{
 "type": "bundle",
 "id": "bundle--ee953f18-022d-4cdb-820c-e8060f04d5b1",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--c84baddd-8436-5a7e-bf6f-249d8454cd51",
   "created": "2026-11-10T16:32:08.013Z",
   "modified": "2026-11-10T16:40:20.414Z",
   "name": "South Korea bank hack suspect may be 26-year-old in China, U.S. firm says",
   "description": "Detected automatically from 4 articles in 4 outlets (Channel News Asia, New York Times China, Taipei Times, The Japan Times), Oct 8, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: China. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "espionage",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/south-korea-bank-hack-suspect-may-be-26-year-old-in-china-us-firm-says-20261008/"
    },
    {
     "source_name": "The Japan Times",
     "url": "https://www.japantimes.co.jp/business/2026/10/08/south-korea-cyberattack-china-suspect/",
     "description": "South Korea bank hack suspect may be 26-year-old in China, U.S. firm says"
    },
    {
     "source_name": "Channel News Asia",
     "url": "https://www.channelnewsasia.com/business/crowdstrike-says-china-based-suspect-used-ai-tools-in-south-korean-bank-hacks-6441386",
     "description": "CrowdStrike says China-based suspect used AI tools in South Korean bank hacks"
    },
    {
     "source_name": "New York Times China",
     "url": "https://www.nytimes.com/2026/10/08/world/australia/south-korea-bank-hack-china-us-ai.html",
     "description": "Hacker Used Chinese-Developed A.I. Tool to Target South Korean Banks, CrowdStrike Says"
    },
    {
     "source_name": "Taipei Times",
     "url": "https://www.taipeitimes.com/News/front/archives/2026/10/09/2003865655",
     "description": "S Korean banks likely hacked by China-based actor: CrowdStrike"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-08",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--231e90b4-4920-54e1-af65-e3447d240a54",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "China",
   "country": "CN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--2c908ce6-1ad8-53ce-862f-6f73cc5830a9",
   "created": "2026-11-10T16:32:08.013Z",
   "modified": "2026-11-10T16:32:08.013Z",
   "relationship_type": "related-to",
   "source_ref": "incident--c84baddd-8436-5a7e-bf6f-249d8454cd51",
   "target_ref": "location--231e90b4-4920-54e1-af65-e3447d240a54",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "SecFlow Campaign Uses Commercial AI Agents Against Taiwanese and Indonesian Government Targets",
   "description": "Hunt.io researchers documented Chinese-speaking operators running the SecFlow framework across five exposed directories, routing requests to Claude, Qwen and DeepSeek through private proxy servers on the niestools.com domain as interchangeable operational components. Confirmed targets include Kuomintang Party political archives in Taiwan, the Indonesian Ministry of Foreign Affairs, industrial hosts in Vietnam, and government, education and industrial entities in China. The operators deployed the GLUTTON webshell framework and ASPX web shells, used steganographic PNG payload delivery and a fake MySQL deserialization service, and dumped LSASS memory in 37-block segments. Confirmed impact totals 822 compromised office-automation user records and 1.28GB of exfiltrated data including patient health information.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/secflow-campaign-uses-commercial-ai-agents-against-taiwanese-and-indonesian-government-targets/"
    },
    {
     "source_name": "source",
     "url": "https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-04",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Education",
    "Manufacturing",
    "Healthcare"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Taiwan",
   "country": "TW"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--e7abb989-2773-57b7-ae68-ece06d3664fd",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Indonesia",
   "country": "ID"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--4f4f93e7-0fc6-5ae0-a6a0-54fca02eacca",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Vietnam",
   "country": "VN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--46ddf5df-0dfa-5683-b9b8-91ab537721e4",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--fb865868-8a32-500d-8fd8-2f35681509ce",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--231e90b4-4920-54e1-af65-e3447d240a54",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Thailand",
   "country": "TH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1df41102-2f1d-5e81-b020-e232fb5f92f8",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--51e9a2ca-ecb1-5c26-a8b7-e7de025a6086",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Afghanistan",
   "country": "AF"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8e9b5194-01ee-57c0-8e08-073a02c4576d",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--51e9a2ca-ecb1-5c26-a8b7-e7de025a6086",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--74657fff-2b96-5e87-8bba-660969e4162e",
   "created": "2026-11-08T21:16:16.719Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "China-linked SecFlow campaign uses AI agents against Asian government and industrial targets",
   "description": "Hunt.io documented a Chinese-speaking operation tracked as SecFlow, linked to a username 'Nie' recurring across its infrastructure, which routed Claude, Qwen and DeepSeek through private proxies at niestools.com to automate reconnaissance and exploitation. The toolkit included the GLUTTON webshell framework delivering steganographic payloads inside PNG files, a fake MySQL deserialization service, a Java and CAS exploitation workspace, and Shellshock and credential-testing nodes. Confirmed targeting spanned Kuomintang Party archives in Taiwan, the Indonesian Ministry of Foreign Affairs, and Chinese and Vietnamese government, education and industrial hosts. A confirmed breach of the Fengtai District government office-automation environment yielded 822 OA user records and 1.28GB of data including patient health information.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/china-linked-secflow-campaign-uses-ai-agents-against-asian-government-and-industrial-targets/"
    },
    {
     "source_name": "source",
     "url": "https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-08-20",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Education",
    "Defense",
    "Industrial"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--71e28321-0abc-5e25-965c-aa00c51fe6c5",
   "created": "2026-11-08T21:16:16.719Z",
   "modified": "2026-11-08T21:16:16.719Z",
   "relationship_type": "related-to",
   "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--6f5180ac-106f-503e-86ac-5890fc36ea67",
   "created": "2026-11-08T21:16:16.719Z",
   "modified": "2026-11-08T21:16:16.719Z",
   "relationship_type": "related-to",
   "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e",
   "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--25b1769c-a3f9-5501-9181-7fe452a1ef4b",
   "created": "2026-11-08T21:16:16.719Z",
   "modified": "2026-11-08T21:16:16.719Z",
   "relationship_type": "related-to",
   "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e",
   "target_ref": "location--231e90b4-4920-54e1-af65-e3447d240a54",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--6ca59b95-4835-5e06-8708-e735d0538a5c",
   "created": "2026-11-08T21:16:16.719Z",
   "modified": "2026-11-08T21:16:16.719Z",
   "relationship_type": "related-to",
   "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e",
   "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "description": "affected country"
  }
 ]
}