{
 "type": "bundle",
 "id": "bundle--23e9df10-a083-4357-bab5-56342ace8def",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--b299d607-e234-5775-b9fc-432ce849ae5c",
   "created": "2026-11-11T12:23:36.576Z",
   "modified": "2026-11-13T00:02:47.840Z",
   "name": "VCAA investigating after website hacked during exam period",
   "description": "Detected automatically from 2 articles in 2 outlets (ABC News, The Guardian Australia), Nov 11, 2026. Type: intrusion; sectors: government, education. Asia-Pacific countries affected: Australia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "intrusion",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/vcaa-investigating-after-website-hacked-during-exam-period-20261111/"
    },
    {
     "source_name": "ABC News",
     "url": "https://www.abc.net.au/news/2026-11-11/vcaa-website-hacked-during-exam-period/107375210",
     "description": "VCAA investigating after website hacked during exam period"
    },
    {
     "source_name": "The Guardian Australia",
     "url": "https://www.theguardian.com/australia-news/2026/nov/12/vce-exams-hack-year-12-papers-vcaa-victorian-curriculum-and-assessment-authority",
     "description": "Hacker claims to have sold VCE exam papers to hundreds of students after government website hack"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-11",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Government",
    "Education"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Australia",
   "country": "AU"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--c4e334f2-e04f-5a05-96ae-312009c78c7d",
   "created": "2026-11-11T12:23:36.576Z",
   "modified": "2026-11-11T12:23:36.576Z",
   "relationship_type": "related-to",
   "source_ref": "incident--b299d607-e234-5775-b9fc-432ce849ae5c",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--af94897a-de91-5c95-8dcf-f2c5f8156ec8",
   "created": "2026-11-12T00:02:27.467Z",
   "modified": "2026-11-13T00:02:47.871Z",
   "name": "Personal data stolen after Queensland Parks booking service hacked",
   "description": "Detected automatically from 1 article in 1 outlet (ABC News), Nov 11, 2026. Type: intrusion. Asia-Pacific countries affected: Australia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "intrusion",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/personal-data-stolen-after-queensland-parks-booking-service-hacked-20261111/"
    },
    {
     "source_name": "ABC News",
     "url": "https://www.abc.net.au/news/2026-11-12/queensland-parks-booking-system-hacked/107376788",
     "description": "Personal data stolen after Queensland Parks booking service hacked"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-11",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8b90cab0-025f-5319-8a82-62b885cf0bb4",
   "created": "2026-11-12T00:02:27.467Z",
   "modified": "2026-11-12T00:02:27.467Z",
   "relationship_type": "related-to",
   "source_ref": "incident--af94897a-de91-5c95-8dcf-f2c5f8156ec8",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--c454cc06-af5a-5977-aeac-db2feca6e0cc",
   "created": "2026-11-10T16:32:08.738Z",
   "modified": "2026-11-13T00:02:47.753Z",
   "name": "The new ‘cold’ war: hacked fridges reveal infrastructure-security gaps",
   "description": "Detected automatically from 1 article in 1 outlet (ASPI The Strategist), Nov 10, 2026. Type: intrusion. Asia-Pacific countries affected: Australia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "intrusion",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/the-new-cold-war-hacked-fridges-reveal-infrastructure-security-gaps-20261110/"
    },
    {
     "source_name": "ASPI The Strategist",
     "url": "https://www.aspistrategist.org.au/the-new-cold-war-hacked-fridges-reveal-infrastructure-security-gaps/",
     "description": "The new ‘cold’ war: hacked fridges reveal infrastructure-security gaps"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-10",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--b3b0deae-ad3f-5b51-b58a-892e3fc6364a",
   "created": "2026-11-10T16:32:08.738Z",
   "modified": "2026-11-10T16:32:08.738Z",
   "relationship_type": "related-to",
   "source_ref": "incident--c454cc06-af5a-5977-aeac-db2feca6e0cc",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--88b78184-c284-5241-9000-edca1cab4bb7",
   "created": "2026-11-10T16:32:08.699Z",
   "modified": "2026-11-13T00:02:47.706Z",
   "name": "Cabinet minister Anne Aly hacked after 'inadvertently' opening WhatsApp scam link",
