{
  "type": "bundle",
  "id": "bundle--1306819f-1f42-5527-a447-c1e6dd16038d",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--15ab9da6-a075-52a6-a20c-8e03046947b1",
      "name": "NEODYMIUM",
      "aliases": [
        "NEODYMIUM"
      ],
      "description": "NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird. This backdoor’s characteristics closely match FinFisher, a government-grade commercial surveillance package. Data about Wingbird activity indicate that it is typically used to attack individual computers instead of networks.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G0055",
          "url": "https://attack.mitre.org/groups/G0055/"
        },
        {
          "source_name": "skopnix",
          "external_id": "neodymium",
          "url": "https://skopnix.com/actors/neodymium"
        },
        {
          "source_name": "blogs.technet.microsoft.com",
          "url": "https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0055"
        },
        {
          "source_name": "download.microsoft.com",
          "url": "http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf"
        },
        {
          "source_name": "cyberscoop.com",
          "url": "https://www.cyberscoop.com/middle-eastern-hacking-group-using-finfisher-malware-conduct-international-espionage/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--dea4bb94-cc2e-5e04-9aee-0b8db8764b3c",
      "name": "Wingbird",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0176",
          "url": "https://attack.mitre.org/software/S0176/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--565e3661-bfd6-50ea-a938-ce9a4be8d228",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--15ab9da6-a075-52a6-a20c-8e03046947b1",
      "target_ref": "malware--dea4bb94-cc2e-5e04-9aee-0b8db8764b3c"
    }
  ]
}