{
 "type": "bundle",
 "id": "bundle--26a32d55-fe4f-4cb3-938d-9ad6d599b13d",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-13T06:07:08.574Z",
   "name": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns",
   "description": "Detected automatically from 2 articles in 2 outlets (Check Point Research, Microsoft Threat Intelligence), Nov 5 to Nov 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea, Hong Kong, Thailand, Cambodia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "espionage",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/hacking-on-autopilot-inside-artex-cybercrime-campaigns-20261105/"
    },
    {
     "source_name": "Check Point Research",
     "url": "https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/",
     "description": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns"
    },
    {
     "source_name": "Microsoft Threat Intelligence",
     "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "description": "ARTEX abuse expands as cybercriminals target financial sector"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-05",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Hong Kong",
   "country": "HK"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--ef85cfba-0238-5680-aea1-65608ed33612",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--045a1890-e799-520f-8119-ae91e4fb69bb",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Cambodia",
   "country": "KH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--9b12a351-49f3-59e1-9cc0-9a00ca31b2c8",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--045a1890-e799-520f-8119-ae91e4fb69bb",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "South Korea",
   "country": "KR"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--2990eb21-033c-5af2-8a5b-46e23b3cb343",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Thailand",
   "country": "TH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--7985a9d6-9e8b-57bc-9e3e-2829147cbdd9",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6",
   "created": "2026-11-09T04:30:05.339Z",
   "modified": "2026-11-09T04:30:05.339Z",
   "name": "Storm-0940",
   "aliases": [
    "CovertNetwork-1658",
    "ORB07"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/storm-0940/"
    }
   ],
   "description": "Storm-0940 is a Chinese threat actor active since at least 2021, known for gaining initial access through password spray and brute-force attacks, as well as exploiting network edge applications. Microsoft has observed Storm-0940 utilizing valid credentials obtained from CovertNetwork-1658's password spray operations, indicating a close operational relationship between the two. Once inside a victim environment, Storm-0940 has been seen leveraging compromised credentials for further malicious activities. Additionally, Storm-0940 has employed botnets, such as Quad7, to facilitate password spraying attacks."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1999587e-b927-574f-9ab1-fa9a82d2d58e",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6",
   "description": "actor named in the coverage (the sources' attribution)"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-13T06:07:08.404Z",
   "name": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack",
   "description": "Detected automatically from 8 articles in 7 outlets (Bangkok Post, Channel News Asia, Malay Mail, Matichon, South China Morning Post, The Straits Times and others), Oct 30 to Nov 10, 2026. Type: data breach; sectors: transportation, technology. Asia-Pacific countries affected: Thailand, Japan, Singapore, Hong Kong, Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/cathay-pacific-says-data-from-53000-bookings-compromised-in-amadeus-cy-20261030/"
    },
    {
     "source_name": "South China Morning Post",
     "url": "https://www.scmp.com/news/hong-kong/transport/article/3372722/cathay-pacific-says-data-53000-bookings-compromised-amadeus-cyberattack",
     "description": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack"
    },
    {
     "source_name": "Malay Mail",
     "url": "https://www.malaymail.com/news/malaysia/2026/11/01/malaysia-airlines-warns-customers-of-data-exposure-in-amadeus-cybersecurity-breach/241516",
     "description": "Malaysia Airlines warns customers of data exposure in Amadeus cybersecurity breach"
    },
    {
     "source_name": "The Straits Times",
     "url": "https://www.straitstimes.com/singapore/46000-sia-booking-records-accessed-illegally-in-data-breach-affecting-software-provider-amadeus",
     "description": "46,000 SIA booking records accessed illegally in data breach affecting software provider Amadeus"
    },
    {
     "source_name": "Channel News Asia",
     "url": "https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151",
     "description": "About 46,000 SIA booking records accessed in data breach involving travel tech company Amadeus"
    },
    {
     "source_name": "Matichon",
     "url": "https://www.matichon.co.th/economy/news_5969157",
     "description": "การบินไทย รับถูกแฮก ข้อมูลรั่ว 6 หมื่นรายการ แต่ไม่กระทบข้อมูลบัตรเครดิต"
    },
    {
     "source_name": "Bangkok Post",
     "url": "https://www.bangkokpost.com/thailand/general/3352180/60000-thai-bookings-compromised-in-amadeus-breach",
     "description": "THAI passenger data compromised in Amadeus security breach"
    },
    {
     "source_name": "The Thaiger",
     "url": "https://thethaiger.com/news/world/aviation/thai-airways-confirms-passenger-data-leak-but-credit-card-details-safe",
     "description": "Thai Airways confirms passenger data leak but credit card details safe"
    },
    {
     "source_name": "Matichon",
     "url": "https://www.matichon.co.th/economy/news_5969937",
     "description": "การบินไทย แจ้ง ไซเบอร์โจมตี ข้อมูล 6 หมื่นรายการรั่วไหล ไชยชนก ถก ‘แอปเปิ้ล’ สกัด"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-30",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Transportation",
    "Technology"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--d8dcd32a-245a-5e4c-b9bc-e5e43b9093eb",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Japan",
   "country": "JP"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--317010bf-0058-51a9-b822-d6d704efbe31",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Malaysia",
   "country": "MY"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--a3ed75f2-2699-5840-b35c-27be8a40c0cc",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Singapore",
   "country": "SG"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--dc48e5ec-d80c-5cbd-bea5-0fd84c8f8607",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--6dac9bd3-fa51-5640-8e1c-99147e4a1ad5",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  }
 ]
}