   "description": "Detected automatically from 1 article in 1 outlet (SBS News), Nov 9, 2026. Type: intrusion; sectors: technology. Asia-Pacific countries affected: Australia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "intrusion",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/cabinet-minister-anne-aly-hacked-after-inadvertently-opening-whatsapp-20261109/"
    },
    {
     "source_name": "SBS News",
     "url": "https://www.sbs.com.au/news/article/labor-frontbencher-anne-alys-phone-hacked-scam-whatsapp-link/yg52uglkw",
     "description": "Cabinet minister Anne Aly hacked after 'inadvertently' opening WhatsApp scam link"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-09",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Technology"
   ],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--bd657e68-ab5f-52dc-957a-04d6687d2685",
   "created": "2026-11-10T16:32:08.699Z",
   "modified": "2026-11-10T16:32:08.699Z",
   "relationship_type": "related-to",
   "source_ref": "incident--88b78184-c284-5241-9000-edca1cab4bb7",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--49681c3d-bfc2-5e03-af18-5b9eb800449b",
   "created": "2026-11-10T16:32:08.321Z",
   "modified": "2026-11-11T20:40:49.580Z",
   "name": "Singapore embraces AI for cyber defence, with one caveat: breach transparency",
   "description": "Detected automatically from 1 article in 1 outlet (South China Morning Post), Oct 25, 2026. Type: data breach; sectors: defence. Asia-Pacific countries affected: Singapore, Australia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/singapore-embraces-ai-for-cyber-defence-with-one-caveat-breach-transpa-20261025/"
    },
    {
     "source_name": "South China Morning Post",
     "url": "https://www.scmp.com/week-asia/politics/article/3371950/singapore-embraces-ai-cyber-defence-one-caveat-breach-transparency",
     "description": "Singapore embraces AI for cyber defence, with one caveat: breach transparency"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-25",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Defence"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--ee3011bf-d9b0-5b2a-b2ad-c466f24616ce",
   "created": "2026-11-10T16:32:08.321Z",
   "modified": "2026-11-10T16:32:08.321Z",
   "relationship_type": "related-to",
   "source_ref": "incident--49681c3d-bfc2-5e03-af18-5b9eb800449b",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Singapore",
   "country": "SG"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--309ecb5c-048e-5b43-90fa-f2c88e2b6d92",
   "created": "2026-11-10T16:32:08.321Z",
   "modified": "2026-11-10T16:32:08.321Z",
   "relationship_type": "related-to",
   "source_ref": "incident--49681c3d-bfc2-5e03-af18-5b9eb800449b",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--efb2078d-bfea-5182-830d-8f48f72ae6e9",
   "created": "2026-11-10T16:32:08.094Z",
   "modified": "2026-11-11T20:40:49.283Z",
   "name": "S’pore asks AI firms for full transparency after Australian government hack: Shanmugam",
   "description": "Detected automatically from 1 article in 1 outlet (The Straits Times), Oct 13, 2026. Type: intrusion; sectors: government. Asia-Pacific countries affected: Australia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "intrusion",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/spore-asks-ai-firms-for-full-transparency-after-australian-government-20261013/"
    },
    {
     "source_name": "The Straits Times",
     "url": "https://www.straitstimes.com/tech/spore-asks-ai-firms-for-full-transparency-after-australian-government-hack-shanmugam",
     "description": "S’pore asks AI firms for full transparency after Australian government hack: Shanmugam"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-13",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Government"
   ],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--2ac85cfd-f31e-5f4b-bf5c-90b69d46f460",
   "created": "2026-11-10T16:32:08.094Z",
   "modified": "2026-11-10T16:32:08.094Z",
   "relationship_type": "related-to",
   "source_ref": "incident--efb2078d-bfea-5182-830d-8f48f72ae6e9",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31",
   "created": "2026-11-08T21:16:16.722Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Dutch NCSC warns critical Check Point VPN flaws face imminent exploitation",
