{"type":"bundle","id":"bundle--cdbedb72-5939-569f-a9b0-690f203f92b1","objects":[{"type":"intrusion-set","id":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Patchwork","aliases":["Patchwork","VICEROY TIGER","Operation Hangover","Dropping Elephant","Monsoon","Chinastrats","SectorE02","ATK11","Hangover","QUILTED TIGER","APT-C-09","Vibrant Opal","G0040","IRON PANDA"],"first_seen":"2009-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/patchwork"},{"source_name":"mitre-attack","external_id":"G0040","url":"https://attack.mitre.org/groups/G0040/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--2c6c4c3a-7bdc-5834-8749-20cbe4046ff7","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Remote Desktop Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1021.001","url":"https://attack.mitre.org/techniques/T1021/001"}]},{"type":"relationship","id":"relationship--ef6a349c-8ba7-5e6e-b135-aeda18572dde","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--9f627f43-16fe-5dd9-a85a-f56013e72950"},{"type":"attack-pattern","id":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Software Packing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.002","url":"https://attack.mitre.org/techniques/T1027/002"}]},{"type":"relationship","id":"relationship--79b45433-d9c9-557a-9b15-c7960e49a7b7","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--8f3df416-3850-5534-9c3d-6a8f7343c92d"},{"type":"attack-pattern","id":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Command Obfuscation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.010","url":"https://attack.mitre.org/techniques/T1027/010"}]},{"type":"relationship","id":"relationship--969a9229-4239-50cd-a53a-3b2aa19b01f7","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486"},{"type":"attack-pattern","id":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"System Owner/User Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1033","url":"https://attack.mitre.org/techniques/T1033"}]},{"type":"relationship","id":"relationship--e5931b1e-dea6-5317-9f00-fd71dfe36508","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--5794f196-c4b1-5178-9a87-bbd5351bdeae"},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--343b28d1-c13b-55e7-86ad-dfd0cd0a348d","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Scheduled Task","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1053.005","url":"https://attack.mitre.org/techniques/T1053/005"}]},{"type":"relationship","id":"relationship--3bbd9b18-df17-5597-8be7-3212ae91ffe0","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--5b9c404b-c207-54da-8f40-97b17eeae7d8"},{"type":"attack-pattern","id":"attack-pattern--52c7e47b-be40-519e-8f4f-8e18377515ad","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Process Hollowing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1055.012","url":"https://attack.mitre.org/techniques/T1055/012"}]},{"type":"relationship","id":"relationship--085cfe66-1f4b-52dd-8314-c30a805b8417","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--52c7e47b-be40-519e-8f4f-8e18377515ad"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--063a2658-170e-5ae1-b158-8b105cffff82","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--4435d5b6-fcb9-50da-b9cd-e16d600d56df","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Visual Basic","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.005","url":"https://attack.mitre.org/techniques/T1059/005"}]},{"type":"relationship","id":"relationship--2e339497-415a-5fce-ba2e-7fbf275e676b","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--80bbe2ac-55f9-5670-9b81-183194d9ba8e"},{"type":"attack-pattern","id":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"File Deletion","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1070.004","url":"https://attack.mitre.org/techniques/T1070/004"}]},{"type":"relationship","id":"relationship--ec63cdae-5ee0-552c-afa1-e98e5c6aeb8b","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--56e9c681-1ca0-518d-b40f-cf7807b49d05"},{"type":"attack-pattern","id":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"File and Directory Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1083","url":"https://attack.mitre.org/techniques/T1083"}]},{"type":"relationship","id":"relationship--67951ea4-7365-53b6-a696-880f4cb3ddbb","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--01d3636c-1049-59e7-9568-b125d31158dd"},{"type":"attack-pattern","id":"attack-pattern--98660027-bed4-5a1b-ac9b-6627a99d6480","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Dead Drop Resolver","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1102.001","url":"https://attack.mitre.org/techniques/T1102/001"}]},{"type":"relationship","id":"relationship--30ae47dc-c156-5971-9c26-3bca126d331b","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--98660027-bed4-5a1b-ac9b-6627a99d6480"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--4d2ebddb-be2e-5f62-974e-d3af0a290b27","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Modify