{"type":"bundle","id":"bundle--0d9cc4cd-1379-543c-b0f2-e5eb2cccc05d","objects":[{"type":"intrusion-set","id":"intrusion-set--3dbb0bcd-c80f-59bf-9ed9-447179fc88ad","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","name":"Star Blizzard","description":"FSB cyber-espionage group targeting Western think tanks, NGOs, and politicians.","aliases":["BlueCharlie","SEABORGIUM","TAG-53","Callisto","COLDRIVER","G1033","TA446","IRON FRONTIER"],"first_seen":"2017-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/star-blizzard"},{"source_name":"mitre-attack","external_id":"G1033","url":"https://attack.mitre.org/groups/G1033/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--10fd0857-f024-537b-b356-654bb4ca4c2e","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","name":"Search Open Websites/Domains","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1593","url":"https://attack.mitre.org/techniques/T1593"}]},{"type":"relationship","id":"relationship--422e6097-5412-57af-826b-784865d6d708","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","relationship_type":"uses","source_ref":"intrusion-set--3dbb0bcd-c80f-59bf-9ed9-447179fc88ad","target_ref":"attack-pattern--10fd0857-f024-537b-b356-654bb4ca4c2e"},{"type":"attack-pattern","id":"attack-pattern--0f0cc6d7-1ffa-5b47-8f22-758cc19b400b","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","name":"Acquire Infrastructure","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583","url":"https://attack.mitre.org/techniques/T1583"}]},{"type":"relationship","id":"relationship--13a55d89-e3a1-5e99-a2df-fe6e26277ffa","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","relationship_type":"uses","source_ref":"intrusion-set--3dbb0bcd-c80f-59bf-9ed9-447179fc88ad","target_ref":"attack-pattern--0f0cc6d7-1ffa-5b47-8f22-758cc19b400b"},{"type":"attack-pattern","id":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","name":"JavaScript","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.007","url":"https://attack.mitre.org/techniques/T1059/007"}]},{"type":"relationship","id":"relationship--0aa1cd0a-1508-5043-81a6-1a6bb7669567","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","relationship_type":"uses","source_ref":"intrusion-set--3dbb0bcd-c80f-59bf-9ed9-447179fc88ad","target_ref":"attack-pattern--b89d0ac8-c6b0-520b-b42a-2bde78a994dc"},{"type":"attack-pattern","id":"attack-pattern--17aa8f39-b715-569f-acd8-521a0da1ac7b","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","name":"Remote Email Collection","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1114.002","url":"https://attack.mitre.org/techniques/T1114/002"}]},{"type":"relationship","id":"relationship--e7586a3f-63c6-5034-b521-a512256984b4","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","relationship_type":"uses","source_ref":"intrusion-set--3dbb0bcd-c80f-59bf-9ed9-447179fc88ad","target_ref":"attack-pattern--17aa8f39-b715-569f-acd8-521a0da1ac7b"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--5789d071-d2a8-55a9-9b37-25cfa889cd3b","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","relationship_type":"uses","source_ref":"intrusion-set--3dbb0bcd-c80f-59bf-9ed9-447179fc88ad","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--abc6446a-b100-5237-80e0-21c49b39bf62","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","name":"Impersonation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1684.001","url":"https://attack.mitre.org/techniques/T1684/001"}]},{"type":"relationship","id":"relationship--f37e844f-a09f-5b17-91cd-d1a9b74dc016","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","relationship_type":"uses","source_ref":"intrusion-set--3dbb0bcd-c80f-59bf-9ed9-447179fc88ad","target_ref":"attack-pattern--abc6446a-b100-5237-80e0-21c49b39bf62"},{"type":"attack-pattern","id":"attack-pattern--672d4b11-210b-5ad6-9c7f-8d0041ebc115","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","name":"Web Session Cookie","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1550.004","url":"https://attack.mitre.org/techniques/T1550/004"}]},{"type":"relationship","id":"relationship--7613fcef-218f-579b-9f86-89bd78462cb0","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","relationship_type":"uses","source_ref":"intrusion-set--3dbb0bcd-c80f-59bf-9ed9-447179fc88ad","target_ref":"attack-pattern--672d4b11-210b-5ad6-9c7f-8d0041ebc115"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--afbdab95-4e03-5ce6-be70-f858117f3786","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","relationship_type":"uses","source_ref":"intrusion-set--3dbb0bcd-c80f-59bf-9ed9-447179fc88ad","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--e17aa47c-232f-576d-bfd6-e0e04e7369db","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","name":"Email Forwarding Rule","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1114.003","url":"https://attack.mitre.org/techniques/T1114/003"}]},{"type":"relationship","id":"relationship--9595bfeb-462e-508c-88f8-8b2fb822fc71","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","relationship_type":"uses","source_ref":"intrusion-set--3dbb0bcd-c80f-59bf-9ed9-447179fc88ad","target_ref":"attack-pattern--e17aa47c-232f-576d-bfd6-e0e04e7369db"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--63c59c25-712d-5668-909e-b99cd62a26ed","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","relationship_type":"targets","source_ref":"intrusion-set--3dbb0bcd-c80f-59bf-9ed9-447179fc88ad","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--28af571d-efb5-5547-b4c0-f5be348ac20a","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","name":"Poland","country":"PL","region":"europe"},{"type":"relationship","id":"relationship--82869dcb-3a66-5695-a79a-1fb0e823feae","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","relationship_type":"targets","source_ref":"intrusion-set--3dbb0bcd-c80f-59bf-9ed9-447179fc88ad","target_ref":"location--28af571d-efb5-5547-b4c0-f5be348ac20a"},{"type":"location","id":"location--657f368a-bd77-5f31-84cf-340236190da3","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","name":"Russia","country":"RU","region":"europe"},{"type":"relationship","id":"relationship--543c8c47-55a8-57d3-b09b-106700dd777b","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","relationship_type":"targets","source_ref":"intrusion-set--3dbb0bcd-c80f-59bf-9ed9-447179fc88ad","target_ref":"location--657f368a-bd77-5f31-84cf-340236190da3"},{"type":"location","id":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","name":"Ukraine","country":"UA","region":"europe"},{"type":"relationship","id":"relationship--4e372ab1-ed72-5c0e-8374-064840307da1","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","relationship_type":"targets","source_ref":"intrusion-set--3dbb0bcd-c80f-59bf-9ed9-447179fc88ad","target_ref":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--63df1c2f-9e74-57a6-8a65-2685886e248e","spec_version":"2.1","created":"2026-05-20T09:52:26.841246+00:00","modified":"2026-07-29T07:06:48.762+00:00","relationship_type":"targets","source_ref":"intrusion-set--3dbb0bcd-c80f-59bf-9ed9-447179fc88ad","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"}]}