   "description": "The Dutch National Cyber Security Centre issued a warning that exploitation of CVE-2026-85102 and CVE-2026-85103 in Check Point VPN Security Gateway and Security Management Servers is imminent, assessing both likelihood and impact as high. CVE-2026-85102 is an improper certificate validation flaw during VPN negotiation enabling arbitrary code execution, while CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder permitting remote code execution; both are rated 9.8. Affected versions include R81.20, R82, R82.10, R81.10.x and R82.00.x plus end-of-support R80 through R81.10, with R82.20 unaffected. No public exploit code existed at time of reporting and neither CVE appears in the CISA KEV catalog as of version 2026.09.11. Patches shipped 9 September 2026.",
   "confidence": 50,
   "labels": [
    "other",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/dutch-ncsc-warns-critical-check-point-vpn-flaws-face-imminent-exploitation/"
    },
    {
     "source_name": "source",
     "url": "https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/"
    },
    {
     "source_name": "source",
     "url": "https://thehackernews.com/2026/09/check-point-discloses-two-98-rated-vpn.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-09",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Financial Services",
    "Critical Infrastructure",
    "Manufacturing"
   ],
   "x_securitystudies_eu_relevance": "high"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--fe267809-b98d-54a3-9e8a-636c61dfcb03",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Netherlands",
   "country": "NL"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--56561444-f2fa-5f98-a150-4192444a07ac",
   "created": "2026-11-08T21:16:16.722Z",
   "modified": "2026-11-08T21:16:16.722Z",
   "relationship_type": "related-to",
   "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31",
   "target_ref": "location--fe267809-b98d-54a3-9e8a-636c61dfcb03",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--985edf3b-bbdc-5fce-808b-4e4869bff566",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Germany",
   "country": "DE"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--5bde517c-7bdd-5a8b-9e12-4357c671ee3f",
   "created": "2026-11-08T21:16:16.722Z",
   "modified": "2026-11-08T21:16:16.722Z",
   "relationship_type": "related-to",
   "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31",
   "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--41ac0fa7-2d80-5bda-afc1-65273a433364",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "United Kingdom",
   "country": "GB"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--c8f1404a-837d-5b97-b4ef-9facfcc40be8",
   "created": "2026-11-08T21:16:16.722Z",
   "modified": "2026-11-08T21:16:16.722Z",
   "relationship_type": "related-to",
   "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31",
   "target_ref": "location--41ac0fa7-2d80-5bda-afc1-65273a433364",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Japan",
   "country": "JP"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1620e02b-0832-534f-b54b-9b94c8547bc6",
   "created": "2026-11-08T21:16:16.722Z",
   "modified": "2026-11-08T21:16:16.722Z",
   "relationship_type": "related-to",
   "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--afcd4fe1-ec8e-5dad-b123-13144bc09f07",
   "created": "2026-11-08T21:16:16.722Z",
   "modified": "2026-11-08T21:16:16.722Z",
   "relationship_type": "related-to",
   "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--e458f5b5-c8f5-52a2-87ac-d3b80558d13c",
   "created": "2026-11-08T21:16:16.722Z",
   "modified": "2026-11-08T21:16:16.722Z",
   "relationship_type": "related-to",
   "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627",
   "created": "2026-11-08T21:16:16.709Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Unpatched StyleSmuggler Zero-Day Exploited Across Magento and Adobe Commerce Stores",
   "description": "Dutch security firm Sansec disclosed active exploitation, beginning 4 September 2026, of an unpatched flaw affecting Magento Open Source 2.4.6 through 2.4.9 and Adobe Commerce. Attackers plant PHP code into files Magento writes, such as failure reports, and execution is triggered automatically when the platform renders its routine Payment Transaction Failed Reminder email, requiring no user interaction. The resulting backdoor runs as a process disguised as the Linux kernel thread [kworker/u:8:0], installs binaries in the user home directory rather than the web root, and re-adds cron entries every five minutes. No CVE, patch or official workaround existed as of 6 September 2026, with the next scheduled Adobe security release set for 8 September.",
   "confidence": 50,
   "labels": [
    "other",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/unpatched-stylesmuggler-zero-day-exploited-across-magento-and-adobe-commerce-stores/"
    },
    {
     "source_name": "source",
