{
  "type": "bundle",
  "id": "bundle--e573cc97-8836-588b-ba61-bd93a996fa18",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--92ddbe5c-3b46-5dc3-8b5c-ffdbb53410d8",
      "name": "FIN7",
      "aliases": [
        "FIN7",
        "CARBON SPIDER",
        "GOLD NIAGARA",
        "Calcium",
        "ATK32",
        "Coreid",
        "Carbanak",
        "Sangria Tempest",
        "ELBRUS",
        "JokerStash",
        "WILD COMET",
        "ITG14",
        "Anunak"
      ],
      "description": "Groups targeting financial organizations or people with significant financial assets.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G0008",
          "url": "https://attack.mitre.org/groups/G0008/"
        },
        {
          "source_name": "skopnix",
          "external_id": "fin7",
          "url": "https://skopnix.com/actors/fin7"
        },
        {
          "source_name": "en.wikipedia.org",
          "url": "https://en.wikipedia.org/wiki/Carbanak"
        },
        {
          "source_name": "app.box.com",
          "url": "https://app.box.com/s/p7qzcury97tuwk26694uutujwqmwqyhe"
        },
        {
          "source_name": "2014.zeronights.ru",
          "url": "http://2014.zeronights.ru/assets/files/slides/ivanovb-zeronights.pdf"
        },
        {
          "source_name": "web.archive.org",
          "url": "https://web.archive.org/web/20161223002016/https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks"
        },
        {
          "source_name": "proofpoint.com",
          "url": "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
        },
        {
          "source_name": "icebrg.io",
          "url": "https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns"
        },
        {
          "source_name": "crowdstrike.com",
          "url": "https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/"
        },
        {
          "source_name": "europol.europa.eu",
          "url": "https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain"
        },
        {
          "source_name": "computerweekly.com",
          "url": "https://www.computerweekly.com/news/252446153/Three-Carbanak-cyber-heist-gang-members-arrested"
        },
        {
          "source_name": "media.kasperskycontenthub.com",
          "url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"
        },
        {
          "source_name": "group-ib.com",
          "url": "https://www.group-ib.com/resources/threat-research/Anunak_APT_against_financial_institutions.pdf"
        },
        {
          "source_name": "fireeye.com",
          "url": "https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html"
        },
        {
          "source_name": "threatpost.com",
          "url": "https://threatpost.com/fileless-malware-campaigns-tied-to-same-attacker/124369/"
        },
        {
          "source_name": "fireeye.com",
          "url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
        },
        {
          "source_name": "fireeye.com",
          "url": "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html"
        },
        {
          "source_name": "blog.morphisec.com",
          "url": "https://blog.morphisec.com/fin7-attacks-restaurant-industry"
        },
        {
          "source_name": "flashpoint-intel.com",
          "url": "https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"
        },
        {
          "source_name": "blog.morphisec.com",
          "url": "https://blog.morphisec.com/fin7-attack-modifications-revealed"
        },
        {
          "source_name": "blog.morphisec.com",
          "url": "https://blog.morphisec.com/fin7-not-finished-morphisec-spots-new-campaign"
        },
        {
          "source_name": "securelist.com",
          "url": "https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/"
        },
        {
          "source_name": "fireeye.com",
          "url": "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0046/"
        },
        {
          "source_name": "go.crowdstrike.com",
          "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
        },
        {
          "source_name": "threatintel.blog",
          "url": "https://threatintel.blog/OPBlueRaven-Part1/"
        },
        {
          "source_name": "threatintel.blog",
          "url": "https://threatintel.blog/OPBlueRaven-Part2/"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/research/threat-profiles/gold-niagara"
        },
        {
          "source_name": "computerweekly.com",
          "url": "https://www.computerweekly.com/news/252525240/ALPHV-BlackCat-ransomware-family-becoming-more-dangerous"
        },
        {
          "source_name": "deepinstinct.com",
          "url": "https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape"
        },
        {
          "source_name": "microsoft.com",
          "url": "https://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/"
        },
        {
          "source_name": "wired.com",
          "url": "https://www.wired.com/story/fin7-carbanak-hacking-group-behind-a-string-of-big-breaches/"
        },
        {
          "source_name": "cloud.google.com",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0046"
        },
        {
          "source_name": "mandiant.com",
          "url": "https://www.mandiant.com/resources/evolution-of-fin7"
        },
        {
          "source_name": "fireeye.com",
          "url": "https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"
        },
        {
          "source_name": "bi-zone.medium.com",
          "url": "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0008"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/research/threat-profiles/gold-kingswood?filter=item-financial-gain"
        },
        {
          "source_name": "fox-it.com",
          "url": "https://www.fox-it.com/en/news/blog/anunak-aka-carbanak-update/"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00",
      "name": "Tool",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1588.002",
          "url": "https://attack.mitre.org/techniques/T1588/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c",
