{
  "type": "bundle",
  "id": "bundle--bc65e3bd-63cb-546b-8448-f521796da5f3",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "name": "Lazarus Group",
      "aliases": [
        "Lazarus Group",
        "Operation DarkSeoul",
        "Dark Seoul",
        "Hidden Cobra",
        "Hastati Group",
        "Andariel",
        "Unit 121",
        "Bureau 121",
        "NewRomanic Cyber Army Team",
        "Bluenoroff",
        "Subgroup: Bluenoroff",
        "Group 77",
        "Labyrinth Chollima",
        "Operation Troy",
        "Operation GhostSecret",
        "Operation AppleJeus",
        "APT38",
        "APT 38",
        "Stardust Chollima",
        "Whois Hacking Team",
        "Zinc",
        "Appleworm",
        "Nickel Academy",
        "APT-C-26",
        "NICKEL GLADSTONE",
        "COVELLITE",
        "ATK3",
        "ATK117",
        "Citrine Sleet",
        "DEV-0139",
        "DEV-1222",
        "Diamond Sleet",
        "Sapphire Sleet",
        "COPERNICIUM",
        "TA404",
        "BeagleBoyz",
        "Moonstone Sleet",
        "Black Artemis",
        "Gleaming Pisces",
        "UNC1720",
        "UNC4736",
        "Guardians of Peace",
        "Storm-1789"
      ],
      "description": "Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Duuzer, and Hangman.",
      "resource_level": "government",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G1036",
          "url": "https://attack.mitre.org/groups/G1036/"
        },
        {
          "source_name": "skopnix",
          "external_id": "lazarus-group",
          "url": "https://skopnix.com/actors/lazarus-group"
        },
        {
          "source_name": "threatpost.com",
          "url": "https://threatpost.com/operation-blockbuster-coalition-ties-destructive-attacks-to-lazarus-group/116422/"
        },
        {
          "source_name": "us-cert.gov",
          "url": "https://www.us-cert.gov/ncas/alerts/TA17-164A"
        },
        {
          "source_name": "us-cert.gov",
          "url": "https://www.us-cert.gov/ncas/alerts/TA17-318A"
        },
        {
          "source_name": "us-cert.gov",
          "url": "https://www.us-cert.gov/ncas/alerts/TA17-318B"
        },
        {
          "source_name": "securelist.com",
          "url": "https://securelist.com/operation-applejeus/87553/"
        },
        {
          "source_name": "securelist.com",
          "url": "https://securelist.com/lazarus-under-the-hood/77908/"
        },
        {
          "source_name": "us-cert.gov",
          "url": "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
        },
        {
          "source_name": "mcafee.com",
          "url": "https://www.mcafee.com/enterprise/en-us/assets/white-papers/wp-dissecting-operation-troy.pdf"
        },
        {
          "source_name": "bleepingcomputer.com",
          "url": "https://www.bleepingcomputer.com/news/security/north-korean-hackers-are-up-to-no-good-again/"
        },
        {
          "source_name": "cfr.org",
          "url": "https://www.cfr.org/interactive/cyber-operations/lazarus-group"
        },
        {
          "source_name": "cfr.org",
          "url": "https://www.cfr.org/interactive/cyber-operations/operation-ghostsecret"
        },
        {
          "source_name": "cfr.org",
          "url": "https://www.cfr.org/interactive/cyber-operations/compromise-cryptocurrency-exchanges-south-korea"
        },
        {
          "source_name": "bleepingcomputer.com",
          "url": "https://www.bleepingcomputer.com/news/security/lazarus-group-deploys-its-first-mac-malware-in-cryptocurrency-exchange-hack/"
        },
        {
          "source_name": "content.fireeye.com",
          "url": "https://content.fireeye.com/apt/rpt-apt38"
        },
        {
          "source_name": "blog.malwarebytes.com",
          "url": "https://blog.malwarebytes.com/threat-analysis/2019/03/the-advanced-persistent-threat-files-lazarus-group/"
        },
        {
          "source_name": "theguardian.com",
          "url": "https://www.theguardian.com/world/2009/jul/08/south-korea-cyber-attack"
        },
        {
          "source_name": "web.archive.org",
          "url": "https://web.archive.org/web/20131123012339/https://www.symantec.com/connect/blogs/trojankoredos-comes-unwelcomed-surprise"
        },
        {
          "source_name": "nytimes.com",
          "url": "https://www.nytimes.com/2013/03/21/world/asia/south-korea-computer-network-crashes.html"
        },
        {
          "source_name": "web.archive.org",
          "url": "https://web.archive.org/web/20130607233212/https://www.symantec.com/connect/blogs/south-korean-financial-companies-targeted-castov"
        },
        {
          "source_name": "web.archive.org",
          "url": "https://web.archive.org/web/20130701021735/https://www.symantec.com/connect/blogs/four-years-darkseoul-cyberattacks-against-south-korea-continue-anniversary-korean-war"
        },
        {
          "source_name": "trendmicro.com",