     "url": "https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-04",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Retail & E-commerce",
    "Technology"
   ],
   "x_securitystudies_eu_relevance": "high"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--0e406bb3-0a39-5075-8f96-d9cd6e06de90",
   "created": "2026-11-08T21:16:16.709Z",
   "modified": "2026-11-08T21:16:16.709Z",
   "relationship_type": "related-to",
   "source_ref": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627",
   "target_ref": "location--fe267809-b98d-54a3-9e8a-636c61dfcb03",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "United States",
   "country": "US"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--d0c66848-781e-57bb-9bb1-d2a4a77b0773",
   "created": "2026-11-08T21:16:16.709Z",
   "modified": "2026-11-08T21:16:16.709Z",
   "relationship_type": "related-to",
   "source_ref": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--3a268a25-e664-5085-8aa6-967531515923",
   "created": "2026-11-08T21:16:16.709Z",
   "modified": "2026-11-08T21:16:16.709Z",
   "relationship_type": "related-to",
   "source_ref": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627",
   "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--f51a42fc-c1bc-5f11-a014-b06620be9890",
   "created": "2026-11-08T21:16:16.709Z",
   "modified": "2026-11-08T21:16:16.709Z",
   "relationship_type": "related-to",
   "source_ref": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--d715dae8-45d7-58c8-9d8b-8b8fc6ebfdcc",
   "created": "2026-11-08T21:16:16.709Z",
   "modified": "2026-11-08T21:16:16.709Z",
   "relationship_type": "related-to",
   "source_ref": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44",
   "created": "2026-11-08T21:16:16.711Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Google Patches Sixth Actively Exploited Chrome Zero-Day of 2026",
   "description": "Google released an emergency Chrome update addressing CVE-2026-85046, a CVSS 8.8 type confusion vulnerability in the V8 JavaScript and WebAssembly engine that enables arbitrary code execution within the renderer sandbox via a crafted HTML page. The flaw was under active exploitation prior to patching and is the sixth exploited Chrome zero-day of 2026. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 September 2026, requiring Federal Civilian Executive Branch agencies to remediate by 18 September 2026. The fix ships in Chrome 152.0.7977.82.",
   "confidence": 50,
   "labels": [
    "other",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/google-patches-sixth-actively-exploited-chrome-zero-day-of-2026/"
    },
    {
     "source_name": "source",
     "url": "https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog"
    },
    {
     "source_name": "source",
     "url": "https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html"
    },
    {
     "source_name": "source",
     "url": "https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/"
    },
    {
     "source_name": "source",
     "url": "https://securityaffairs.com/198405/security/google-fixes-the-sixth-actively-exploited-chrome-zero-day-of-2026.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-04",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Technology",
    "Financial Services",
    "Healthcare"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--7f4ae124-6b26-520d-8306-f3df41bdc29a",
   "created": "2026-11-08T21:16:16.711Z",
   "modified": "2026-11-08T21:16:16.711Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--61f8abc6-b0fd-5c03-ac7f-45ee19b1d8a6",
   "created": "2026-11-08T21:16:16.711Z",
   "modified": "2026-11-08T21:16:16.711Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "South Korea",
   "country": "KR"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--0f08bb4e-8dc7-5fda-8c39-751c887e6e04",
   "created": "2026-11-08T21:16:16.711Z",
   "modified": "2026-11-08T21:16:16.711Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--343d1641-2005-55b4-a2ff-02e0f31e83a4",
   "created": "2026-11-08T21:16:16.711Z",
   "modified": "2026-11-08T21:16:16.711Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--095279bc-69f1-5155-a576-8cfad052b57e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "India",
   "country": "IN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8d466d58-e466-5116-9c0d-9743d902f512",
   "created": "2026-11-08T21:16:16.711Z",
   "modified": "2026-11-08T21:16:16.711Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44",
   "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--dda27c44-0117-5591-abf6-2cffa8099661",