Registry","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Defense Impairment"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1112","url":"https://attack.mitre.org/techniques/T1112"}]},{"type":"relationship","id":"relationship--9a045f23-fcd4-5f26-aed6-e89d334c2daf","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--212d2cd2-bb7f-5ca8-a89f-aa66dec93e51"},{"type":"attack-pattern","id":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Automated Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1119","url":"https://attack.mitre.org/techniques/T1119"}]},{"type":"relationship","id":"relationship--f78ef0e9-a4f4-533d-9265-689884673268","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--500dbad8-d9b0-5bfb-8677-8c3eb7e44ab3"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--adbc722a-a2c5-5e05-86d0-3447c1dca675","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--3131bfb2-9d10-5fff-8de0-31bccba3d19d","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"BITS Jobs","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1197","url":"https://attack.mitre.org/techniques/T1197"}]},{"type":"relationship","id":"relationship--1baf5a19-7be9-519b-9696-dc7d101dc5cc","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--3131bfb2-9d10-5fff-8de0-31bccba3d19d"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--b1f14cd1-38d8-5223-852c-264085daa973","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--4b58b531-cdaa-5497-aff2-64652b7a71b9","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Registry Run Keys / Startup Folder","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Persistence"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1547.001","url":"https://attack.mitre.org/techniques/T1547/001"}]},{"type":"relationship","id":"relationship--22a0b13a-2822-57fc-bcd1-d3c7a8d2656b","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--7b2d19e4-bdbd-51ea-a2fb-e189fbdc5cd4"},{"type":"attack-pattern","id":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Credentials from Web Browsers","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1555.003","url":"https://attack.mitre.org/techniques/T1555/003"}]},{"type":"relationship","id":"relationship--5e6571f3-a6fd-5e77-9dff-851452a5019c","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--717b894d-8b75-5238-843c-4fcbef706070"},{"type":"attack-pattern","id":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Archive Collected Data","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560","url":"https://attack.mitre.org/techniques/T1560"}]},{"type":"relationship","id":"relationship--45c26c60-1dac-5457-81fe-071eb6981a99","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--170e4138-6f89-5c21-b7a6-7d58f2c314a6","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--af078234-ce88-5709-85e0-8388ff07bf47","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--6b587822-f319-5e97-a60e-749521b0fbe7","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Local Storage Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1680","url":"https://attack.mitre.org/techniques/T1680"}]},{"type":"relationship","id":"relationship--72363593-b5aa-55d9-b04e-9ce6eec8a222","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"uses","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"attack-pattern--6b587822-f319-5e97-a60e-749521b0fbe7"},{"type":"location","id":"location--1375b154-0a19-561b-b92a-50fd99cbdd99","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"United Arab Emirates","country":"AE","region":"asia"},{"type":"relationship","id":"relationship--f7209601-bd3e-5544-966d-7e0c4eb674b3","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--1375b154-0a19-561b-b92a-50fd99cbdd99"},{"type":"location","id":"location--ae85030d-69cb-536c-8f14-e4336359104d","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Afghanistan","country":"AF","region":"asia"},{"type":"relationship","id":"relationship--3932dc24-ef96-58e2-b6e4-e32913889e3a","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--ae85030d-69cb-536c-8f14-e4336359104d"},{"type":"location","id":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Australia","country":"AU","region":"oceania"},{"type":"relationship","id":"relationship--de67cd04-318d-55f0-bf6b-e0168d950011","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a"},{"type":"location","id":"location--a162b21a-e4f9-56d7-9d2c-b77b4154e783","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Bangladesh","country":"BD","region":"asia"},{"type":"relationship","id":"relationship--6c52f614-d2af-5fea-8f0f-393910ae2142","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--a162b21a-e4f9-56d7-9d2c-b77b4154e783"},{"type":"location","id":"location--df32d83f-5f4c-5118-a126-3f5c603db260","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Canada","country":"CA","region":"americas"},{"type":"relationship","id":"relationship--f804258d-aaba-5798-a22e-89a9721dc2bc","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--df32d83f-5f4c-5118-a126-3f5c603db260"},{"type":"location","id":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"China","country":"CN","region":"asia"},{"type":"relationship","id":"relationship--c8383310-07e1-5c01-b92c-58638acecf76","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--056ea79b-9152-5e3f-86fe-b20f9c477d2f","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Hong