{"type":"bundle","id":"bundle--14ada731-55da-5b96-a7f4-56c85d363f89","objects":[{"type":"intrusion-set","id":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"UNC1543","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/unc1543"}],"labels":["cybercrime","fin"]},{"type":"attack-pattern","id":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Match Legitimate Resource Name or Location","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1036.005","url":"https://attack.mitre.org/techniques/T1036/005"}]},{"type":"relationship","id":"relationship--f79db31e-b61f-51a2-8df7-3a4d289a2ae5","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"uses","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"attack-pattern--5d84feda-5716-51fa-87e4-3a24359fe7c1"},{"type":"attack-pattern","id":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Spearphishing Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566.002","url":"https://attack.mitre.org/techniques/T1566/002"}]},{"type":"relationship","id":"relationship--d42d4ed2-e629-5189-87e4-bffd6411651a","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"uses","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"attack-pattern--c2e3df13-b71e-5873-beb1-5d621be45acd"},{"type":"attack-pattern","id":"attack-pattern--d3bdd5ed-0eae-55ac-bf7f-b5e20f654648","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Server","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.004","url":"https://attack.mitre.org/techniques/T1583/004"}]},{"type":"relationship","id":"relationship--e13a8480-cbe0-5d86-ac8f-f1c55940ed03","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"uses","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"attack-pattern--d3bdd5ed-0eae-55ac-bf7f-b5e20f654648"},{"type":"attack-pattern","id":"attack-pattern--f4c4e111-8d48-55b6-8183-b9932b53e6c8","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Malvertising","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1583.008","url":"https://attack.mitre.org/techniques/T1583/008"}]},{"type":"relationship","id":"relationship--6092ac6d-5776-5f6f-9294-706164041949","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"uses","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"attack-pattern--f4c4e111-8d48-55b6-8183-b9932b53e6c8"},{"type":"attack-pattern","id":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Drive-by Compromise","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1189","url":"https://attack.mitre.org/techniques/T1189"}]},{"type":"relationship","id":"relationship--d1c32dd9-3d5e-5b84-9767-8c68e6b6f9d4","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"uses","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"attack-pattern--512d8208-66a2-5f60-8683-ce6555aa98fd"},{"type":"attack-pattern","id":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Malicious Link","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Execution"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1204.001","url":"https://attack.mitre.org/techniques/T1204/001"}]},{"type":"relationship","id":"relationship--658ade81-e572-523a-a38e-27e350c8a346","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"uses","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"attack-pattern--750af5f9-b87c-54e9-8254-be340a29a8cc"},{"type":"attack-pattern","id":"attack-pattern--85abd10a-d356-574c-a7a2-8284da52ffa3","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"SEO Poisoning","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Resource Development"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1608.006","url":"https://attack.mitre.org/techniques/T1608/006"}]},{"type":"relationship","id":"relationship--a164aa6a-be37-5226-8d92-f4f4cc0a4d62","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"uses","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"attack-pattern--85abd10a-d356-574c-a7a2-8284da52ffa3"},{"type":"attack-pattern","id":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Ingress Tool Transfer","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1105","url":"https://attack.mitre.org/techniques/T1105"}]},{"type":"relationship","id":"relationship--80a17fde-91ac-5493-bc15-269cf5760452","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"uses","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"attack-pattern--34c30c2c-82c9-5065-a995-6cab07ee655a"},{"type":"location","id":"location--1375b154-0a19-561b-b92a-50fd99cbdd99","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"United Arab Emirates","country":"AE","region":"asia"},{"type":"relationship","id":"relationship--3aa9b693-eb42-59a3-ac07-31bb54022c76","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--1375b154-0a19-561b-b92a-50fd99cbdd99"},{"type":"location","id":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Austria","country":"AT","region":"europe"},{"type":"relationship","id":"relationship--4a9c1309-9f83-5a64-bfad-3670e92b42cf","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--8c2bc2e0-62b9-53f4-aaa8-b8b8b4bcfb25"},{"type":"location","id":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Australia","country":"AU","region":"oceania"},{"type":"relationship","id":"relationship--9f9471c5-ee95-5896-acb4-94ca3f744cbe","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--0375fcf1-94fe-5ba0-b36d-c031719c346a"},{"type":"location","id":"location--df32d83f-5f4c-5118-a126-3f5c603db260","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Canada","country":"CA","region":"americas"},{"type":"relationship","id":"relationship--1e87dbc3-d51d-562d-8b7b-9adc57c21dae","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--df32d83f-5f4c-5118-a126-3f5c603db260"},{"type":"location","id":"location--28c31ddb-f375-5682-8697-e338a5f5d82f","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Switzerland","country":"CH","region":"europe"},{"type":"relationship","id":"relationship--6