{
  "type": "bundle",
  "id": "bundle--f69963e4-521e-5635-8781-96bf388ae398",
  "objects": [
    {
      "type": "marking-definition",
      "spec_version": "2.1",
      "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
      "created": "2017-01-20T00:00:00.000Z",
      "definition_type": "tlp",
      "name": "TLP:WHITE",
      "definition": {
        "tlp": "white"
      }
    },
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-07T00:00:00.000Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "name": "skopnix",
      "identity_class": "organization",
      "description": "skopnix — open threat intelligence. Aggregated and published, not authored: cite the external_references, not us.",
      "contact_information": "https://skopnix.com"
    },
    {
      "type": "intrusion-set",
      "spec_version": "2.1",
      "created": "2026-09-07T00:00:00.000Z",
      "modified": "2026-09-15T11:55:05.370Z",
      "created_by_ref": "identity--c1b401e5-a927-598d-859c-fc757d058154",
      "object_marking_refs": [
        "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
      ],
      "id": "intrusion-set--ca75e662-f964-5e14-bad6-5d113e029c11",
      "name": "Zarya",
      "aliases": [
        "Zarya",
        "UAC-0109"
      ],
      "description": "Zarya is a pro-Russian hacktivist group that emerged in March 2022. Initially operating as a special forces unit under the command of Killnet, Zarya has since become an independent entity. The group is primarily known for engaging in Denial-of-Service attacks, website defacement campaigns, and data leaks. Zarya targets government agencies, service providers, critical infrastructure, and civil service employees, both domestically and internationally.",
      "external_references": [
        {
          "source_name": "skopnix",
          "external_id": "zarya",
          "url": "https://skopnix.com/actors/zarya"
        },
        {
          "source_name": "mandiant.com",
          "url": "https://www.mandiant.com/resources/blog/killnet-new-capabilities-older-tactics"
        },
        {
          "source_name": "cyfirma.com",
          "url": "https://www.cyfirma.com/?post_type=out-of-band&p=17397"
        },
        {
          "source_name": "reversinglabs.com",
          "url": "https://www.reversinglabs.com/blog/the-week-in-security-possible-colonial-pipeline-2.0-ransomware-hurts-small-american-eateries"
        },
        {
          "source_name": "channellife.com.au",
          "url": "https://channellife.com.au/story/the-increasing-presence-of-pro-russia-hacktivists"
        },
        {
          "source_name": "socradar.io",
          "url": "https://socradar.io/dark-web-profile-killnet-russian-hacktivist-group/"
        },
        {
          "source_name": "cip.gov.ua",
          "url": "https://cip.gov.ua/services/cm/api/attachment/download?id=60068"
        }
      ]
    }
  ]
}