type":"location","id":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Philippines","country":"PH","region":"asia"},{"type":"relationship","id":"relationship--be940312-4cbe-5da8-8f09-d1621db82c8c","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822"},{"type":"location","id":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Pakistan","country":"PK","region":"asia"},{"type":"relationship","id":"relationship--9146cc9f-9b6d-5fa2-b245-4be4455e7999","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77"},{"type":"location","id":"location--28af571d-efb5-5547-b4c0-f5be348ac20a","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Poland","country":"PL","region":"europe"},{"type":"relationship","id":"relationship--05858ac4-6f62-51b5-af0c-76c55ef50a65","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--28af571d-efb5-5547-b4c0-f5be348ac20a"},{"type":"location","id":"location--48c0566b-263f-5cdb-b529-4f2715353a59","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Serbia","country":"RS","region":"europe"},{"type":"relationship","id":"relationship--8c1e4686-2833-54f1-86f1-fc75b93d0aaf","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--48c0566b-263f-5cdb-b529-4f2715353a59"},{"type":"location","id":"location--5335c49c-6927-5649-8a2c-06f868a6e189","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Slovakia","country":"SK","region":"europe"},{"type":"relationship","id":"relationship--b34b6c6e-2c4c-5584-86f9-09673b4eb7b1","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--5335c49c-6927-5649-8a2c-06f868a6e189"},{"type":"location","id":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Thailand","country":"TH","region":"asia"},{"type":"relationship","id":"relationship--5baa577f-6662-5ada-9745-1e273671f5fe","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186"},{"type":"location","id":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Taiwan","country":"TW","region":"asia"},{"type":"relationship","id":"relationship--ea7db235-baee-5114-9abb-6ca4acee1cb0","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1"},{"type":"location","id":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Ukraine","country":"UA","region":"europe"},{"type":"relationship","id":"relationship--d80eae4a-c2ff-5f75-a07a-d7122d3b478b","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--4b9f9989-c861-56f5-b96f-c1e996eb6322","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"},{"type":"location","id":"location--4ca1b4cb-af8a-5372-9788-48c52ad0cb05","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Vatican City","country":"VA","region":"europe"},{"type":"relationship","id":"relationship--7695f0aa-99ed-5c3c-868c-f49faae75448","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--4ca1b4cb-af8a-5372-9788-48c52ad0cb05"},{"type":"location","id":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Vietnam","country":"VN","region":"asia"},{"type":"relationship","id":"relationship--684b65ac-f5cb-5fb2-8c5e-1a44b46deba6","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9"},{"type":"location","id":"location--fae2a730-2ce4-50a7-973d-99664a824361","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","name":"Zimbabwe","country":"ZW","region":"africa"},{"type":"relationship","id":"relationship--723bc9a6-978a-5753-a77c-c17fc10a444b","spec_version":"2.1","created":"2026-05-20T09:52:24.315223+00:00","modified":"2026-07-29T07:06:38.304+00:00","relationship_type":"targets","source_ref":"intrusion-set--63f5fcab-7a9b-5880-aa7b-f550b879a73e","target_ref":"location--fae2a730-2ce4-50a7-973d-99664a824361"}]}