   "created": "2026-11-08T21:16:16.710Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Citrix NetScaler Authentication Bypass CVE-2026-19490 Under Active Attack",
   "description": "Security firm Previdian reported that on 3 September 2026 one of its NetScaler sensors received requests matching public proof-of-concept code from three distinct source IPs geolocated to Australia, the United States and Germany. CVE-2026-19490 permits unprivileged remote attackers to bypass authentication on NetScaler ADC and Gateway appliances configured as AAA virtual servers or gateways, depending on firmware version and SAML Action configuration. Belgium's National Cybersecurity Coordination Centre issued a parallel warning, and more than 22,000 NetScaler ADC appliances are tracked as internet-exposed. Citrix released fixed builds in mid-August 2026.",
   "confidence": 50,
   "labels": [
    "other",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/citrix-netscaler-authentication-bypass-cve-2026-19490-under-active-attack/"
    },
    {
     "source_name": "source",
     "url": "https://www.bleepingcomputer.com/news/security/hackers-target-critical-citrix-netscaler-auth-bypass-in-attacks/"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-03",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Financial Services",
    "Healthcare",
    "Technology"
   ],
   "x_securitystudies_eu_relevance": "high"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--e7883170-4258-5022-ac87-d26ac2502370",
   "created": "2026-11-08T21:16:16.710Z",
   "modified": "2026-11-08T21:16:16.710Z",
   "relationship_type": "related-to",
   "source_ref": "incident--dda27c44-0117-5591-abf6-2cffa8099661",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--0b238368-454f-5156-bb93-34eeb86cd472",
   "created": "2026-11-08T21:16:16.710Z",
   "modified": "2026-11-08T21:16:16.710Z",
   "relationship_type": "related-to",
   "source_ref": "incident--dda27c44-0117-5591-abf6-2cffa8099661",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--39c557e8-6841-50a6-9a0a-9862dc0e6b56",
   "created": "2026-11-08T21:16:16.710Z",
   "modified": "2026-11-08T21:16:16.710Z",
   "relationship_type": "related-to",
   "source_ref": "incident--dda27c44-0117-5591-abf6-2cffa8099661",
   "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--f8de1409-c8bc-547e-863c-07817401d9a2",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Belgium",
   "country": "BE"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--64580759-d4cc-58eb-8d86-aecc9f422b2d",
   "created": "2026-11-08T21:16:16.710Z",
   "modified": "2026-11-08T21:16:16.710Z",
   "relationship_type": "related-to",
   "source_ref": "incident--dda27c44-0117-5591-abf6-2cffa8099661",
   "target_ref": "location--f8de1409-c8bc-547e-863c-07817401d9a2",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7",
   "created": "2026-11-08T21:16:16.706Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "SonicWall SMA 1000 Zero-Day Chain Exploited for Remote Code Execution",
   "description": "SonicWall disclosed that threat actors are chaining two previously unknown vulnerabilities in SMA 1000 remote-access appliances. CVE-2026-83548, a CVSS 10.0 pre-authentication server-side request forgery in the WorkPlace interface, is used to reach internal functionality, and CVE-2026-83549, a CVSS 7.8 OS command injection in the Appliance Management Console, converts that access into arbitrary command execution. CISA added both to the Known Exploited Vulnerabilities catalogue on 2 September 2026 with a remediation deadline of 5 September. Compromise of these appliances yields authenticated network position behind perimeter controls.",
   "confidence": 50,
   "labels": [
    "other",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/sonicwall-sma-1000-zero-day-chain-exploited-for-remote-code-execution/"
    },
    {
     "source_name": "source",
     "url": "https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog"
    },
    {
     "source_name": "source",
     "url": "https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/"
    },
    {
     "source_name": "source",
     "url": "https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-02",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Technology",
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "high"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--93a4b897-9098-5258-8f78-c11ca62c9c2d",
   "created": "2026-11-08T21:16:16.706Z",
   "modified": "2026-11-08T21:16:16.706Z",
   "relationship_type": "related-to",
   "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--7c1fb9eb-6517-5d3f-a593-dbe41586b7ec",