      "name": "Windows Service",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1543.003",
          "url": "https://attack.mitre.org/techniques/T1543/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7c173797-2d12-5fd3-9f00-104c2ff30c48",
      "name": "Masquerade Task or Service",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036.004",
          "url": "https://attack.mitre.org/techniques/T1036/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db",
      "name": "Match Legitimate Resource Name or Location",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1036.005",
          "url": "https://attack.mitre.org/techniques/T1036/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9",
      "name": "Valid Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1078",
          "url": "https://attack.mitre.org/techniques/T1078/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--0303fe9f-35de-5bc4-ae07-7ef0f51ab40a",
      "name": "Rundll32",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1218.011",
          "url": "https://attack.mitre.org/techniques/T1218/011/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--08cdeba8-d849-5e73-81eb-b47b226c1f7e",
      "name": "Bidirectional Communication",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1102.002",
          "url": "https://attack.mitre.org/techniques/T1102/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--0b9ccf3b-0528-5fb4-9569-579389b7b541",
      "name": "Remote Access Tools",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1219",
          "url": "https://attack.mitre.org/techniques/T1219/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--0fa14b7c-2630-5249-be53-f3d040057e57",
      "name": "Disable or Modify System Firewall",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1686",
          "url": "https://attack.mitre.org/techniques/T1686/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "defense-impairment"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--9342a4de-d798-5736-ab5a-1569bd320cac",
      "name": "Carbanak",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0030",
          "url": "https://attack.mitre.org/software/S0030/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b",
      "name": "Mimikatz",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0002",
          "url": "https://attack.mitre.org/software/S0002/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--f5609300-bc14-52af-92f9-0f1315aabef6",
      "name": "PsExec",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0029",
          "url": "https://attack.mitre.org/software/S0029/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--1f8aecfa-a763-5d41-8858-f664f76735b9",
      "name": "netsh",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0108",
          "url": "https://attack.mitre.org/software/S0108/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--56dceef2-ba4f-5d62-85a9-305bc1fe4013",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--92ddbe5c-3b46-5dc3-8b5c-ffdbb53410d8",
      "target_ref": "attack-pattern--be6b06f6-2757-56ad-8d53-c6ac3118fa00"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a0176ef2-877e-5eb3-b906-77e38518e7bd",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--92ddbe5c-3b46-5dc3-8b5c-ffdbb53410d8",
      "target_ref": "attack-pattern--d6564283-cb2e-5245-962e-31a883b2656c"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a82fca6c-c50f-5c2b-9b66-074a2497fa65",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--92ddbe5c-3b46-5dc3-8b5c-ffdbb53410d8",
      "target_ref": "attack-pattern--7c173797-2d12-5fd3-9f00-104c2ff30c48"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--2c3ca693-4251-5bdf-8aeb-6b931f025259",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--92ddbe5c-3b46-5dc3-8b5c-ffdbb53410d8",
      "target_ref": "attack-pattern--38c56b01-4c61-5ed2-a4aa-bbc3328c26db"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6095e9d5-407f-5c4e-af4a-9d55e7f4779d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--92ddbe5c-3b46-5dc3-8b5c-ffdbb53410d8",
      "target_ref": "attack-pattern--d63b884f-c324-51f9-ac6c-587c8063f3a9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b75700e7-ba7d-52db-858d-3e8adcaea10b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--92ddbe5c-3b46-5dc3-8b5c-ffdbb53410d8",
      "target_ref": "attack-pattern--0303fe9f-35de-5bc4-ae07-7ef0f51ab40a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--0f75afdb-c5a4-5a85-95e5-1c8264c63e81",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--92ddbe5c-3b46-5dc3-8b5c-ffdbb53410d8",
      "target_ref": "attack-pattern--08cdeba8-d849-5e73-81eb-b47b226c1f7e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ec3a6d4c-a423-5fc1-a35c-4d8ddc9455b5",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--92ddbe5c-3b46-5dc3-8b5c-ffdbb53410d8",
      "target_ref": "attack-pattern--0b9ccf3b-0528-5fb4-9569-579389b7b541"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--32c830b4-3698-588b-95f8-da056ddd97f0",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--92ddbe5c-3b46-5dc3-8b5c-ffdbb53410d8",
      "target_ref": "attack-pattern--0fa14b7c-2630-5249-be53-f3d040057e57"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6f8573fd-b962-514e-8d98-f27a337dc7e9",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--92ddbe5c-3b46-5dc3-8b5c-ffdbb53410d8",
      "target_ref": "malware--9342a4de-d798-5736-ab5a-1569bd320cac"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--047d08e0-b8f8-53e2-976e-10e4feed2a01",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--92ddbe5c-3b46-5dc3-8b5c-ffdbb53410d8",
      "target_ref": "tool--c3bed45a-e5cf-58e1-93d5-76905668062b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e89afc9f-d1bf-5a36-aa4d-e78b143daf2d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--92ddbe5c-3b46-5dc3-8b5c-ffdbb53410d8",
      "target_ref": "tool--f5609300-bc14-52af-92f9-0f1315aabef6"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b207078f-a17a-5168-b291-699dd1bf6fa1",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--92ddbe5c-3b46-5dc3-8b5c-ffdbb53410d8",
      "target_ref": "tool--1f8aecfa-a763-5d41-8858-f664f76735b9"
    }
  ]
}