{
 "type": "bundle",
 "id": "bundle--59590f8c-3f7f-49c3-8726-be107ac35062",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--1bc09e60-d48b-59ff-9227-e5d911f09a5f",
   "created": "2026-11-11T20:35:29.928Z",
   "modified": "2026-11-13T06:07:08.619Z",
   "name": "SonicWall SSL-VPN authentication bypass vulnerability exploited in actual attacks, multi-factor authentication also neutralized",
   "description": "Detected automatically from 1 article in 1 outlet (Dailysecu (Korean)), Nov 9, 2026. Title machine-translated from Korean. Type: exploitation. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "exploitation",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/sonicwall-ssl-vpn-authentication-bypass-vulnerability-exploited-in-act-20261109/"
    },
    {
     "source_name": "Dailysecu (Korean)",
     "url": "https://www.dailysecu.com/news/articleView.html?idxno=209394",
     "description": "소닉월 SSL-VPN 인증 우회 취약점 실제 공격에 악용, 다중인증도 무력화"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-09",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "South Korea",
   "country": "KR"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--fe97fcb5-287d-56c6-a798-914b08267c23",
   "created": "2026-11-11T20:35:29.928Z",
   "modified": "2026-11-11T20:35:29.928Z",
   "relationship_type": "related-to",
   "source_ref": "incident--1bc09e60-d48b-59ff-9227-e5d911f09a5f",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "vulnerability",
   "id": "vulnerability--502a9f8f-a5b4-5afc-abed-dfd1c77c5cd6",
   "created": "2026-11-13T05:15:33.953Z",
   "modified": "2026-11-13T05:15:33.953Z",
   "name": "CVE-2026-19868",
   "external_references": [
    {
     "source_name": "cve",
     "external_id": "CVE-2026-19868"
    }
   ],
   "description": "SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--fa591481-207c-519e-a125-a9c868ca1360",
   "created": "2026-11-11T20:35:29.928Z",
   "modified": "2026-11-11T20:35:29.928Z",
   "relationship_type": "related-to",
   "source_ref": "incident--1bc09e60-d48b-59ff-9227-e5d911f09a5f",
   "target_ref": "vulnerability--502a9f8f-a5b4-5afc-abed-dfd1c77c5cd6",
   "description": "vulnerability exploited"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-13T06:07:08.574Z",
   "name": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns",
   "description": "Detected automatically from 2 articles in 2 outlets (Check Point Research, Microsoft Threat Intelligence), Nov 5 to Nov 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea, Hong Kong, Thailand, Cambodia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "espionage",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/hacking-on-autopilot-inside-artex-cybercrime-campaigns-20261105/"
    },
    {
     "source_name": "Check Point Research",
     "url": "https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/",
     "description": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns"
    },
    {
     "source_name": "Microsoft Threat Intelligence",
     "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "description": "ARTEX abuse expands as cybercriminals target financial sector"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-05",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Hong Kong",
   "country": "HK"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--ef85cfba-0238-5680-aea1-65608ed33612",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--045a1890-e799-520f-8119-ae91e4fb69bb",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Cambodia",
   "country": "KH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--9b12a351-49f3-59e1-9cc0-9a00ca31b2c8",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--045a1890-e799-520f-8119-ae91e4fb69bb",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--2990eb21-033c-5af2-8a5b-46e23b3cb343",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Thailand",
   "country": "TH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--7985a9d6-9e8b-57bc-9e3e-2829147cbdd9",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6",
   "created": "2026-11-09T04:30:05.339Z",
   "modified": "2026-11-09T04:30:05.339Z",
   "name": "Storm-0940",
   "aliases": [
    "CovertNetwork-1658",
    "ORB07"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/storm-0940/"
    }
   ],
