{"type":"bundle","id":"bundle--b465efea-8323-5019-bcd1-9bd8b8a693c8","objects":[{"type":"intrusion-set","id":"intrusion-set--6cd235f9-83d0-5d53-9721-d02f0370d0a2","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","name":"UNC28","description":"UNC28 is a Chinese state-sponsored advanced persistent threat (APT) group tracked by Mandiant, assessed to conduct cyber espionage operations in support of Chinese government intelligence objectives. The group focuses on intelligence gathering activities, leveraging sophisticated intrusion techniques to gain unauthorized access to targeted networks and exfiltrate sensitive information. Their targeting profile aligns with broader Chinese strategic interests, likely focusing on government, defense, technology, or other sectors of geopolitical significance, though specific victim verticals remain limited in open-source reporting.","external_references":[{"source_name":"APT Atlas","url":"https://aptatlas.net/actors/unc28"}],"labels":["nation-state","esp"]},{"type":"attack-pattern","id":"attack-pattern--183774af-4c33-54de-8d3d-aaf04646d481","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","name":"Phishing","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1566","url":"https://attack.mitre.org/techniques/T1566"}]},{"type":"relationship","id":"relationship--7ceb06cb-8466-5df9-b7ed-d38831fa1a60","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","relationship_type":"uses","source_ref":"intrusion-set--6cd235f9-83d0-5d53-9721-d02f0370d0a2","target_ref":"attack-pattern--183774af-4c33-54de-8d3d-aaf04646d481"},{"type":"attack-pattern","id":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","name":"Exploit Public-Facing Application","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Initial Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190"}]},{"type":"relationship","id":"relationship--17f29102-f041-520c-ba81-2a34cb2769de","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","relationship_type":"uses","source_ref":"intrusion-set--6cd235f9-83d0-5d53-9721-d02f0370d0a2","target_ref":"attack-pattern--af84ab0b-3cda-55c1-bc74-37df3090ab1b"},{"type":"attack-pattern","id":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","name":"Exfiltration Over C2 Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Exfiltration"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1041","url":"https://attack.mitre.org/techniques/T1041"}]},{"type":"relationship","id":"relationship--df1d2c7a-ebee-57ef-8732-2c0a531b29f5","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","relationship_type":"uses","source_ref":"intrusion-set--6cd235f9-83d0-5d53-9721-d02f0370d0a2","target_ref":"attack-pattern--1ba07102-97a3-5123-afeb-4a6b98b42d7d"},{"type":"attack-pattern","id":"attack-pattern--f8b681a6-c01a-53c9-a3b0-83ea21e8823b","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","name":"Application Layer Protocol","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1071","url":"https://attack.mitre.org/techniques/T1071"}]},{"type":"relationship","id":"relationship--93b7bc6d-8d58-5b9e-a7aa-695b7ea0fab8","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","relationship_type":"uses","source_ref":"intrusion-set--6cd235f9-83d0-5d53-9721-d02f0370d0a2","target_ref":"attack-pattern--f8b681a6-c01a-53c9-a3b0-83ea21e8823b"},{"type":"attack-pattern","id":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","name":"Obfuscated Files or Information","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1027","url":"https://attack.mitre.org/techniques/T1027"}]},{"type":"relationship","id":"relationship--07bea79a-5234-557a-9c11-6cd0df56e95a","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","relationship_type":"uses","source_ref":"intrusion-set--6cd235f9-83d0-5d53-9721-d02f0370d0a2","target_ref":"attack-pattern--83bf6bd6-5ec5-5d2a-9ded-a83895020e8f"},{"type":"attack-pattern","id":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","name":"Data from Local System","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1005","url":"https://attack.mitre.org/techniques/T1005"}]},{"type":"relationship","id":"relationship--da0965fb-0e45-5ec6-9092-eb7aea728978","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","relationship_type":"uses","source_ref":"intrusion-set--6cd235f9-83d0-5d53-9721-d02f0370d0a2","target_ref":"attack-pattern--83208c41-e2b1-5fb5-927e-0a1ec6b2510e"},{"type":"attack-pattern","id":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","name":"Archive Collected Data","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Collection"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1560","url":"https://attack.mitre.org/techniques/T1560"}]},{"type":"relationship","id":"relationship--d2879864-43fc-5996-989b-d107797caaf5","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","relationship_type":"uses","source_ref":"intrusion-set--6cd235f9-83d0-5d53-9721-d02f0370d0a2","target_ref":"attack-pattern--c1f4b0ff-b46f-56bd-85dc-c061fa945b80"},{"type":"attack-pattern","id":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","name":"Valid Accounts","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Stealth"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1078","url":"https://attack.mitre.org/techniques/T1078"}]},{"type":"relationship","id":"relationship--32cd7cef-eb47-5c97-bdd2-14de6daaad05","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","relationship_type":"uses","source_ref":"intrusion-set--6cd235f9-83d0-5d53-9721-d02f0370d0a2","target_ref":"attack-pattern--f36f588d-b22c-54e9-80cb-493b50db1b53"},{"type":"attack-pattern","id":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","name":"OS Credential Dumping","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Credential Access"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1003","url":"https://attack.mitre.org/techniques/T1003"}]},{"type":"relationship","id":"relationship--5e52711f-8f7b-598e-85fe-91ad8c61a3c6","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","relationship_type":"uses","source_ref":"intrusion-set--6cd235f9-83d0-5d53-9721-d02f0370d0a2","target_ref":"attack-pattern--a809c9d8-8111-55c2-bac8-9c7a54c72e56"},{"type":"attack-pattern","id":"attack-pattern--112fb2d7-85f2-528f-98b7-c446712039b6","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","name":"Encrypted Channel","kill_chain_phases":[{"kill_chain_name":"mitre-attack","phase_name":"Command And Control"}],"external_references":[{"source_name":"mitre-attack","external_id":"T1573","url":"https://attack.mitre.org/techniques/T1573"}]},{"type":"relationship","id":"relationship--fa677174-6331-5151-a6e0-020fb2366f4a","spec_version":"2.1","created":"2026-05-20T09:50:22.714242+00:00","modified":"2026-05-20T11:23:46.153+00:00","relationship_type":"uses","source_ref":"intrusion-set--6cd235f9-83d0-5d53-9721-d02f0370d0a2","target_ref":"attack-pattern--112fb2d7-85f2-528f-98b7-c446712039b6"}]}