   "created": "2026-11-08T21:16:16.706Z",
   "modified": "2026-11-08T21:16:16.706Z",
   "relationship_type": "related-to",
   "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1e87d0f6-5cc6-563d-884f-7c283893a9e7",
   "created": "2026-11-08T21:16:16.706Z",
   "modified": "2026-11-08T21:16:16.706Z",
   "relationship_type": "related-to",
   "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7",
   "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--75c8ae31-9b94-5ba7-a159-38dd7168e3f1",
   "created": "2026-11-08T21:16:16.706Z",
   "modified": "2026-11-08T21:16:16.706Z",
   "relationship_type": "related-to",
   "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--70de3750-edaf-5bef-8617-848f92724d94",
   "created": "2026-11-08T21:16:16.706Z",
   "modified": "2026-11-08T21:16:16.706Z",
   "relationship_type": "related-to",
   "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Russian-speaking actor uses hundreds of AI agents to exploit PaperCut across 48 countries",
   "description": "Blackpoint Cyber and GreyNoise Intelligence reported a Russian-speaking actor operating from 45.142.193[.]132 who used hundreds of AI agents powered by OpenAI Codex and DeepSeek models to exploit PaperCut CVE-2026-81578 and CVE-2026-82078. Vulnerability research began on 31 August 2026 and remote code execution against the first victim was achieved in under four hours, with 11 organisations compromised within 26 seconds of campaign launch and one high school taken from initial access to domain admin in seven minutes. In total 440+ PaperCut MF/NG instances across 395 organisations in 48 countries were compromised, with education targets in Australia, the US, UK, France, Spain, Canada, Belgium, Portugal, Germany and Switzerland. Post-exploitation tooling included Mimikatz, SharpHound, Certipy, Rubeus and Impacket; domain administrator was obtained at 12 organisations.",
   "confidence": 50,
   "labels": [
    "other",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/russian-speaking-actor-uses-hundreds-of-ai-agents-to-exploit-papercut-across-48-countries/"
    },
    {
     "source_name": "source",
     "url": "https://thehackernews.com/2026/09/papercut-attacker-uses-hundreds-of-ai.html"
    },
    {
     "source_name": "source",
     "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
    }
   ],
   "x_securitystudies_occurred_on": "2026-08-31",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Education",
    "Government",
    "Professional Services"
   ],
   "x_securitystudies_eu_relevance": "high"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--6c899edb-5dd1-57ff-8c6f-a43cede344b0",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--e91bd8e7-8960-5be2-9b2f-c4c765833a5d",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8b495a5b-8600-5b3a-95b0-888dc02210c8",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--41ac0fa7-2d80-5bda-afc1-65273a433364",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--f9d2ee61-54dd-59f4-bd2d-fbac39debc46",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "France",
   "country": "FR"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--08b210a2-2294-5716-9964-7bae63b44f38",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--f9d2ee61-54dd-59f4-bd2d-fbac39debc46",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--562bb4c5-4ed9-580f-b37e-c9ae676755f0",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Spain",
   "country": "ES"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--b9797bf5-7ce0-51b3-84c6-5a99c433cc27",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--562bb4c5-4ed9-580f-b37e-c9ae676755f0",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--7f77e251-85bd-53e4-bc72-1edcb2d04d5d",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Canada",
   "country": "CA"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--f253adaa-4dbc-5476-8cfd-5622ac6d9a2a",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--7f77e251-85bd-53e4-bc72-1edcb2d04d5d",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--67b1d27a-748d-56d6-a1fa-4d0634924114",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--f8de1409-c8bc-547e-863c-07817401d9a2",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--dd1bec90-2604-53f0-953a-bab543805077",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Portugal",
   "country": "PT"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--4c3eefe1-da2d-56c5-8e34-790324e9bbc5",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--dd1bec90-2604-53f0-953a-bab543805077",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8b803bdb-0ca1-5685-be70-4eacad913cac",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--aa8b441f-2a10-5e00-b00e-56ba6bfa70f6",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Switzerland",