   "description": "Storm-0940 is a Chinese threat actor active since at least 2021, known for gaining initial access through password spray and brute-force attacks, as well as exploiting network edge applications. Microsoft has observed Storm-0940 utilizing valid credentials obtained from CovertNetwork-1658's password spray operations, indicating a close operational relationship between the two. Once inside a victim environment, Storm-0940 has been seen leveraging compromised credentials for further malicious activities. Additionally, Storm-0940 has employed botnets, such as Quad7, to facilitate password spraying attacks."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1999587e-b927-574f-9ab1-fa9a82d2d58e",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6",
   "description": "actor named in the coverage (the sources' attribution)"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--ca649294-37b3-58a6-b905-21498e809401",
   "created": "2026-11-10T16:32:08.548Z",
   "modified": "2026-11-13T06:07:08.467Z",
   "name": "Personal information of Lee, presidential staff leaked: report",
   "description": "Detected automatically from 11 articles in 6 outlets (Hankyoreh, NHK, New Talk, South China Morning Post, The Korea Herald, Yonhap), Nov 2 to Nov 4, 2026. Type: data breach; sectors: government. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/personal-information-of-lee-presidential-staff-leaked-report-20261102/"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261102013200320",
     "description": "Personal information of Lee, presidential staff leaked: report"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261102013251320",
     "description": "(LEAD) Personal information of Lee, presidential staff leaked: report"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261103003700315",
     "description": "Presidential office holds emergency meeting over leak of personal data of president, trip entourage"
    },
    {
     "source_name": "The Korea Herald",
     "url": "https://www.koreaherald.com/article/10923757",
     "description": "Presidential office holds emergency meeting over leak of personal data of president, trip entourage"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261103003751315",
     "description": "(LEAD) Presidential office holds emergency meeting over leak of personal data of president, trip entourage"
    },
    {
     "source_name": "South China Morning Post",
     "url": "https://www.scmp.com/news/asia/east-asia/article/3373065/south-korea-rushes-reissue-passports-president-lee-wife-after-data-leak",
     "description": "South Korea rushes to reissue passports to President Lee, wife after data leak"
    },
    {
     "source_name": "New Talk",
     "url": "https://newtalk.tw/news/view/2026-11-03/1069015",
     "description": "長達逾5個月！ 李在明護照資料遭公開 韓國政府急善後..."
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261103010400315",
     "description": "Main opposition slams presidential office for leak of Lee's personal data"
    },
    {
     "source_name": "NHK",
     "url": "https://news.web.nhk/newsweb/na/nd-20261103de70007",
     "description": "韓国大統領や高官の個人情報流出 イ大統領パスポート再発行へ"
    },
    {
     "source_name": "Hankyoreh",
     "url": "https://www.hani.co.kr/arti/english_edition/e_national/1285585.html",
     "description": "Passport numbers of Lee, 167 others leaked in presidential jet data breach"
    },
    {
     "source_name": "Hankyoreh",
     "url": "https://www.hani.co.kr/arti/english_edition/e_national/1285767.html",
     "description": "Foreign Ministry employee likely behind presidential jet passenger data leak"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-02",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Government"
   ],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--6dbd0ffd-b3ab-5689-9e97-81680954e607",
   "created": "2026-11-10T16:32:08.548Z",
   "modified": "2026-11-10T16:32:08.548Z",
   "relationship_type": "related-to",
   "source_ref": "incident--ca649294-37b3-58a6-b905-21498e809401",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--1936f227-2555-556b-92d4-7f48f4860626",
   "created": "2026-11-10T16:32:08.478Z",
   "modified": "2026-11-13T06:07:08.394Z",
   "name": "North Korean actors steal $6.36B from Binance in largest crypto theft in history",
