{
  "type": "bundle",
  "id": "bundle--a46805a2-10a7-51b2-a98e-2d4a580ec52a",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--42cb76be-2b3f-5dca-ba8d-bd8e81e49609",
      "name": "Orangeworm",
      "aliases": [
        "Orangeworm"
      ],
      "description": "Symantec has identified a previously unknown group called Orangeworm that has been observed installing a custom backdoor called Trojan.Kwampirs within large international corporations that operate within the healthcare sector in the United States, Europe, and Asia.\nFirst identified in January 2015, Orangeworm has also conducted targeted attacks against organizations in related industries as part of a larger supply-chain attack in order to reach their intended victims. Known victims include healthcare providers, pharmaceuticals, IT solution providers for healthcare and equipment manufacturers that serve the healthcare industry, likely for the purpose of corporate espionage.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G0071",
          "url": "https://attack.mitre.org/groups/G0071/"
        },
        {
          "source_name": "skopnix",
          "external_id": "orangeworm",
          "url": "https://skopnix.com/actors/orangeworm"
        },
        {
          "source_name": "symantec.com",
          "url": "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0071"
        },
        {
          "source_name": "resources.cylera.com",
          "url": "https://resources.cylera.com/hubfs/Cylera%20Labs/Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee",
      "name": "SMB/Windows Admin Shares",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1021.002",
          "url": "https://attack.mitre.org/techniques/T1021/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "lateral-movement"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa",
      "name": "Web Protocols",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1071.001",
          "url": "https://attack.mitre.org/techniques/T1071/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "command-and-control"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--f28c91c3-fa00-5544-888e-c8ec220f8357",
      "name": "Kwampirs",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0236",
          "url": "https://attack.mitre.org/software/S0236/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--eefa3ad3-3173-5ac2-a622-d26e56e1c236",
      "name": "netstat",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0104",
          "url": "https://attack.mitre.org/software/S0104/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--83e8900b-0bd1-5b50-8eec-55c9d31d202d",
      "name": "Net",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0039",
          "url": "https://attack.mitre.org/software/S0039/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--4a5acfcc-34b2-5f89-881e-309ca7a69632",
      "name": "ipconfig",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0100",
          "url": "https://attack.mitre.org/software/S0100/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--9021a9e6-9284-5ea9-810d-2ad391019467",
      "name": "cmd",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0106",
          "url": "https://attack.mitre.org/software/S0106/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--960fea46-8de0-5e55-a903-32a5d8fdaa3e",
      "name": "route",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0103",
          "url": "https://attack.mitre.org/software/S0103/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--29be7f44-d302-5883-b81c-161b5092c3a8",
      "name": "Arp",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0099",
          "url": "https://attack.mitre.org/software/S0099/"
        }
      ]
    },
    {
      "type": "tool",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "tool--e5af569b-fbf8-5ed3-824b-2311c639859c",
      "name": "Systeminfo",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0096",
          "url": "https://attack.mitre.org/software/S0096/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--d82c67ce-e55a-576b-b71d-55a07ecff71e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--42cb76be-2b3f-5dca-ba8d-bd8e81e49609",
      "target_ref": "attack-pattern--b16c9715-0c0a-5d8b-972e-f93c9d5c95ee"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b04fb478-632d-5217-93c5-e3093047651f",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--42cb76be-2b3f-5dca-ba8d-bd8e81e49609",
      "target_ref": "attack-pattern--09a3f2a6-2845-595b-81f0-17c4f55b8caa"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--1f11648e-01fe-5500-ba80-001729000a8c",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--42cb76be-2b3f-5dca-ba8d-bd8e81e49609",
      "target_ref": "malware--f28c91c3-fa00-5544-888e-c8ec220f8357"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b8c2f7c5-e168-51ae-88ab-83089d050c65",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--42cb76be-2b3f-5dca-ba8d-bd8e81e49609",
      "target_ref": "tool--eefa3ad3-3173-5ac2-a622-d26e56e1c236"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--bd581d81-2e88-5325-a464-090cc68cb6f0",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--42cb76be-2b3f-5dca-ba8d-bd8e81e49609",
      "target_ref": "tool--83e8900b-0bd1-5b50-8eec-55c9d31d202d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5f29738b-026c-5581-895f-b5486da35962",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--42cb76be-2b3f-5dca-ba8d-bd8e81e49609",
      "target_ref": "tool--4a5acfcc-34b2-5f89-881e-309ca7a69632"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--e6822f81-f102-5e84-8bdb-fac5139748ab",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--42cb76be-2b3f-5dca-ba8d-bd8e81e49609",
      "target_ref": "tool--9021a9e6-9284-5ea9-810d-2ad391019467"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--027c6267-ad31-5bdc-bdb5-b1b911c775a2",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--42cb76be-2b3f-5dca-ba8d-bd8e81e49609",
      "target_ref": "tool--960fea46-8de0-5e55-a903-32a5d8fdaa3e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--893bea19-3d06-5316-8fab-9cf0c3781669",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--42cb76be-2b3f-5dca-ba8d-bd8e81e49609",
      "target_ref": "tool--29be7f44-d302-5883-b81c-161b5092c3a8"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--543d084a-b90d-5a0d-8568-57d68e978205",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--42cb76be-2b3f-5dca-ba8d-bd8e81e49609",
      "target_ref": "tool--e5af569b-fbf8-5ed3-824b-2311c639859c"
    }
  ]
}