Kong","country":"HK","region":"asia"},{"type":"relationship","id":"relationship--3e787893-831e-5f52-8631-c96e97a7f9d9","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--4fc5cec1-9034-5db5-b6cc-7e6a86346fc6","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--ad0e2a15-cb2b-5914-9739-1fecfc18450f","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Iran","country":"IR","region":"asia"},{"type":"relationship","id":"relationship--68eec999-ce78-5e2d-a8fe-b4bfa08d4f6e","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--ad0e2a15-cb2b-5914-9739-1fecfc18450f"},{"type":"location","id":"location--78662962-dc04-5bf7-8a71-2e825ce899cf","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Sri Lanka","country":"LK","region":"asia"},{"type":"relationship","id":"relationship--ef8c5c37-1c75-5ca0-beb3-1e17f9a6535f","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--78662962-dc04-5bf7-8a71-2e825ce899cf"},{"type":"location","id":"location--e6a15e3d-a6f4-57b1-8ecb-a2a326fbe2f4","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Mongolia","country":"MN","region":"asia"},{"type":"relationship","id":"relationship--71bc6e8f-b4e8-5a96-a67f-7ab533996ff1","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--e6a15e3d-a6f4-57b1-8ecb-a2a326fbe2f4"},{"type":"location","id":"location--88c9fb6c-f398-559f-b18e-422cbb386901","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Norway","country":"NO","region":"europe"},{"type":"relationship","id":"relationship--bde9ac10-b01f-596b-9dd0-58680a62fff0","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--88c9fb6c-f398-559f-b18e-422cbb386901"},{"type":"location","id":"location--f8c79602-1ba4-5643-8a4a-86331c7f1a46","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Oman","country":"OM","region":"asia"},{"type":"relationship","id":"relationship--07a0d1b6-eded-5aed-a527-d661a070c12a","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--f8c79602-1ba4-5643-8a4a-86331c7f1a46"},{"type":"location","id":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Pakistan","country":"PK","region":"asia"},{"type":"relationship","id":"relationship--b0d064d0-f230-5c6a-b425-c161b9b31116","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--d67b28f5-3449-5d37-bbeb-23642cd36b77"},{"type":"location","id":"location--657f368a-bd77-5f31-84cf-340236190da3","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Russia","country":"RU","region":"europe"},{"type":"relationship","id":"relationship--8f2404db-c734-52b2-aa36-5bb8eacfc644","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--657f368a-bd77-5f31-84cf-340236190da3"},{"type":"location","id":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Saudi Arabia","country":"SA","region":"asia"},{"type":"relationship","id":"relationship--8e3a2d3f-f16d-5af9-b910-a5771fcf6ecd","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--4ea5f174-f6ea-5fe4-acc4-765448fbce0a"},{"type":"location","id":"location--9f915047-365b-5d02-ac33-38528c38eb92","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Singapore","country":"SG","region":"asia"},{"type":"relationship","id":"relationship--e5b2f973-cd4a-500a-a0f3-7e5f06a6e5ba","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--9f915047-365b-5d02-ac33-38528c38eb92"},{"type":"location","id":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Türkiye","country":"TR","region":"asia"},{"type":"relationship","id":"relationship--828061c0-f07c-5bc5-aa11-66b5ab38da15","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe"},{"type":"location","id":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"Taiwan","country":"TW","region":"asia"},{"type":"relationship","id":"relationship--cd36d896-2a32-5c06-b75c-4cd0f88e640c","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--b6441ffb-0865-5bb9-9d5f-f800436cb4f1"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--d9504416-af40-5f39-9cd2-68f43abac070","spec_version":"2.1","created":"2026-05-20T09:52:25.322081+00:00","modified":"2026-07-29T08:59:18.361+00:00","relationship_type":"targets","source_ref":"intrusion-set--1479810b-a29f-56de-89c9-7e92f556c1ca","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}