   "description": "Detected automatically from 35 articles in 16 outlets (Channel News Asia, Daily NK, Free Malaysia Today, Hankyoreh, Japan Today, Liberty Times and others), Oct 30 to Nov 13, 2026. Type: cryptocurrency theft; sectors: cryptocurrency, technology. Asia-Pacific countries affected: South Korea. Largest figure in the headlines: 200,000,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "crypto_theft",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/binance-th-pauses-crypto-transfers-says-thai-funds-safe-after-hack-20261030/"
    },
    {
     "source_name": "The Thaiger",
     "url": "https://thethaiger.com/news/business/binance-th-pauses-crypto-transfers-after-hack",
     "description": "Binance TH pauses crypto transfers, says Thai funds safe after hack"
    },
    {
     "source_name": "NK Pro",
     "url": "https://www.nknews.org/pro/north-korean-actors-steal-6-36b-from-binance-in-largest-crypto-theft-in-history/",
     "description": "North Korean actors steal $6.36B from Binance in largest crypto theft in history"
    },
    {
     "source_name": "New Talk",
     "url": "https://newtalk.tw/news/view/2026-10-30/1068375",
     "description": "金將軍又缺錢？ 幣安2千多億加密貨幣遭駭創歷來之最 北韓遭認是兇手"
    },
    {
     "source_name": "Liberty Times",
     "url": "https://ec.ltn.com.tw/article/breakingnews/5624143",
     "description": "史上最大駭客攻擊！幣安遭竊逾2000億 美分析指向北韓"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261031000200315",
     "description": "N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261031000251315",
     "description": "(LEAD) N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261031000252315",
     "description": "(2nd LD) N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm"
    },
    {
     "source_name": "Japan Today",
     "url": "https://japantoday.com/category/world/hackers-steal-6.3-billion-from-binance-in-record-heist-blamed-on-north-korea4",
     "description": "Hackers steal $6.3 billion from Binance in record heist blamed on North Korea"
    },
    {
     "source_name": "The Korea Herald",
     "url": "https://www.koreaherald.com/article/10921226",
     "description": "N. Korean hackers blamed for record $6.3b Binance cryptocurrency theft: US firm"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261101000300315",
     "description": "FBI says N. Korea responsible for over US$6 bln crypto theft from Binance"
    },
    {
     "source_name": "The Japan Times",
     "url": "https://www.japantimes.co.jp/business/2026/11/01/tech/binance-hack-fbi-north-korea/",
     "description": "FBI blames North Korea for $6 billion Binance crypto hack"
    },
    {
     "source_name": "South China Morning Post",
     "url": "https://www.scmp.com/news/world/united-states-canada/article/3372858/fbi-blames-north-korea-stolen-billions-binance-biggest-hack-history",
     "description": "FBI blames North Korea for stolen billions from Binance in biggest hack in history"
    },
    {
     "source_name": "New Talk",
     "url": "https://newtalk.tw/news/view/2026-11-01/1068564",
     "description": "幣安逾60億美元資產遭竊　FBI指北韓所為"
    },
    {
     "source_name": "The Korea Herald",
     "url": "https://www.koreaherald.com/article/10921526",
     "description": "FBI says N. Korea responsible for over $6b crypto theft from Binance"
    },
    {
     "source_name": "NHK",
     "url": "https://news.web.nhk/newsweb/na/nd-20261101de69102",
     "description": "暗号資産大手バイナンスへのサイバー攻撃 FBI“北朝鮮が関与”"
    },
    {
     "source_name": "The Korea Herald",
     "url": "https://www.koreaherald.com/article/10921777",
     "description": "North Korean cyberterrorism gains renewed scrutiny after record Binance heist"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261101000351315",
     "description": "(LEAD) Trump says U.S. will talk to N. Korea if it is behind Binance hack"
    },
    {
     "source_name": "Free Malaysia Today",
     "url": "https://www.freemalaysiatoday.com/category/business/2026/11/01/fbi-says-north-korea-behind-us-6bil-crypto-theft-from-binance",
     "description": "FBI says North Korea behind US$6bil crypto theft from Binance"
    },
    {
     "source_name": "Taipei Times",
     "url": "https://www.taipeitimes.com/News/biz/archives/2026/11/02/2003866975",
     "description": "N Korea behind US$6bn crypto theft, FBI says"
    },
    {
     "source_name": "New Talk",
     "url": "https://newtalk.tw/news/view/2026-11-02/1068750",
     "description": "20分鐘盜逾60億美元加密貨幣! 北韓駭客疑感情詐騙滲透幣安工程師 川普這樣說...."