   "country": "CH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--b9b6c5c4-944f-5c7b-a4ce-071374ff250a",
   "created": "2026-11-08T21:16:16.720Z",
   "modified": "2026-11-08T21:16:16.720Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a129b2a-ed88-5d0e-a430-eb2edfdd612a",
   "target_ref": "location--aa8b441f-2a10-5e00-b00e-56ba6bfa70f6",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--886dc369-da7a-5eb5-9539-82519eab05eb",
   "created": "2026-11-08T21:16:16.700Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Quest Aparthotel Chain Exposes Guest PII via Third-Party Breach",
   "description": "Australian aparthotel chain Quest, which operates more than 120 properties across Australia, New Zealand and Fiji, disclosed unauthorised access to a database run by a third-party service provider, detected on 17 August 2026. Exposed guest records from before June 2025 included full names, email and contact details, and dates of birth in a small number of records.",
   "confidence": 50,
   "labels": [
    "data_breach",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/quest-aparthotel-chain-exposes-guest-pii-via-third-party-breach/"
    },
    {
     "source_name": "source",
     "url": "https://www.theregister.com/cyber-crime/2026/08/19/australian-hotel-chain-leaks-guests-pii-after-breach-at-third-party-database-operator/5289341"
    }
   ],
   "x_securitystudies_occurred_on": "2026-08-17",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "hospitality"
   ],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--a1dbc73a-c492-54a4-8580-26e002a7c1ab",
   "created": "2026-11-08T21:16:16.700Z",
   "modified": "2026-11-08T21:16:16.700Z",
   "relationship_type": "related-to",
   "source_ref": "incident--886dc369-da7a-5eb5-9539-82519eab05eb",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--6e0bbb2b-f502-57ac-b1f5-25e3061c30a8",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "New Zealand",
   "country": "NZ"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--ec9bdd9d-c835-5122-bf1d-a7f11134c36c",
   "created": "2026-11-08T21:16:16.700Z",
   "modified": "2026-11-08T21:16:16.700Z",
   "relationship_type": "related-to",
   "source_ref": "incident--886dc369-da7a-5eb5-9539-82519eab05eb",
   "target_ref": "location--6e0bbb2b-f502-57ac-b1f5-25e3061c30a8",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--6c5e711a-8a33-5240-b0a3-6c917d821bc0",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Fiji",
   "country": "FJ"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--d1f94613-a2da-5e0b-9f1c-6bc655a2e3ff",
   "created": "2026-11-08T21:16:16.700Z",
   "modified": "2026-11-08T21:16:16.700Z",
   "relationship_type": "related-to",
   "source_ref": "incident--886dc369-da7a-5eb5-9539-82519eab05eb",
   "target_ref": "location--6c5e711a-8a33-5240-b0a3-6c917d821bc0",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--8da29e79-0082-5823-b874-886f01521c8d",
   "created": "2026-11-08T21:16:16.716Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Three threat clusters exploit Cisco Secure FMC flaws to steal credentials and deploy Qilin ransomware",
   "description": "Cisco Talos identified three distinct clusters exploiting CVE-2026-20079, a CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center, alongside the lower-severity CVE-2026-20316. UAT-12197 deployed JSP web shells and Java command executors to harvest credentials and authentication data from internal databases; UAT-11823 delivered reverse shells and configuration harvesting scripts and deployed Cyclops Blink, previously attributed to Russian state-sponsored Sandworm; UAT-11988 used legitimate FMC tooling for reconnaissance and credential collection before deploying Qilin ransomware. CISA added CVE-2026-20079 to the KEV catalog on 9 September 2026 with a 12 September federal deadline.",
   "confidence": 50,
   "labels": [
    "ransomware",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/three-threat-clusters-exploit-cisco-secure-fmc-flaws-to-steal-credentials-and-deploy-qilin-ransomware/"
    },
    {
     "source_name": "source",
     "url": "https://thehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html"
    },
    {
     "source_name": "source",
     "url": "https://securityaffairs.com/198884/cyber-crime/attackers-exploit-critical-cisco-fmc-flaw-to-deploy-qilin-ransomware.html"
    },
    {
     "source_name": "source",
