{
  "type": "bundle",
  "id": "bundle--805b275e-bf3c-58a3-87da-9617e84a3fc7",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-18T21:35:12.981Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--77b11b34-c128-5eaf-81fd-207616c50625",
      "name": "UNC4736",
      "aliases": [
        "UNC4736",
        "Gleaming Pisces",
        "Citrine Sleet",
        "UNC1720"
      ],
      "description": "UNC4736 is a North Korean threat actor that has been involved in supply chain attacks targeting software chains of 3CX and X_TRADER. They have used malware strains such as TAXHAUL, Coldcat, and VEILEDSIGNAL to compromise Windows and macOS systems. UNC4736 has been linked to financially motivated cybercrime operations, particularly focused on cryptocurrency and fintech-related services. They have also demonstrated infrastructure overlap with other North Korean and APT43 activity.",
      "first_seen": "2018-01-01T00:00:00.000Z",
      "last_seen": "2026-07-30T14:00:00.000Z",
      "resource_level": "government",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "G1049",
          "url": "https://attack.mitre.org/groups/G1049/"
        },
        {
          "source_name": "skopnix",
          "external_id": "unc4736",
          "url": "https://skopnix.com/actors/unc4736"
        },
        {
          "source_name": "mandiant.com",
          "url": "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
        },
        {
          "source_name": "attack.mitre.org",
          "url": "https://attack.mitre.org/groups/G1049"
        },
        {
          "source_name": "cloud.google.com",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise/"
        },
        {
          "source_name": "reports.dtexsystems.com",
          "url": "https://reports.dtexsystems.com/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf"
        },
        {
          "source_name": "cloud.google.com",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-structure-alignment-2023"
        },
        {
          "source_name": "unit42.paloaltonetworks.com",
          "url": "https://unit42.paloaltonetworks.com/threat-assessment-north-korean-threat-groups-2024/"
        },
        {
          "source_name": "blogs.jpcert.or.jp",
          "url": "https://blogs.jpcert.or.jp/en/2025/03/classifying-lazaruss-subgroup.html"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-18T21:35:12.981Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--f921c5f3-9eb8-5e0e-808b-8ed2a9056601",
      "name": "Phishing",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1566",
          "url": "https://attack.mitre.org/techniques/T1566/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "initial-access"
        }
      ]
    },
    {
      "type": "attack-pattern",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-18T21:35:12.981Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b",
      "name": "Financial Theft",
      "external_references": [
        {
          "source_name": "mitre-attack",
          "external_id": "T1657",
          "url": "https://attack.mitre.org/techniques/T1657/"
        }
      ],
      "kill_chain_phases": [
        {
          "kill_chain_name": "mitre-attack",
          "phase_name": "impact"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-18T21:35:12.981Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--f4a9f0f0-811a-5de4-b4c9-605a62ddcd2d",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--77b11b34-c128-5eaf-81fd-207616c50625",
      "target_ref": "attack-pattern--f921c5f3-9eb8-5e0e-808b-8ed2a9056601"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-10-18T21:35:12.981Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "relationship--3a7dd450-a694-5648-b835-76e5ae13afa0",
      "relationship_type": "uses",
      "source_ref": "intrusion-set--77b11b34-c128-5eaf-81fd-207616c50625",
      "target_ref": "attack-pattern--1fe5869f-309d-59cc-9bc1-bf23684e0b2b"
    }
  ]
}