{"type":"bundle","id":"bundle--48f240eb-a782-599b-b7b5-5f765f7a4985","objects":[{"type":"intrusion-set","id":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Tonto Team","aliases":["Tonto Team","Earth Akhlut","CactusPete","HeartBeat","KARMA PANDA","Purple Typhoon","G0131","BRONZE HUNTLEY"],"first_seen":"2009-01-01T00:00:00.000Z","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/tonto-team"},{"source_name":"mitre-attack","external_id":"G0131","url":"https://attack.mitre.org/groups/G0131/"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"OS Credential Dumping","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003","url":"https://attack.mitre.org/techniques/T1003"}]},{"type":"relationship","id":"relationship--9ff37588-2bfb-5754-b4a7-0a4a3eaa6066","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"uses","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56"},{"type":"attack-pattern","id":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Spearphishing Attachment","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.001","url":"https://attack.mitre.org/techniques/T1566/001"}]},{"type":"relationship","id":"relationship--a0461a10-0e5d-5adc-a0f3-57bef744b92d","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"uses","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"attack-pattern--3ed779c7-a3d4-5af5-8cf5-ab0c7e9900ed"},{"type":"attack-pattern","id":"attack-pattern--ef38b7e3-123c-503b-97ec-7915e8882375","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Network Share Discovery","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1135","url":"https://attack.mitre.org/techniques/T1135"}]},{"type":"relationship","id":"relationship--5b4ebd60-205e-5210-a5dc-b0b12c135f74","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"uses","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"attack-pattern--ef38b7e3-123c-503b-97ec-7915e8882375"},{"type":"attack-pattern","id":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Python","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.006","url":"https://attack.mitre.org/techniques/T1059/006"}]},{"type":"relationship","id":"relationship--4c56d749-fc2b-5919-9a50-2b20bf011283","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"uses","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"attack-pattern--1b59a8f2-784a-5c11-9754-599f71f2dbe8"},{"type":"attack-pattern","id":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Exploitation for Privilege Escalation","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Privilege Escalation"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1068","url":"https://attack.mitre.org/techniques/T1068"}]},{"type":"relationship","id":"relationship--b45cf57a-cbf7-5e95-9714-4aa406507d64","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"uses","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"attack-pattern--8c626bca-7d35-5166-bdd7-a35b89cd973d"},{"type":"attack-pattern","id":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"PowerShell","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1059.001","url":"https://attack.mitre.org/techniques/T1059/001"}]},{"type":"relationship","id":"relationship--d03a9c44-fddd-5859-9cb1-0a3b5f3833e1","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"uses","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"attack-pattern--a9d34107-5cdd-5c05-809d-436ff6f7509d"},{"type":"attack-pattern","id":"attack-pattern--b398dd87-6aae-5e87-aea4-54f6c6c7898c","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Local Groups","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Discovery"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1069.001","url":"https://attack.mitre.org/techniques/T1069/001"}]},{"type":"relationship","id":"relationship--0b3f5fe8-c863-596b-91b3-1f6a4463dde6","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"uses","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"attack-pattern--b398dd87-6aae-5e87-aea4-54f6c6c7898c"},{"type":"attack-pattern","id":"attack-pattern--86cda69e-2977-5ad8-8419-13a697a3e4af","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Exploitation of Remote Services","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Lateral Movement"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1210","url":"https://attack.mitre.org/techniques/T1210"}]},{"type":"relationship","id":"relationship--af8a68d1-6f60-55e9-b2a8-4cb9aad6d01e","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"uses","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"attack-pattern--86cda69e-2977-5ad8-8419-13a697a3e4af"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--ff0d26ea-1114-5f90-b967-29ec4da70cda","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"uses","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"attack-pattern","id":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Exploitation for Client Execution","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1203","url":"https://attack.mitre.org/techniques/T1203"}]},{"type":"relationship","id":"relationship--18faff36-3103-5722-9ef9-81d1871f56e1","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"uses","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"attack-pattern--5bf681f3-d3ec-5c7e-9627-e4241d9c8ae9"},{"type":"location","id":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"China","country":"CN","region":"asia"},{"type":"relationship","id":"relationship--782e7d24-a01c-59c6-becb-650dbdb51180","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"targets","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"location--6cf74cdb-05d3-5c2b-87c0-28df42a33e96"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--350cb2bf-b9f8-5960-9c32-19d24663f090","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"targets","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--fd98b554-2d31-56db-8bc0-812e65009813","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Italy","country":"IT","region":"europe"},{"type":"relationship","id":"relationship--8ee3ade7-4f21-5c11-b4c0-fd6ff529d301","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"targets","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"location--fd98b554-2d31-56db-8bc0-812e65009813"},{"type":"location","id":"location--168ae1d8-d8eb-5440-9d21-d02292700adf","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Japan","country":"JP","region":"asia"},{"type":"relationship","id":"relationship--aa5b461d-472c-52d7-a8a4-4fdbc1473f24","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"targets","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"location--168ae1d8-d8eb-5440-9d21-d02292700adf"},{"type":"location","id":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"South Korea","country":"KR","region":"asia"},{"type":"relationship","id":"relationship--262ac914-ba71-5f46-a52a-87ccc7b989a1","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"targets","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"location--e65fe67e-b17f-5bb9-b32c-402d6a5aa451"},{"type":"location","id":"location--e6a15e3d-a6f4-57b1-8ecb-a2a326fbe2f4","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Mongolia","country":"MN","region":"asia"},{"type":"relationship","id":"relationship--f0da166b-c85c-54aa-b457-39445f0e00a9","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"targets","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"location--e6a15e3d-a6f4-57b1-8ecb-a2a326fbe2f4"},{"type":"location","id":"location--63d812be-f70d-560d-a8a2-032ed1026b7c","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Peru","country":"PE","region":"americas"},{"type":"relationship","id":"relationship--cbba06aa-84e0-59ff-9cb3-d6e76b30d016","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"targets","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"location--63d812be-f70d-560d-a8a2-032ed1026b7c"},{"type":"location","id":"location--657f368a-bd77-5f31-84cf-340236190da3","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Russia","country":"RU","region":"europe"},{"type":"relationship","id":"relationship--9ee99240-373e-5965-9921-e63a7336e3b2","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"targets","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"location--657f368a-bd77-5f31-84cf-340236190da3"},{"type":"location","id":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Türkiye","country":"TR","region":"asia"},{"type":"relationship","id":"relationship--7b8c2ab2-ee36-574d-91b6-291830863aab","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"targets","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"location--45a794f0-2f7e-56ca-84fe-cc3888e36fbe"},{"type":"location","id":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","name":"Ukraine","country":"UA","region":"europe"},{"type":"relationship","id":"relationship--c60667b7-bb59-59ee-b0a6-48b3d959338f","spec_version":"2.1","created":"2026-05-20T09:52:28.845185+00:00","modified":"2026-07-29T08:59:25.848+00:00","relationship_type":"targets","source_ref":"intrusion-set--8bbacc5d-bbc4-5dae-a48b-c96e71c11ea5","target_ref":"location--2726446a-ddde-58f1-8c9f-cf66fe6fc18f"}]}