{"type":"bundle","id":"bundle--c337f02a-3759-5d61-acbf-f709c2f9923f","objects":[{"type":"intrusion-set","id":"intrusion-set--0e5e60e2-65ee-5730-9e41-1aa375ea7703","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","name":"TA551","aliases":["Shathak","UNC2420"],"first_seen":"2018-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/ta551"}],"labels":["cybercrime","fin","ran"]},{"type":"attack-pattern","id":"attack-pattern--651509f5-52f0-5c8e-af73-dea9c8dd5f85","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","name":"Regsvr32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.010","url":"https://attack.mitre.org/techniques/T1218/010"}]},{"type":"relationship","id":"relationship--4983f6b1-a2d5-5e53-a56d-8d44653d33ab","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","relationship_type":"uses","source_ref":"intrusion-set--0e5e60e2-65ee-5730-9e41-1aa375ea7703","target_ref":"attack-pattern--651509f5-52f0-5c8e-af73-dea9c8dd5f85"},{"type":"attack-pattern","id":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","name":"Rundll32","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.011","url":"https://attack.mitre.org/techniques/T1218/011"}]},{"type":"relationship","id":"relationship--a35ffa1a-a46a-5966-bfc5-fbb0af0e3edd","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","relationship_type":"uses","source_ref":"intrusion-set--0e5e60e2-65ee-5730-9e41-1aa375ea7703","target_ref":"attack-pattern--ad5c8bbd-7aa6-54eb-a215-813f0e62fe44"},{"type":"attack-pattern","id":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","name":"Email Addresses","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Reconnaissance"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1589.002","url":"https://attack.mitre.org/techniques/T1589/002"}]},{"type":"relationship","id":"relationship--4a74fab0-a94e-5395-a6ab-313236f336a1","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","relationship_type":"uses","source_ref":"intrusion-set--0e5e60e2-65ee-5730-9e41-1aa375ea7703","target_ref":"attack-pattern--89d3ed48-b2fd-53f5-b426-32a2fd501bd9"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--a7ec2382-eb6a-5c91-a931-3807d3c73127","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","relationship_type":"uses","source_ref":"intrusion-set--0e5e60e2-65ee-5730-9e41-1aa375ea7703","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","name":"Masquerading","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036","url":"https://attack.mitre.org/techniques/T1036"}]},{"type":"relationship","id":"relationship--c27d2d1b-adb2-5b30-bf53-b327de84be32","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","relationship_type":"uses","source_ref":"intrusion-set--0e5e60e2-65ee-5730-9e41-1aa375ea7703","target_ref":"attack-pattern--e52e2304-f280-5d73-9850-2a7a5b37727a"},{"type":"attack-pattern","id":"attack-pattern--6aa1111e-c29d-5cd6-91d5-69ab9b7c0d27","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","name":"Steganography","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.003","url":"https://attack.mitre.org/techniques/T1027/003"}]},{"type":"relationship","id":"relationship--a01949b6-99fc-573d-94ec-73aaf58f60f0","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","relationship_type":"uses","source_ref":"intrusion-set--0e5e60e2-65ee-5730-9e41-1aa375ea7703","target_ref":"attack-pattern--6aa1111e-c29d-5cd6-91d5-69ab9b7c0d27"},{"type":"attack-pattern","id":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","name":"Mshta","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1218.005","url":"https://attack.mitre.org/techniques/T1218/005"}]},{"type":"relationship","id":"relationship--e0571416-2b81-547b-8ba2-6b941774a38f","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","relationship_type":"uses","source_ref":"intrusion-set--0e5e60e2-65ee-5730-9e41-1aa375ea7703","target_ref":"attack-pattern--d30b4fa1-3c5c-5b6b-9cec-484e7de5ccda"},{"type":"attack-pattern","id":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","name":"Windows Command Shell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.003","url":"https://attack.mitre.org/techniques/T1059/003"}]},{"type":"relationship","id":"relationship--cd767d4d-3a20-56d6-b5bf-7d6615fd020b","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","relationship_type":"uses","source_ref":"intrusion-set--0e5e60e2-65ee-5730-9e41-1aa375ea7703","target_ref":"attack-pattern--cf456289-7638-5e20-8316-3599b0c6019b"},{"type":"attack-pattern","id":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","name":"Web Protocols","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071.001","url":"https://attack.mitre.org/techniques/T1071/001"}]},{"type":"relationship","id":"relationship--de1e081a-3978-5caa-a12a-3e9fa03f864c","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","relationship_type":"uses","source_ref":"intrusion-set--0e5e60e2-65ee-5730-9e41-1aa375ea7703","target_ref":"attack-pattern--2b08bace-70a9-534c-861e-76d7dd8ea0e9"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--e360243d-862d-56cb-be54-a3d54cb9cf02","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","relationship_type":"uses","source_ref":"intrusion-set--0e5e60e2-65ee-5730-9e41-1aa375ea7703","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","name":"Command Obfuscation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027.010","url":"https://attack.mitre.org/techniques/T1027/010"}]},{"type":"relationship","id":"relationship--139d3204-5b5e-5b42-8b8a-b08e002429c6","spec_version":"2.1","created":"2026-05-20T09:52:27.600145+00:00","modified":"2026-05-20T09:52:27.600145+00:00","relationship_type":"uses","source_ref":"intrusion-set--0e5e60e2-65ee-5730-9e41-1aa375ea7703","target_ref":"attack-pattern--3808bff0-0f79-5ea2-998d-aa039ff41486"}]}