          "url": "https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/the-hack-of-sony-pictures-what-you-need-to-know"
        },
        {
          "source_name": "blog.trendmicro.com",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/new-killdisk-variant-hits-financial-organizations-in-latin-america/"
        },
        {
          "source_name": "welivesecurity.com",
          "url": "https://www.welivesecurity.com/2018/04/03/lazarus-killdisk-central-american-casino/"
        },
        {
          "source_name": "securingtomorrow.mcafee.com",
          "url": "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"
        },
        {
          "source_name": "securingtomorrow.mcafee.com",
          "url": "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"
        },
        {
          "source_name": "us-cert.gov",
          "url": "https://www.us-cert.gov/ncas/analysis-reports/AR19-129A"
        },
        {
          "source_name": "securingtomorrow.mcafee.com",
          "url": "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/operation-sharpshooter-targets-global-defense-critical-infrastructure/"
        },
        {
          "source_name": "securelist.com",
          "url": "https://securelist.com/cryptocurrency-businesses-still-being-targeted-by-lazarus/90019/"
        },
        {
          "source_name": "theregister.co.uk",
          "url": "https://www.theregister.co.uk/2019/04/10/lazarus_group_malware/"
        },
        {
          "source_name": "operationblockbuster.com",
          "url": "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
        },
        {
          "source_name": "justice.gov",
          "url": "https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and"
        },
        {
          "source_name": "trendmicro.com",
          "url": "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/a-look-into-the-lazarus-groups-operations"
        },
        {
          "source_name": "kaspersky.com",
          "url": "https://www.kaspersky.com/about/press-releases/2017_chasing-lazarus-a-hunt-for-the-infamous-hackers-to-prevent-large-bank-robberies"
        },
        {
          "source_name": "medium.com",
          "url": "https://medium.com/threat-intel/lazarus-attacks-wannacry-5fdeddee476c"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0032/"
        },
        {
          "source_name": "threatpost.com",
          "url": "https://threatpost.com/lazarus-apt-spinoff-linked-to-banking-hacks/124746/"
        },
        {
          "source_name": "community.broadcom.com",
          "url": "https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=5b9850b9-0fdd-48a9-b595-9234207ae7df&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"
        },
        {
          "source_name": "bankinfosecurity.com",
          "url": "https://www.bankinfosecurity.com/vietnamese-bank-blocks-1-million-online-heist-a-9105"
        },
        {
          "source_name": "reuters.com",
          "url": "https://www.reuters.com/article/us-cyber-heist-swift-specialreport-idUSKCN0YB0DD"
        },
        {
          "source_name": "web.archive.org",
          "url": "https://web.archive.org/web/20160527050022/https://www.symantec.com/connect/blogs/swift-attackers-malware-linked-more-financial-attacks"
        },
        {
          "source_name": "symantec-blogs.broadcom.com",
          "url": "https://symantec-blogs.broadcom.com/blogs/threat-intelligence/fastcash-lazarus-atm-malware"
        },
        {
          "source_name": "blog.trendmicro.com",
          "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/what-we-can-learn-from-the-bangladesh-central-bank-cyber-heist/"
        },
        {
          "source_name": "symantec.com",
          "url": "https://www.symantec.com/connect/blogs/attackers-target-dozens-global-banks-new-malware"
        },
        {
          "source_name": "baesystemsai.blogspot.com",
          "url": "https://baesystemsai.blogspot.com/2017/10/taiwan-heist-lazarus-tools.html"
        },
        {
          "source_name": "bloomberg.com",
          "url": "https://www.bloomberg.com/news/articles/2018-05-29/mexico-foiled-a-110-million-bank-heist-then-kept-it-a-secret"
        },
        {
          "source_name": "threatpost.com",
          "url": "https://threatpost.com/banco-de-chile-wiper-attack-just-a-cover-for-10m-swift-heist/132796/"
        },
        {
          "source_name": "darkreading.com",
          "url": "https://www.darkreading.com/attacks-breaches/north-korean-hacking-group-steals-$135-million-from-indian-bank-/d/d-id/1332678"
        },
        {
          "source_name": "zdnet.com",
          "url": "https://www.zdnet.com/article/north-korean-hackers-infiltrate-chiles-atm-network-after-skype-job-interview/"
        },
        {
          "source_name": "blogs.jpcert.or.jp",
          "url": "https://blogs.jpcert.or.jp/en/2020/08/Lazarus-malware.html"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/research/threat-profiles/nickel-gladstone"