328b34a-bab2-5b37-b705-6a4afdf0b497","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--28c31ddb-f375-5682-8697-e338a5f5d82f"},{"type":"location","id":"location--d8f97962-e60f-580e-80c7-bb324614e41b","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Colombia","country":"CO","region":"americas"},{"type":"relationship","id":"relationship--ee65057f-5c86-5e81-84b6-0d3d39a1d2ac","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--d8f97962-e60f-580e-80c7-bb324614e41b"},{"type":"location","id":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Germany","country":"DE","region":"europe"},{"type":"relationship","id":"relationship--0d1cb6e9-e29b-568f-af11-eef9e9320e5f","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--7106d5fc-d11b-55da-9a5d-9e28f41d33da"},{"type":"location","id":"location--bb45582d-2e27-5828-aa2f-343b24630f35","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Denmark","country":"DK","region":"europe"},{"type":"relationship","id":"relationship--f606665b-e2cc-5d95-b7d8-c137eb624f52","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--bb45582d-2e27-5828-aa2f-343b24630f35"},{"type":"location","id":"location--a41caef2-fe04-5da5-bc82-ec135954366c","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"France","country":"FR","region":"europe"},{"type":"relationship","id":"relationship--062840d2-d4a6-5d86-944f-08fed9883fe4","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--a41caef2-fe04-5da5-bc82-ec135954366c"},{"type":"location","id":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"United Kingdom","country":"GB","region":"europe"},{"type":"relationship","id":"relationship--46a5d109-bb7a-5e26-b367-ffe842e92b3b","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--8b47490b-4c54-523d-a7bf-f8a265db7aa6"},{"type":"location","id":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Hong Kong","country":"HK","region":"asia"},{"type":"relationship","id":"relationship--ac717ec5-02e1-5f90-874b-45331bd70b8e","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--8030edcd-9ba7-51a8-ace6-6cfff266d6ff"},{"type":"location","id":"location--760995dc-62de-5ef6-9bc7-faf52bf1b952","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Ireland","country":"IE","region":"europe"},{"type":"relationship","id":"relationship--1d93717e-183b-57ac-866e-a6c44bfd99da","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--760995dc-62de-5ef6-9bc7-faf52bf1b952"},{"type":"location","id":"location--a010f9b5-f121-5125-a684-6dd58c48d368","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Israel","country":"IL","region":"asia"},{"type":"relationship","id":"relationship--4b7e3dd5-c626-558e-9c22-4bc74ab697c0","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--a010f9b5-f121-5125-a684-6dd58c48d368"},{"type":"location","id":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"India","country":"IN","region":"asia"},{"type":"relationship","id":"relationship--96251d8c-141a-51de-a1cc-211d90e89210","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--6e5b4c5e-7bd4-57d1-b1ea-657b1891ea82"},{"type":"location","id":"location--fd98b554-2d31-56db-8bc0-812e65009813","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Italy","country":"IT","region":"europe"},{"type":"relationship","id":"relationship--5e8bf142-164c-5c01-ad0a-d85c4902a9d4","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--fd98b554-2d31-56db-8bc0-812e65009813"},{"type":"location","id":"location--1faaca57-40f6-50ab-bfaa-f6975424db9a","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Luxembourg","country":"LU","region":"europe"},{"type":"relationship","id":"relationship--f1f43b5e-5058-515e-83ea-a40487da4ac8","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--1faaca57-40f6-50ab-bfaa-f6975424db9a"},{"type":"location","id":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Philippines","country":"PH","region":"asia"},{"type":"relationship","id":"relationship--a81f52f1-873c-56b2-9147-3a78b1e2eb1d","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--7588a13c-1acb-50cb-80b0-1ecfe3aba822"},{"type":"location","id":"location--64282129-6afb-5607-8988-27d394389a0e","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Sweden","country":"SE","region":"europe"},{"type":"relationship","id":"relationship--f8c10930-39c9-54e6-bc6b-e6afe4d13def","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--64282129-6afb-5607-8988-27d394389a0e"},{"type":"location","id":"location--9f915047-365b-5d02-ac33-38528c38eb92","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Singapore","country":"SG","region":"asia"},{"type":"relationship","id":"relationship--90584c06-bad9-5c0a-87c5-221f530d3f3e","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--9f915047-365b-5d02-ac33-38528c38eb92"},{"type":"location","id":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"Thailand","country":"TH","region":"asia"},{"type":"relationship","id":"relationship--15092847-743d-5b30-a958-ef0eb72ae11e","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--d2b5c59b-8465-529f-8f9c-77d033ed8186"},{"type":"location","id":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"United States","country":"US","region":"americas"},{"type":"relationship","id":"relationship--d9ab641e-e47c-53a3-9cb4-c8d6ad426ca7","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--ea514d88-d8fb-51d8-9162-c666a0ebd505"},{"type":"location","id":"location--6a5fb4e5-83ad-5007-b5fc-c682a5a9c285","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","name":"South Africa","country":"ZA","region":"africa"},{"type":"relationship","id":"relationship--9c734b7e-87ed-5255-a68c-e356bee77a7c","spec_version":"2.1","created":"2026-05-20T09:50:40.815018+00:00","modified":"2026-05-20T09:50:40.815018+00:00","relationship_type":"targets","source_ref":"intrusion-set--889dab8a-0906-5760-a49f-be59400fcc6c","target_ref":"location--6a5fb4e5-83ad-5007-b5fc-c682a5a9c285"}]}