     "url": "https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-three-known-exploited-vulnerabilities-catalog"
    }
   ],
   "x_securitystudies_occurred_on": "2026-08-15",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Technology",
    "Critical Infrastructure",
    "Government",
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "high"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--17605ae0-95ba-5855-9399-554213716d97",
   "created": "2026-11-08T21:16:16.716Z",
   "modified": "2026-11-08T21:16:16.716Z",
   "relationship_type": "related-to",
   "source_ref": "incident--8da29e79-0082-5823-b874-886f01521c8d",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8afda179-e386-520e-9d50-139939763d98",
   "created": "2026-11-08T21:16:16.716Z",
   "modified": "2026-11-08T21:16:16.716Z",
   "relationship_type": "related-to",
   "source_ref": "incident--8da29e79-0082-5823-b874-886f01521c8d",
   "target_ref": "location--41ac0fa7-2d80-5bda-afc1-65273a433364",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--ace93ef1-0e87-532c-96b6-ee889dfbb28a",
   "created": "2026-11-08T21:16:16.716Z",
   "modified": "2026-11-08T21:16:16.716Z",
   "relationship_type": "related-to",
   "source_ref": "incident--8da29e79-0082-5823-b874-886f01521c8d",
   "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--bf715ab9-663b-51d6-bc29-4d565ea0a3de",
   "created": "2026-11-08T21:16:16.716Z",
   "modified": "2026-11-08T21:16:16.716Z",
   "relationship_type": "related-to",
   "source_ref": "incident--8da29e79-0082-5823-b874-886f01521c8d",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Salt Typhoon Telecom Espionage Campaign — Ongoing",
   "description": "Chinese state-sponsored group Salt Typhoon (also tracked as GhostEmperor/FamousSparrow) continues to maintain persistent access to major US, Southeast Asian, and Australian telecommunications networks. The campaign, first publicly disclosed in late 2024, has been confirmed to compromise call detail records and lawful intercept systems across at least 9 major carriers. As of May 2026, incident response is ongoing at several ASEAN-region telecoms. CISA has issued updated advisories recommending encrypted communications for government officials.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/salt-typhoon-telecom-espionage-campaign-ongoing/"
    },
    {
     "source_name": "source",
     "url": {
      "title": "CISA Advisory AA24-340A",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-340a"
     }
    },
    {
     "source_name": "source",
     "url": {
      "title": "Microsoft Threat Intelligence",
      "url": "https://www.microsoft.com/en-us/security/blog/"
     }
    }
   ],
   "x_securitystudies_occurred_on": "2024-09-15",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Telecommunications",
    "Government",
    "Defense"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--435d00ae-93cc-5b82-973d-553a2ad2316c",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Philippines",
   "country": "PH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8108d9cb-277e-53fe-b5e8-3795c21eb8aa",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Thailand",
   "country": "TH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--9072f4ee-c5de-5753-a3e6-9be0f67cbc1b",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--d963c41d-ea95-5987-a1e4-a461feb2cbdc",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Indonesia",
   "country": "ID"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--26c5417c-4add-561a-9231-6a9797918e9d",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Taiwan",
   "country": "TW"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8be3764b-86b0-5fde-af53-2f87940a6fa2",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--642c612d-bcf7-5030-bd96-c51cad00d04e",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--994a786f-903b-5827-8b99-fb2bcf62d3db",
   "created": "2026-11-09T04:30:08.681Z",
   "modified": "2026-11-09T04:30:08.681Z",
   "name": "GhostEmperor",
   "aliases": [
    "FamousSparrow",
    "OPERATOR PANDA",
    "RedMike",
    "Salt Typhoon",
    "UNC2286"
   ],
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "G1045",
     "url": "https://attack.mitre.org/groups/G1045/"
    },
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/ghostemperor/"
    }
   ],
   "description": "GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--344356d8-39e3-5c5b-b48f-9b5cf793a03a",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "intrusion-set--994a786f-903b-5827-8b99-fb2bcf62d3db",
   "description": "attribution"
  }
 ]
}