    },
    {
     "source_name": "NK Pro",
     "url": "https://www.nknews.org/pro/fbi-confirms-north-korea-behind-record-6-36b-binance-crypto-heist/",
     "description": "FBI confirms North Korea behind record $6.36B Binance crypto heist"
    },
    {
     "source_name": "The Japan Times",
     "url": "https://www.japantimes.co.jp/business/2026/11/02/binance-outflows-north-korea-hack/",
     "description": "Binance outflows hit $4.7 billion after record North Korea hack"
    },
    {
     "source_name": "Hankyoreh",
     "url": "https://www.hani.co.kr/arti/english_edition/e_northkorea/1285383.html",
     "description": "FBI identifies North Korean hackers as responsible for unprecedented Binance breach"
    },
    {
     "source_name": "NK News",
     "url": "https://www.nknews.org/2026/11/kim-yo-jong-denies-north-korean-involvement-in-6b-binance-crypto-theft/",
     "description": "Kim Yo Jong denies North Korean involvement in $6B Binance crypto theft"
    },
    {
     "source_name": "Channel News Asia",
     "url": "https://www.channelnewsasia.com/east-asia/north-korea-binance-hack-fbi-grave-provocation-6514311",
     "description": "North Korea slams FBI allegations over Binance hack as 'grave' provocation"
    },
    {
     "source_name": "The Japan Times",
     "url": "https://www.japantimes.co.jp/news/2026/11/03/asia-pacific/north-korea-binance-us-hacking/",
     "description": "North Korea calls U.S. claims it was behind Binance hack ‘a grave political provocation’"
    },
    {
     "source_name": "Free Malaysia Today",
     "url": "https://www.freemalaysiatoday.com/category/world/2026/11/03/n-korea-slams-fbi-allegations-over-binance-hack-as-grave-provocation",
     "description": "N. Korea slams FBI allegations over Binance hack as ‘grave’ provocation"
    },
    {
     "source_name": "South China Morning Post",
     "url": "https://www.scmp.com/news/world/united-states-canada/article/3373050/sister-north-koreas-kim-slams-fbis-binance-hack-allegations-grave-provocation",
     "description": "Sister of North Korea’s Kim slams FBI’s Binance hack allegations as ‘grave’ provocation"
    },
    {
     "source_name": "VN Express",
     "url": "https://vnexpress.net/trieu-tien-dap-tra-cao-buoc-tan-cong-mang-binance-tu-fbi-5139936.html",
     "description": "Triều Tiên đáp trả cáo buộc 'tấn công mạng Binance' từ FBI"
    },
    {
     "source_name": "NHK",
     "url": "https://news.web.nhk/newsweb/na/nd-20261103de69881",
     "description": "世界的な暗号資産取引所へのサイバー攻撃　北朝鮮が関与否定"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-30",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Cryptocurrency",
    "Technology"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--2dc31aa3-0df9-5ff5-8935-df97ac69a0c9",
   "created": "2026-11-10T16:32:08.478Z",
   "modified": "2026-11-10T16:32:08.478Z",
   "relationship_type": "related-to",
   "source_ref": "incident--1936f227-2555-556b-92d4-7f48f4860626",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--6d1328a3-2c4d-5dbf-8ff6-4cae78790d3a",
   "created": "2026-11-09T04:30:05.217Z",
   "modified": "2026-11-09T04:30:05.217Z",
   "name": "TraderTraitor",
   "aliases": [
    "Jade Sleet",
    "Pukchong",
    "UNC4899"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/tradertraitor/"
    }
   ],
   "description": "TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, intended to gain access to these start-up and high-tech companies. TraderTraitor may be the work of operators previously responsible for APT38 activity."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--55952837-5ab0-5bcc-b705-b0d57744ac9d",
   "created": "2026-11-10T16:32:08.478Z",
   "modified": "2026-11-10T16:32:08.478Z",
   "relationship_type": "related-to",
   "source_ref": "incident--1936f227-2555-556b-92d4-7f48f4860626",
   "target_ref": "intrusion-set--6d1328a3-2c4d-5dbf-8ff6-4cae78790d3a",
   "description": "actor named in the coverage (the sources' attribution)"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--27acc24b-612d-5aeb-8722-ac242eefbaeb",
   "created": "2026-11-10T16:32:08.007Z",
   "modified": "2026-11-10T16:40:20.409Z",
   "name": "Online-only lenders KakaoBank and Kbank are latest targets of cyberattacks on Korean banks",
   "description": "Detected automatically from 1 article in 1 outlet (Hankyoreh), Oct 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "espionage",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/online-only-lenders-kakaobank-and-kbank-are-latest-targets-of-cyberatt-20261007/"
    },
    {
     "source_name": "Hankyoreh",
     "url": "https://www.hani.co.kr/arti/english_edition/e_business/1281364.html",
     "description": "Online-only lenders KakaoBank and Kbank are latest targets of cyberattacks on Korean banks"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-07",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--9b735b72-62fa-5c94-980b-26bd9658327a",
   "created": "2026-11-10T16:32:08.007Z",
   "modified": "2026-11-10T16:32:08.007Z",
   "relationship_type": "related-to",
   "source_ref": "incident--27acc24b-612d-5aeb-8722-ac242eefbaeb",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  }
 ]
}