        },
        {
          "source_name": "blogs.jpcert.or.jp",
          "url": "https://blogs.jpcert.or.jp/en/2020/09/BLINDINGCAN.html"
        },
        {
          "source_name": "welivesecurity.com",
          "url": "https://www.welivesecurity.com/2020/11/16/lazarus-supply-chain-attack-south-korea/"
        },
        {
          "source_name": "dragos.com",
          "url": "https://dragos.com/adversaries.html"
        },
        {
          "source_name": "dragos.com",
          "url": "https://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf"
        },
        {
          "source_name": "cfr.org",
          "url": "https://www.cfr.org/interactive/cyber-operations/covellite"
        },
        {
          "source_name": "hvs-consulting.de",
          "url": "https://www.hvs-consulting.de/lazarus-report/"
        },
        {
          "source_name": "github.com",
          "url": "https://github.com/hvs-consulting/ioc_signatures/tree/main/Lazarus_APT37"
        },
        {
          "source_name": "blogs.jpcert.or.jp",
          "url": "https://blogs.jpcert.or.jp/en/2021/01/Lazarus_tools.html"
        },
        {
          "source_name": "blogs.jpcert.or.jp",
          "url": "https://blogs.jpcert.or.jp/en/2021/01/Lazarus_malware2.html"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0082"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0032"
        },
        {
          "source_name": "microsoft.com",
          "url": "https://www.microsoft.com/en-us/security/blog/2022/12/06/dev-0139-launches-targeted-attacks-against-the-cryptocurrency-industry/"
        },
        {
          "source_name": "proofpoint.com",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/ta444-apt-startup-aimed-at-your-funds"
        },
        {
          "source_name": "proofpoint.com",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/above-fold-and-your-inbox-tracing-state-aligned-activity-targeting-journalists"
        },
        {
          "source_name": "bsi.bund.de",
          "url": "https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html"
        },
        {
          "source_name": "securonix.com",
          "url": "https://www.securonix.com/blog/securonix-threat-labs-monthly-intelligence-insights-june-2023/"
        },
        {
          "source_name": "us-cert.cisa.gov",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa21-048a"
        },
        {
          "source_name": "microsoft.com",
          "url": "https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/"
        },
        {
          "source_name": "go.crowdstrike.com",
          "url": "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf"
        },
        {
          "source_name": "justice.gov",
          "url": "https://www.justice.gov/opa/pr/three-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyberattacks-and"
        },
        {
          "source_name": "us-cert.cisa.gov",
          "url": "https://us-cert.cisa.gov/ncas/alerts/aa20-239a"
        },
        {
          "source_name": "services.google.com",
          "url": "https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"
        },
        {
          "source_name": "crowdstrike.com",
          "url": "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-april-stardust-chollima/"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G1049"
        },
        {
          "source_name": "cloud.google.com",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise/"
        },
        {
          "source_name": "reports.dtexsystems.com",
          "url": "https://reports.dtexsystems.com/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf"
        },
        {
          "source_name": "cloud.google.com",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-structure-alignment-2023"
        },
        {
          "source_name": "unit42.paloaltonetworks.com",
          "url": "https://unit42.paloaltonetworks.com/threat-assessment-north-korean-threat-groups-2024/"
        },
        {
          "source_name": "blogs.jpcert.or.jp",
          "url": "https://blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html"
        },
        {
          "source_name": "web.archive.org",
          "url": "https://web.archive.org/web/20210723190317/https://adversary.crowdstrike.com/en-US/adversary/labyrinth-chollima/"
        },
        {
          "source_name": "cloud.google.com",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/mapping-dprk-groups-to-government/"
        },
        {
          "source_name": "learn.microsoft.com",
          "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
        },
        {
          "source_name": "web.archive.org",
          "url": "https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"
        },
        {
          "source_name": "secureworks.com",
          "url": "https://www.secureworks.com/about/press/media-alert-secureworks-discovers-north-korean-cyber-threat-group-lazarus-spearphishing"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G1036"
