{
  "type": "bundle",
  "id": "bundle--bc8c8dec-9a5c-5837-ac61-10ab1d5b695a",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "name": "BRONZE STARLIGHT",
      "aliases": [
        "BRONZE STARLIGHT",
        "SLIME34",
        "DEV-0401",
        "Cinnamon Tempest",
        "Emperor Dragonfly"
      ],
      "description": "BRONZE STARLIGHT has been active since mid 2021 and targets organizations globally across a range of industry verticals. The group leverages HUI Loader to load Cobalt Strike and PlugX payloads for command and control. CTU researchers have observed BRONZE STARLIGHT deploying ransomware to compromised networks as part of name-and-shame ransomware schemes, and posted victim names to leak sites. \nCTU researchers assess with moderate confidence that BRONZE STARLIGHT is located in China based on observed tradecraft, including the use of HUI Loader and PlugX which are associated with China-based threat group activity. It is plausible that BRONZE STARLIGHT deploys ransomware as a smokescreen rather than for financial gain, with the underlying motivation of stealing intellectual property theft or conducting espionage.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G1021",
          "url": "https://attack.mitre.org/groups/G1021/"
        },
        {
          "source_name": "skopnix",
          "external_id": "bronze-starlight",
          "url": "https://skopnix.com/actors/bronze-starlight"
        },
        {
          "source_name": "i.blackhat.com",
          "url": "https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Li-To-Loot-Or-Not-To-Loot-That-Is-Not-a-Question.pdf"
        },
        {
          "source_name": "microsoft.com",
          "url": "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself"
        },
        {
          "source_name": "microsoft.com",
          "url": "https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation"
        },
        {
          "source_name": "sentinelone.com",
          "url": "https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility"
        },
        {
          "source_name": "twitter.com",
          "url": "https://twitter.com/cglyer/status/1480734487000453121"
        },
        {
          "source_name": "blog.sygnia.co",
          "url": "https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"
        },
        {
          "source_name": "sentinelone.com",
          "url": "https://www.sentinelone.com/labs/chinese-entanglement-dll-hijacking-in-the-asian-gambling-sector/"
        },
        {
          "source_name": "microsoft.com",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G1021"
        },
        {
          "source_name": "trendmicro.com",
          "url": "https://www.trendmicro.com/en_se/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html"
        },
        {
          "source_name": "learn.microsoft.com",
          "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/research/threat-profiles/bronze-starlight"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00",
      "name": "Tool",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1588.002",
          "url": "https://attack.mitre.org/techniques/T1588/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9",
      "name": "Exploit Public-Facing Application",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1190",
          "url": "https://attack.mitre.org/techniques/T1190/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5",
      "name": "Windows Management Instrumentation",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1047",
          "url": "https://attack.mitre.org/techniques/T1047/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16",
      "name": "PowerShell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.001",
          "url": "https://attack.mitre.org/techniques/T1059/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de",
      "name": "Windows Command Shell",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.003",
          "url": "https://attack.mitre.org/techniques/T1059/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e2b3e980-426a-5fb8-a98a-fa88e7e77eba",
      "name": "Python",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1059.006",
          "url": "https://attack.mitre.org/techniques/T1059/006/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c",
      "name": "Windows Service",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1543.003",
          "url": "https://attack.mitre.org/techniques/T1543/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9",
      "name": "Valid Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1078",
          "url": "https://attack.mitre.org/techniques/T1078/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--09e454f2-37db-5719-8971-07ed738d98e2",
      "name": "Domain Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1078.002",
          "url": "https://attack.mitre.org/techniques/T1078/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--4b969def-2fff-5bb3-8343-f00548d349d4",
      "name": "Deobfuscate/Decode Files or Information",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1140",
          "url": "https://attack.mitre.org/techniques/T1140/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bff38174-edab-539a-8e2c-9af52e5810d5",
      "name": "DLL",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1574.001",
          "url": "https://attack.mitre.org/techniques/T1574/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee",
      "name": "SMB/Windows Admin Shares",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1021.002",
          "url": "https://attack.mitre.org/techniques/T1021/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "lateral-movement"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--abb3508c-671d-5395-aea1-0fe5ff439c14",
      "name": "Taint Shared Content",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1080",
          "url": "https://attack.mitre.org/techniques/T1080/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "lateral-movement"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bd7954c9-4bdd-501a-ba9c-f186878ac084",
      "name": "Proxy",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1090",
          "url": "https://attack.mitre.org/techniques/T1090/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7",
      "name": "Ingress Tool Transfer",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1105",
          "url": "https://attack.mitre.org/techniques/T1105/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3187b140-2007-54dd-a9c9-d1779bdc9e5b",
      "name": "Protocol Tunneling",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1572",
          "url": "https://attack.mitre.org/techniques/T1572/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374",
      "name": "Exfiltration to Cloud Storage",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1567.002",
