{
  "type": "bundle",
  "id": "bundle--64d37a61-3ecf-5acb-8b5e-f6254d4dc2e8",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--c3f98294-bcfd-56c5-a27a-bdbf737b2ac0",
      "name": "APT16",
      "aliases": [
        "APT16",
        "SVCMONDR"
      ],
      "description": "Between November 26, 2015, and December 1, 2015, known and suspected China-based APT groups launched several spear-phishing attacks targeting Japanese and Taiwanese organizations in the high-tech, government services, media and financial services industries. Each campaign delivered a malicious Microsoft Word document exploiting the aforementioned EPS dict copy use-after-free vulnerability, and the local Windows privilege escalation vulnerability CVE-2015-1701. The successful exploitation of both vulnerabilities led to the delivery of either a downloader that we refer to as IRONHALO, or a backdoor that we refer to as ELMER.",
      "resource_level": "government",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G0023",
          "url": "https://attack.mitre.org/groups/G0023/"
        },
        {
          "source_name": "skopnix",
          "external_id": "apt16",
          "url": "https://skopnix.com/actors/apt16"
        },
        {
          "source_name": "fireeye.com",
          "url": "https://www.fireeye.com/blog/threat-research/2015/12/the_eps_awakens.html"
        },
        {
          "source_name": "cfr.org",
          "url": "https://www.cfr.org/interactive/cyber-operations/apt-16"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0023"
        },
        {
          "source_name": "mandiant.com",
          "url": "https://www.mandiant.com/resources/insights/apt-groups"
        },
        {
          "source_name": "securelist.com",
          "url": "https://securelist.com/analysis/publications/74828/cve-2015-2545-overview-of-current-threats/"
        },
        {
          "source_name": "web.archive.org",
          "url": "https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--793786fb-a825-51b3-9892-250a0c3ae630",
      "name": "Server",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1584.004",
          "url": "https://attack.mitre.org/techniques/T1584/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--e6e23b52-02f8-5a9a-be8b-177031828ce8",
      "name": "ELMER",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0064",
          "url": "https://attack.mitre.org/software/S0064/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--12f2362f-3312-57ed-8635-929ad637977c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--c3f98294-bcfd-56c5-a27a-bdbf737b2ac0",
      "target_ref": "attack-pattern--793786fb-a825-51b3-9892-250a0c3ae630"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f406a363-8db9-524f-934f-4ddaf71c80c4",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--c3f98294-bcfd-56c5-a27a-bdbf737b2ac0",
      "target_ref": "malware--e6e23b52-02f8-5a9a-be8b-177031828ce8"
    }
  ]
}