        },
        {
          "source_name": "microsoft.com",
          "url": "https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--8658f5fd-1e99-57c3-bc0e-68e33dd4ae8d",
      "name": "Email Addresses",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1589.002",
          "url": "https://attack.mitre.org/techniques/T1589/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bc131fea-1886-5a6a-866d-a1c95e5ab69e",
      "name": "Gather Victim Org Information",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1591",
          "url": "https://attack.mitre.org/techniques/T1591/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b1026e52-a181-5fc5-ad21-0ed27fb9eb31",
      "name": "Phishing for Information",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1598",
          "url": "https://attack.mitre.org/techniques/T1598/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5d486e3c-3099-5048-8b70-b1b946f13b94",
      "name": "Spearphishing Link",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1598.003",
          "url": "https://attack.mitre.org/techniques/T1598/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "reconnaissance"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3",
      "name": "Domains",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583.001",
          "url": "https://attack.mitre.org/techniques/T1583/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98",
      "name": "Virtual Private Server",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1583.003",
          "url": "https://attack.mitre.org/techniques/T1583/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d",
      "name": "Social Media Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1585.001",
          "url": "https://attack.mitre.org/techniques/T1585/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--904b9e3b-7d66-5d85-91f7-87d505c59a98",
      "name": "Email Accounts",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1585.002",
          "url": "https://attack.mitre.org/techniques/T1585/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5461adbd-9559-5d4c-8adf-358f9b19f784",
      "name": "Develop Capabilities",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1587",
          "url": "https://attack.mitre.org/techniques/T1587/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df",
      "name": "Malware",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1587.001",
          "url": "https://attack.mitre.org/techniques/T1587/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--03041285-abc7-5836-9908-13316a674531",
      "name": "Upload Malware",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1608.001",
          "url": "https://attack.mitre.org/techniques/T1608/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "resource-development"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--8374ae39-df94-53cb-92bf-4a61a8e6f734",
      "name": "Compromise Software Supply Chain",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1195.002",
          "url": "https://attack.mitre.org/techniques/T1195/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9",
      "name": "Spearphishing Attachment",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566.001",
          "url": "https://attack.mitre.org/techniques/T1566/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--af307f20-df58-58e9-873b-760eb62c1afd",
      "name": "Spearphishing via Service",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566.003",
          "url": "https://attack.mitre.org/techniques/T1566/003/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6",
      "name": "Scheduled Task",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1053.005",
          "url": "https://attack.mitre.org/techniques/T1053/005/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890",
      "name": "Malicious File",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204.002",
          "url": "https://attack.mitre.org/techniques/T1204/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--532b32d7-1010-5496-a626-8abe7cf32960",
      "name": "Service Execution",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1569.002",
          "url": "https://attack.mitre.org/techniques/T1569/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de",
      "name": "Registry Run Keys / Startup Folder",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1547.001",
          "url": "https://attack.mitre.org/techniques/T1547/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "persistence"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--42b35a39-c6fd-5f5f-a782-348a76b55af5",
      "name": "Obfuscated Files or Information",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027",
          "url": "https://attack.mitre.org/techniques/T1027/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--4ae94166-57cf-5542-aa8c-1d1f8704b23d",
