{"type":"bundle","id":"bundle--1a5cc01f-7663-50cf-99fc-4d0771479afd","objects":[{"type":"intrusion-set","id":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Naikon","aliases":["Naikon","Hellsing","Camerashy","Override Panda","Lotus Blossom","LOTUS PANDA","APT30","Circle Typhoon","G0019"],"first_seen":"2010-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/naikon"},{"source_name":"mitre-attack","external_id":"G0019","url":"https://attack.mitre.org/groups/G0019/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--5f79f817-b071-5a8b-a603-5dcc013c1114","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Windows Management Instrumentation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1047","url":"https://attack.mitre.org/techniques/T1047"}]},{"type":"relationship","id":"relationship--587e3dff-5f8a-5462-95a4-ebb412b16664","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"attack-pattern--ae5783c5-87fc-555d-81e8-cdd25470d85e"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--ae2978be-0946-50b2-b9db-93ca9d798905","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--83d95197-bfa7-507c-96b1-01970f7a5163","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--7ea2e7eb-4d7b-5ffb-9c2f-76a07a7b6cec","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Add-ins","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1137.006","url":"https://attack.mitre.org/techniques/T1137/006"}]},{"type":"relationship","id":"relationship--c451fd96-bc83-5073-a733-42c6d00654aa","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"attack-pattern--7ea2e7eb-4d7b-5ffb-9c2f-76a07a7b6cec"},{"type":"attack-pattern","id":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"System Network Configuration Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1016","url":"https://attack.mitre.org/techniques/T1016"}]},{"type":"relationship","id":"relationship--d5afb8a5-3bed-5909-b455-0bcbde5bb32c","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"attack-pattern--85b2a630-ee19-59eb-bb09-8da636eb4c2c"},{"type":"attack-pattern","id":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Domain Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078.002","url":"https://attack.mitre.org/techniques/T1078/002"}]},{"type":"relationship","id":"relationship--c5167e4d-2245-5065-83b8-f0458a8577c5","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"attack-pattern--a184b572-e2fb-5214-87a2-69848edd3a9a"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--2e65633a-1b5f-54b2-aa81-871f17336995","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Masquerade Task or Service","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.004","url":"https://attack.mitre.org/techniques/T1036/004"}]},{"type":"relationship","id":"relationship--be884e16-9020-5ced-9565-fd4b66162e15","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"attack-pattern--9fd9986d-f7fe-50c9-aa92-2465c0988b70"},{"type":"attack-pattern","id":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Network Service Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1046","url":"https://attack.mitre.org/techniques/T1046"}]},{"type":"relationship","id":"relationship--6897a7cc-5435-5ee9-bc31-a77d72c14a62","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"attack-pattern--5fc10d0e-d4d7-5f76-9c02-68eeb6c7a696"},{"type":"attack-pattern","id":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Remote System Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1018","url":"https://attack.mitre.org/techniques/T1018"}]},{"type":"relationship","id":"relationship--2efef217-f443-5698-b7bb-cea317d921ca","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"uses","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"attack-pattern--6a976a04-eded-5abb-b18d-fa7463e1f21d"},{"type":"location","id":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Hong Kong","country":"HK","region":"asia"},{"type":"relationship","id":"relationship--f382bd82-42b6-55d0-9488-be791c8ef200","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"targets","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff"},{"type":"location","id":"location--28697960-8769-586b-b87b-b9c4e8e68b1d","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Indonesia","country":"ID","region":"asia"},{"type":"relationship","id":"relationship--1f3a3732-e1ef-5130-a21f-4bb8d90fb360","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"targets","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"location--28697960-8769-586b-b87b-b9c4e8e68b1d"},{"type":"location","id":"location--fd2f1d6f-f5f5-55a3-b0f3-a25b36c28f54","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Cambodia","country":"KH","region":"asia"},{"type":"relationship","id":"relationship--0bda7407-8020-55ad-94f3-5bd4b422232e","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"targets","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"location--fd2f1d6f-f5f5-55a3-b0f3-a25b36c28f54"},{"type":"location","id":"location--538b5cfb-ac5d-5ee9-b992-79b29a79b308","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Laos","country":"LA","region":"asia"},{"type":"relationship","id":"relationship--0a0fca3d-9fd5-5d10-9f87-49c1b8b939b3","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"targets","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"location--538b5cfb-ac5d-5ee9-b992-79b29a79b308"},{"type":"location","id":"location--61a56adf-7f12-5e96-b6c9-0cabef6c6315","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Myanmar","country":"MM","region":"asia"},{"type":"relationship","id":"relationship--b0701cca-341c-5e72-ad87-70e2f06de483","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"targets","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"location--61a56adf-7f12-5e96-b6c9-0cabef6c6315"},{"type":"location","id":"location--01638614-d673-58f9-9e1c-5fcfb1c0a4d3","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Macau","country":"MO","region":"asia"},{"type":"relationship","id":"relationship--e158fec6-1ca1-5b73-9405-a5c853c7b245","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"targets","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"location--01638614-d673-58f9-9e1c-5fcfb1c0a4d3"},{"type":"location","id":"location--51edd19f-4bd7-545d-9666-eb05f15cda9d","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Malaysia","country":"MY","region":"asia"},{"type":"relationship","id":"relationship--4af24d85-e855-5dbc-959b-1a7e478a1b7f","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"targets","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"location--51edd19f-4bd7-545d-9666-eb05f15cda9d"},{"type":"location","id":"location--6d6013c1-d310-5f19-8421-72317ffd6ee7","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Nepal","country":"NP","region":"asia"},{"type":"relationship","id":"relationship--6ecfb9fd-fe40-544d-89e1-ca815303ca00","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"targets","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"location--6d6013c1-d310-5f19-8421-72317ffd6ee7"},{"type":"location","id":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Philippines","country":"PH","region":"asia"},{"type":"relationship","id":"relationship--a75260cb-f746-5072-b117-847726fe4b91","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"targets","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822"},{"type":"location","id":"location--9f915047-365b-5d02-ac33-38528c38eb92","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Singapore","country":"SG","region":"asia"},{"type":"relationship","id":"relationship--6958f68a-5148-57c5-a9e3-5488167d79f6","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"targets","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"location--9f915047-365b-5d02-ac33-38528c38eb92"},{"type":"location","id":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Thailand","country":"TH","region":"asia"},{"type":"relationship","id":"relationship--0806773f-5140-5e46-8499-e13d3f498306","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"targets","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186"},{"type":"location","id":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Taiwan","country":"TW","region":"asia"},{"type":"relationship","id":"relationship--eeda4468-7a57-5111-8e01-7d56ab531ed5","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"targets","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--52efe224-1301-5db2-a031-06664a5a3215","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"targets","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"},{"type":"location","id":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","name":"Vietnam","country":"VN","region":"asia"},{"type":"relationship","id":"relationship--1d76b95e-f2e4-555e-aa41-6b8348f7ca13","spec_version":"2.1","created":"2026-05-20T09:52:24.568105+00:00","modified":"2026-07-29T11:39:08.031+00:00","relationship_type":"targets","source_ref":"intrusion-set--2e8c44f4-14ef-5953-910a-b7c41b39250b","target_ref":"location--cc3c6f54-8845-5e18-9950-33f68b9666c9"}]}