{"type":"bundle","id":"bundle--ad65a96d-51b2-50c2-9674-958d58d5b7e9","objects":[{"type":"intrusion-set","id":"intrusion-set--490fdb96-b606-5f48-ad24-066ceafbda99","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","name":"TA570","aliases":["Charming Serpens"],"first_seen":"2020-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/ta570"}],"labels":["cybercrime","fin","ran"]},{"type":"attack-pattern","id":"attack-pattern--183774af-4c33-54de-8d3d-aaf04646d481","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","name":"Phishing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566","url":"https://attack.mitre.org/techniques/T1566"}]},{"type":"relationship","id":"relationship--6198f740-8929-52a9-baa4-8127f55b727f","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","relationship_type":"uses","source_ref":"intrusion-set--490fdb96-b606-5f48-ad24-066ceafbda99","target_ref":"attack-pattern--183774af-4c33-54de-8d3d-aaf04646d481"},{"type":"attack-pattern","id":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","name":"Data Encrypted for Impact","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1486","url":"https://attack.mitre.org/techniques/T1486"}]},{"type":"relationship","id":"relationship--7c2ee5af-9282-508f-b452-6cbff4fe60f2","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","relationship_type":"uses","source_ref":"intrusion-set--490fdb96-b606-5f48-ad24-066ceafbda99","target_ref":"attack-pattern--ee27794c-21a1-5207-b7b4-b281d3de11d2"},{"type":"attack-pattern","id":"attack-pattern--015390a2-cdd2-51a6-ab40-cc4549b0c117","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","name":"Inhibit System Recovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1490","url":"https://attack.mitre.org/techniques/T1490"}]},{"type":"relationship","id":"relationship--3d1022be-bec8-5882-9430-7512bc475513","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","relationship_type":"uses","source_ref":"intrusion-set--490fdb96-b606-5f48-ad24-066ceafbda99","target_ref":"attack-pattern--015390a2-cdd2-51a6-ab40-cc4549b0c117"},{"type":"attack-pattern","id":"attack-pattern--45a3f496-4ba4-5430-ab72-0d06b51d2e12","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","name":"Financial Theft","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1657","url":"https://attack.mitre.org/techniques/T1657"}]},{"type":"relationship","id":"relationship--f7008078-d692-5217-891f-6b6a800ae12f","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","relationship_type":"uses","source_ref":"intrusion-set--490fdb96-b606-5f48-ad24-066ceafbda99","target_ref":"attack-pattern--45a3f496-4ba4-5430-ab72-0d06b51d2e12"},{"type":"attack-pattern","id":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","name":"Command and Scripting Interpreter","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059","url":"https://attack.mitre.org/techniques/T1059"}]},{"type":"relationship","id":"relationship--d0d794e9-fd62-5480-b19e-ea58fd8fc6ff","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","relationship_type":"uses","source_ref":"intrusion-set--490fdb96-b606-5f48-ad24-066ceafbda99","target_ref":"attack-pattern--298551ee-22ca-5cf7-af46-41d8035efbcf"},{"type":"attack-pattern","id":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","name":"Obfuscated Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027","url":"https://attack.mitre.org/techniques/T1027"}]},{"type":"relationship","id":"relationship--720a41d9-e328-5739-96f5-0e6871c071b0","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","relationship_type":"uses","source_ref":"intrusion-set--490fdb96-b606-5f48-ad24-066ceafbda99","target_ref":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--a198aca4-1a06-5632-97ff-15ab07f88c97","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","relationship_type":"uses","source_ref":"intrusion-set--490fdb96-b606-5f48-ad24-066ceafbda99","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--58902cf1-d2d9-5220-a3bc-e970ebd72256","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","name":"Service Stop","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Impact"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1489","url":"https://attack.mitre.org/techniques/T1489"}]},{"type":"relationship","id":"relationship--6305e483-8576-54f4-a485-6ed121d0f386","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","relationship_type":"uses","source_ref":"intrusion-set--490fdb96-b606-5f48-ad24-066ceafbda99","target_ref":"attack-pattern--58902cf1-d2d9-5220-a3bc-e970ebd72256"},{"type":"attack-pattern","id":"attack-pattern--f8b681a6-c01a-53c9-a3b0-83ea21e8823b","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","name":"Application Layer Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071","url":"https://attack.mitre.org/techniques/T1071"}]},{"type":"relationship","id":"relationship--3fc23e42-f856-53f3-ac51-7192b02c3948","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","relationship_type":"uses","source_ref":"intrusion-set--490fdb96-b606-5f48-ad24-066ceafbda99","target_ref":"attack-pattern--f8b681a6-c01a-53c9-a3b0-83ea21e8823b"},{"type":"attack-pattern","id":"attack-pattern--312a9eff-8dc8-5ca1-a077-9c426b1f2ad1","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","name":"User Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204","url":"https://attack.mitre.org/techniques/T1204"}]},{"type":"relationship","id":"relationship--f6d40b46-b108-5069-b44f-ac3db45c9760","spec_version":"2.1","created":"2026-05-20T09:52:27.842446+00:00","modified":"2026-05-20T09:52:27.842446+00:00","relationship_type":"uses","source_ref":"intrusion-set--490fdb96-b606-5f48-ad24-066ceafbda99","target_ref":"attack-pattern--312a9eff-8dc8-5ca1-a077-9c426b1f2ad1"}]}