      "name": "Embedded Payloads",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.009",
          "url": "https://attack.mitre.org/techniques/T1027/009/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3ccefbde-7d5e-5b60-a8e6-cf2fe19a25fd",
      "name": "Encrypted/Encoded File",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.013",
          "url": "https://attack.mitre.org/techniques/T1027/013/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--4b969def-2fff-5bb3-8343-f00548d349d4",
      "name": "Deobfuscate/Decode Files or Information",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1140",
          "url": "https://attack.mitre.org/techniques/T1140/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc",
      "name": "LSASS Memory",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1003.001",
          "url": "https://attack.mitre.org/techniques/T1003/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "credential-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0",
      "name": "System Network Configuration Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1016",
          "url": "https://attack.mitre.org/techniques/T1016/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8",
      "name": "System Owner/User Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1033",
          "url": "https://attack.mitre.org/techniques/T1033/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de",
      "name": "System Information Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1082",
          "url": "https://attack.mitre.org/techniques/T1082/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--73611d76-6eef-5ba9-b217-e6687368ef55",
      "name": "Browser Information Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1217",
          "url": "https://attack.mitre.org/techniques/T1217/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa",
      "name": "Web Protocols",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.001",
          "url": "https://attack.mitre.org/techniques/T1071/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7",
      "name": "Ingress Tool Transfer",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1105",
          "url": "https://attack.mitre.org/techniques/T1105/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--c8b78ebe-d7a4-50da-a7d8-3c062ebffa83",
      "name": "Data Encrypted for Impact",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1486",
          "url": "https://attack.mitre.org/techniques/T1486/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "impact"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--d9ff37a8-1082-5308-8c87-c497f374962a",
      "name": "Qilin",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S1242",
          "url": "https://attack.mitre.org/software/S1242/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--8ee6f1d2-d113-518d-8074-3e9bc3b7ba9a",
      "name": "RawDisk",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0364",
          "url": "https://attack.mitre.org/software/S0364/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--1f8aecfa-a763-5d41-8858-f664f76735b9",
      "name": "netsh",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0108",
          "url": "https://attack.mitre.org/software/S0108/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--960fea46-8de0-5e55-a903-32a5d8fdaa3e",
      "name": "route",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0103",
          "url": "https://attack.mitre.org/software/S0103/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--b5096ef6-d33b-5cce-ba33-1c2fa7852365",
      "name": "Responder",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0174",
          "url": "https://attack.mitre.org/software/S0174/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--857ab47e-058a-5303-ade7-a1bd1bcb61f6",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--8658f5fd-1e99-57c3-bc0e-68e33dd4ae8d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3b6beef3-a4fd-5b87-aa2b-6fddc51bc90f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--bc131fea-1886-5a6a-866d-a1c95e5ab69e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c752ff34-fc66-5f50-b63c-2d07899efd49",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--b1026e52-a181-5fc5-ad21-0ed27fb9eb31"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c11ef279-0926-55cf-b565-3bf9859ef3af",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--5d486e3c-3099-5048-8b70-b1b946f13b94"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--005f18ac-fd01-5a39-aca5-1f0e87f0616a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--6251f3cb-756e-56ba-8cf4-b81e297887d3"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c7e53c3a-2679-5d46-8b02-0e89f70a893e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--4482b1aa-7ad8-547f-83e9-4066eeafae98"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--ba6b405e-2430-5a98-9d8e-c292f3d0e069",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--9597bb