{
  "type": "bundle",
  "id": "bundle--4c85f4d2-6ecb-557e-985a-61a1b93c8b01",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--526d069d-ec30-55fe-a28e-4c0dedbb9b24",
      "name": "The White Company",
      "aliases": [
        "The White Company"
      ],
      "description": "The White Company is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G0089",
          "url": "https://attack.mitre.org/groups/G0089/"
        },
        {
          "source_name": "skopnix",
          "external_id": "the-white-company",
          "url": "https://skopnix.com/actors/the-white-company"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G0089"
        },
        {
          "source_name": "cylance.com",
          "url": "https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9",
      "name": "Spearphishing Attachment",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566.001",
          "url": "https://attack.mitre.org/techniques/T1566/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d",
      "name": "Exploitation for Client Execution",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1203",
          "url": "https://attack.mitre.org/techniques/T1203/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890",
      "name": "Malicious File",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1204.002",
          "url": "https://attack.mitre.org/techniques/T1204/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "execution"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--917d444c-a80c-500f-90b0-01222354508e",
      "name": "Software Packing",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1027.002",
          "url": "https://attack.mitre.org/techniques/T1027/002/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208",
      "name": "File Deletion",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1070.004",
          "url": "https://attack.mitre.org/techniques/T1070/004/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "stealth"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--7a5e8cf5-cb9d-596b-b723-6f0bb5d40e49",
      "name": "System Time Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1124",
          "url": "https://attack.mitre.org/techniques/T1124/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--aa223b10-a214-5ccb-bdde-66a535142526",
      "name": "Security Software Discovery",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1518.001",
          "url": "https://attack.mitre.org/techniques/T1518/001/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "discovery"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--07d6b5d2-1397-599b-9be4-8ab933bc7a9b",
      "name": "Revenge RAT",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0379",
          "url": "https://attack.mitre.org/software/S0379/"
        }
      ]
    },
    {
      "type": "malware",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "malware--7c2cd14f-2af2-594f-9cf6-f7d9fe225714",
      "name": "NETWIRE",
      "is_family": true,
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "S0198",
          "url": "https://attack.mitre.org/software/S0198/"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--10d0401d-bb97-57f2-bfd2-914bdf98976b",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--526d069d-ec30-55fe-a28e-4c0dedbb9b24",
      "target_ref": "attack-pattern--455a6e95-5b37-5030-a9c8-4c2aa8119ca9"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--dbd501f0-1875-5bf4-aa38-0ae3478789ab",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--526d069d-ec30-55fe-a28e-4c0dedbb9b24",
      "target_ref": "attack-pattern--c58e50ea-0b5e-5b78-9d85-5cf86c48813d"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--fc320e38-57cb-50b2-be9f-4508acd65b24",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--526d069d-ec30-55fe-a28e-4c0dedbb9b24",
      "target_ref": "attack-pattern--5fca71f8-fdc7-5a29-a449-bae25d7dc890"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--8eb603f8-f43c-5c0f-b9e1-cf31f561a21e",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--526d069d-ec30-55fe-a28e-4c0dedbb9b24",
      "target_ref": "attack-pattern--917d444c-a80c-500f-90b0-01222354508e"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--71cc57bc-71dc-5d97-921e-8d0e1a673a70",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--526d069d-ec30-55fe-a28e-4c0dedbb9b24",
      "target_ref": "attack-pattern--931c991a-05e7-53eb-ad45-446ee1e76208"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--fc4b63fd-0d6f-5b07-a639-6e86fb2bfff5",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--526d069d-ec30-55fe-a28e-4c0dedbb9b24",
      "target_ref": "attack-pattern--7a5e8cf5-cb9d-596b-b723-6f0bb5d40e49"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--b66ba174-24a8-58ad-9a8b-29cf39577892",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--526d069d-ec30-55fe-a28e-4c0dedbb9b24",
      "target_ref": "attack-pattern--aa223b10-a214-5ccb-bdde-66a535142526"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--5b8e23f6-385f-53ba-979e-152af9ecfe0d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--526d069d-ec30-55fe-a28e-4c0dedbb9b24",
      "target_ref": "malware--07d6b5d2-1397-599b-9be4-8ab933bc7a9b"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-06T13:27:36.797Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--c496ab12-807b-5db8-8b1f-805377c4072d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--526d069d-ec30-55fe-a28e-4c0dedbb9b24",
      "target_ref": "malware--7c2cd14f-2af2-594f-9cf6-f7d9fe225714"
    }
  ]
}