{
  "type": "bundle",
  "id": "bundle--ba19c217-c8f8-59e5-816c-df9cb96f1251",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "name": "EXOTIC LILY",
      "aliases": [
        "EXOTIC LILY",
        "DEV-0413"
      ],
      "description": "EXOTIC LILY is a resourceful, financially motivated group whose activities appear to be closely linked with data exfiltration and deployment of human-operated ransomware such as Conti and Diavol. In early September 2021, the group has been obeserved exploiting a 0day in Microsoft MSHTML (CVE-2021-40444). Investigation lead researchers to believe that they are an Initial Access Broker (IAB) who appear to be working with the Russian cyber crime gang known as FIN12 (Mandiant, FireEye) / WIZARD SPIDER (CrowdStrike). This threat actor deploys tactics, techniques and procedures (TTPs) that are traditionally associated with more targeted attacks, like spoofing companies and employees as a means of gaining trust of a targeted organization through email campaigns that are believed to be sent by real human operators using little-to-no automation. Additionally and rather uniquely, they leverage legitimate file-sharing services like WeTransfer, TransferNow and OneDrive to deliver the payload, namely BUMBLEEBEE and BAZARLOADER, further evading detection mechanisms. This level of human-interaction is rather unusual for cyber crime groups focused on mass scale operations.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G1011",
          "url": "https://attack.mitre.org/groups/G1011/"
        },
        {
          "source_name": "skopnix",
          "external_id": "exotic-lily",
          "url": "https://skopnix.com/actors/exotic-lily"
        },
        {
          "source_name": "microsoft.com",
          "url": "https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability"
        },
        {
          "source_name": "blog.google",
          "url": "https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G1011"
        },
        {
          "source_name": "blog.google",
          "url": "https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--8658f5fd-1e99-57c3-bc0e-68e33dd4ae8d",
      "name": "Email Addresses",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1589.002",
          "url": "https://attack.mitre.org/techniques/T1589/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e6198e93-7eb0-5e76-8a61-5eb70145d807",
      "name": "Social Media",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1593.001",
          "url": "https://attack.mitre.org/techniques/T1593/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--a565401d-9b88-5f91-b04a-675728b9f76f",
      "name": "Search Victim-Owned Websites",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1594",
          "url": "https://attack.mitre.org/techniques/T1594/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b4010243-f10a-5c1b-b297-c1155a216b06",
      "name": "Search Closed Sources",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1597",
          "url": "https://attack.mitre.org/techniques/T1597/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3",
      "name": "Domains",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583.001",
          "url": "https://attack.mitre.org/techniques/T1583/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d",
      "name": "Social Media Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1585.001",
          "url": "https://attack.mitre.org/techniques/T1585/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--904b9e3b-7d66-5d85-91f7-87d505c59a98",
      "name": "Email Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1585.002",
          "url": "https://attack.mitre.org/techniques/T1585/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--03041285-abc7-5836-9908-13316a674531",
      "name": "Upload Malware",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1608.001",
          "url": "https://attack.mitre.org/techniques/T1608/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9",
      "name": "Spearphishing Attachment",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566.001",
          "url": "https://attack.mitre.org/techniques/T1566/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--fecd1b8d-5fe0-5248-a6df-87781d283801",
      "name": "Spearphishing Link",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566.002",
          "url": "https://attack.mitre.org/techniques/T1566/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--af307f20-df58-58e9-873b-760eb62c1afd",
      "name": "Spearphishing via Service",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566.003",
          "url": "https://attack.mitre.org/techniques/T1566/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d",
      "name": "Exploitation for Client Execution",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1203",
          "url": "https://attack.mitre.org/techniques/T1203/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54",
      "name": "Malicious Link",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204.001",
          "url": "https://attack.mitre.org/techniques/T1204/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890",
      "name": "Malicious File",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204.002",
          "url": "https://attack.mitre.org/techniques/T1204/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--63a593e5-948e-5461-bf09-5e65f1705fa3",
      "name": "Web Service",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1102",
          "url": "https://attack.mitre.org/techniques/T1102/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--6d450a7b-f8a8-50e3-83b3-fdfe6279afb0",
      "name": "Bazar",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0534",
          "url": "https://attack.mitre.org/software/S0534/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--415cb7a2-8459-5202-8bbc-540c8189d912",
      "name": "Bumblebee",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1039",
          "url": "https://attack.mitre.org/software/S1039/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a10ad337-7fb4-58bf-baa5-4a78a48015ce",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "attack-pattern--8658f5fd-1e99-57c3-bc0e-68e33dd4ae8d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--7586ecd6-ce59-5047-9a33-2112384c35d0",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "attack-pattern--e6198e93-7eb0-5e76-8a61-5eb70145d807"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--27f5505b-ea2a-52b9-8f47-1779a41226ac",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "attack-pattern--a565401d-9b88-5f91-b04a-675728b9f76f"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a97966de-ffa4-508f-a387-3653a23e6b13",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "attack-pattern--b4010243-f10a-5c1b-b297-c1155a216b06"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--506c4782-7487-53f1-afd0-070ca5671469",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8fbb8df4-fd1c-5641-809a-87cd9dd04e15",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--eecbd1ae-d5d0-5528-9ae0-adf5f4f03616",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "attack-pattern--904b9e3b-7d66-5d85-91f7-87d505c59a98"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f0c31077-9220-53f3-8ecc-a89628e8dab6",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "attack-pattern--03041285-abc7-5836-9908-13316a674531"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4da9710e-8094-5859-93b5-ab59ac037aba",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4639425b-51b8-5778-ae67-9d7f9a03f34a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "attack-pattern--fecd1b8d-5fe0-5248-a6df-87781d283801"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c3584ff8-aba2-5af4-877f-844aac91364e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "attack-pattern--af307f20-df58-58e9-873b-760eb62c1afd"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--09bd1c01-8a86-50ce-9846-f55db374fd30",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--528c6403-9b52-5c74-944e-720c762f04c3",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "attack-pattern--e17c0174-ff05-5d6f-8998-b1f9cf9cdd54"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3922d71c-fde6-593f-a020-83e2a5fdd42f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--55102187-9ecd-50d9-8c20-6aa90076fc07",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "attack-pattern--63a593e5-948e-5461-bf09-5e65f1705fa3"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5cd196eb-1897-5c49-b302-f1b628241ddb",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "malware--6d450a7b-f8a8-50e3-83b3-fdfe6279afb0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--362dbd41-7833-5647-9170-56d2fa2e8296",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b58ece9-eb81-56c3-88b8-97095ac7f1f7",
      "target_ref": "malware--415cb7a2-8459-5202-8bbc-540c8189d912"
    }
  ]
}