5b-3766-58db-959d-b36369007f8d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--4a393c0d-c817-5423-9c9e-8ba5ee92f9d5",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--904b9e3b-7d66-5d85-91f7-87d505c59a98"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e1a4adf9-8a6f-50c5-8a97-724f41ffd654",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--5461adbd-9559-5d4c-8adf-358f9b19f784"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--15ec6b23-6022-5c41-ae92-470155a46112",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--79821af2-a009-522f-85d9-419e6fc310df"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c5397001-9235-5eb3-b4c4-a65dc6936534",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--03041285-abc7-5836-9908-13316a674531"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--605ef8aa-f847-58aa-88bb-fae48f8d4408",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--8374ae39-df94-53cb-92bf-4a61a8e6f734"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--34468fd9-5a41-561c-8224-78c1710f080d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6f9f0cfc-a061-5345-83b1-6a582461e48a",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--af307f20-df58-58e9-873b-760eb62c1afd"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a465172f-9035-59a1-9560-801e9cd8fb0b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--deb85c75-2dea-5914-91d7-564352397fc6"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--2d921344-72dd-5a52-98cd-fb043587b5d2",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--7cd34e5d-7878-5a81-9dca-c021775ed6e5",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--532b32d7-1010-5496-a626-8abe7cf32960"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--160c69d1-1640-5e5e-827c-e4af1336c2ef",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--7f5faf4c-64c8-5ce5-94f8-af8f5cfd82de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--27a80204-7fb7-589e-b90b-10ef31abbb91",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--42b35a39-c6fd-5f5f-a782-348a76b55af5"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--394e5b5d-76c8-510a-a644-2effb5c1c4d6",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--4ae94166-57cf-5542-aa8c-1d1f8704b23d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--723e3055-92c7-5d2d-abd2-edb6f24b8d4e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--3ccefbde-7d5e-5b60-a8e6-cf2fe19a25fd"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--793c0a60-c0ef-5440-8299-42aede1082a5",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--4b969def-2fff-5bb3-8343-f00548d349d4"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a5fa175c-243f-523f-a9a5-3ec7f9284375",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--f6302424-c6aa-5679-b392-fe1a568bb1fc"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3b753dc7-38f7-57c0-9728-febeed5b3144",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--bab635c1-b162-55ed-a9a4-ce797d752be0"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1877b6ab-1964-51cc-a2f2-f98d37cd147e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--28c49cd6-4c32-5796-ba30-dd9a3f8dded8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--43979741-ada1-56c6-b647-9244c64db19d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--d6ae27d1-3519-5b9c-969e-a35f719bb1de"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8f807711-e48a-561c-8746-c33c1e7da111",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--73611d76-6eef-5ba9-b217-e6687368ef55"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a042183e-9cc2-50db-98b3-bd0414c363e2",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c2ef486c-4cb6-59dc-8d08-71f285025099",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--3a8119a6-da4e-575c-929e-78200e2c20b7"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b28bc570-41b8-545e-a8ad-5f12f94ca122",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "attack-pattern--c8b78ebe-d7a4-50da-a7d8-3c062ebffa83"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--6ff7a43f-7f0f-5b28-8687-cdb0919f7d64",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "malware--d9ff37a8-1082-5308-8c87-c497f374962a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--11e30c37-8bf3-5db1-8e17-3983c148c619",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "tool--8ee6f1d2-d113-518d-8074-3e9bc3b7ba9a"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--a93d479b-bf8b-5212-b024-0942fa6f62fe",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "tool--1f8aecfa-a763-5d41-8858-f664f76735b9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5d3e1b4f-110f-5c4f-9674-f086313b753e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "tool--960fea46-8de0-5e55-a903-32a5d8fdaa3e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c980483a-88f4-5d72-97fe-71a54645f110",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--7b4c96f5-1ce9-5044-917c-34cd32510825",
      "target_ref": "tool--b5096ef6-d33b-5cce-ba33-1c2fa7852365"
    }
  ]
}