          "url": "https://attack.mitre.org/techniques/T1567/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "exfiltration"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--9593f143-6845-5387-b32d-755e7a322c33",
      "name": "Group Policy Modification",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1484.001",
          "url": "https://attack.mitre.org/techniques/T1484/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-impairment"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b",
      "name": "Financial Theft",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1657",
          "url": "https://attack.mitre.org/techniques/T1657/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "impact"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--9a75520c-7922-5485-9b25-b4e1cbd144a0",
      "name": "Pandora",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0664",
          "url": "https://attack.mitre.org/software/S0664/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--63894d01-623f-535a-88c3-7a6dd3a5784d",
      "name": "PlugX",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0013",
          "url": "https://attack.mitre.org/software/S0013/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--18d670d1-de71-5bf3-a8d9-5332f3a3bd32",
      "name": "Cheerscrypt",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1096",
          "url": "https://attack.mitre.org/software/S1096/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--77b6cfdd-dfb4-5235-99b5-e1fd508f07c6",
      "name": "Cobalt Strike",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0154",
          "url": "https://attack.mitre.org/software/S0154/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--6ca6275e-ee96-55ff-ab0d-204314b36a08",
      "name": "HUI Loader",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1097",
          "url": "https://attack.mitre.org/software/S1097/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--387ec776-926f-532f-bde6-2a3515615fc7",
      "name": "Sliver",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0633",
          "url": "https://attack.mitre.org/software/S0633/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--c193b7fb-278e-5bd8-bdf0-cf5742e85be8",
      "name": "Impacket",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0357",
          "url": "https://attack.mitre.org/software/S0357/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--adb71aeb-77a9-581d-9060-7a3a82d271a1",
      "name": "Rclone",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1040",
          "url": "https://attack.mitre.org/software/S1040/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--158035b1-7161-58b6-bdf6-6b33d0a793b9",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0fafee17-253d-59c0-ae1b-0035169041a4",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--e4d61281-53b2-54b0-b3dd-1bad38b949d9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--7dd6888a-ee17-5afa-bf1f-69097dc57716",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--067f0642-1cfd-5978-9286-24de16df2ca5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6af2cc00-ab4d-51a9-be86-a2266ba9aeef",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--cb1904b4-6302-55f3-8c98-268cb585da16"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1815fc5f-0fd0-5b97-b7bf-734f383cac9a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--111cc564-56b3-5368-8b57-092f566fe2de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4aac9ea1-b026-5a47-9b23-9b9903795471",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--e2b3e980-426a-5fb8-a98a-fa88e7e77eba"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8117a13e-24a4-5ce5-aa83-4a661c076d89",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--2ba414cf-b463-54eb-be73-1bb489721ee1",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b6b67376-b765-56ab-b9c0-1f8ac8c533f0",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--09e454f2-37db-5719-8971-07ed738d98e2"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--83816e84-ce67-512c-a1fd-bd1019614e98",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--4b969def-2fff-5bb3-8343-f00548d349d4"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3e4cb618-d42e-5206-8c7b-dffe4d422da1",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--bff38174-edab-539a-8e2c-9af52e5810d5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--83e0aa3c-117c-552a-8628-0782c19eda65",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5ac2a70c-5f5e-5c41-9bf2-0e9a9db7511d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--abb3508c-671d-5395-aea1-0fe5ff439c14"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--2dde7266-d689-5e93-8138-e6dad0cebe88",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--bd7954c9-4bdd-501a-ba9c-f186878ac084"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ec24163a-d6fc-5188-b9af-cca6c54625e4",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6010fc2f-f7f5-5c4d-9370-1e0bec410199",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--3187b140-2007-54dd-a9c9-d1779bdc9e5b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--2015ce33-1e20-5ed3-a63b-da64873bb43b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--40ef31c0-8d8b-56d0-a6ef-fa75ec4d4374"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--bfe5dde5-ae92-52e8-b2b8-cbc4c6e3f1b4",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--9593f143-6845-5387-b32d-755e7a322c33"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--dc132b75-7cd6-5d6f-862d-a59b86dc4e64",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c9d1a20c-a66e-5178-b1fc-cec8273512e3",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "malware--9a75520c-7922-5485-9b25-b4e1cbd144a0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--91ecd79a-12b6-54ef-a504-3ae7a086f397",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "malware--63894d01-623f-535a-88c3-7a6dd3a5784d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a60eaea1-87c2-59b7-a73e-6282072ecece",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "malware--18d670d1-de71-5bf3-a8d9-5332f3a3bd32"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--be558a1b-f625-524e-9de0-07b44a35a6bd",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "malware--77b6cfdd-dfb4-5235-99b5-e1fd508f07c6"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4be63e66-af28-5149-80d1-daf3f380eee4",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "malware--6ca6275e-ee96-55ff-ab0d-204314b36a08"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ea4053f1-95d1-556e-823c-02783ceb7f5f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "tool--387ec776-926f-532f-bde6-2a3515615fc7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e9ef2d40-c974-5b99-adef-daa1da613fc5",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "tool--c193b7fb-278e-5bd8-bdf0-cf5742e85be8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6506d4f6-ac9b-51b5-b811-6c09d5ce22e3",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--d68393e7-0696-5f97-a138-27107ec74916",
      "target_ref": "tool--adb71aeb-77a9-581d-9060-7a3a82d271a1"
    }
  ]
}