{
 "type": "bundle",
 "id": "bundle--d7f945f7-dbc5-4a7f-8900-f267628e10b1",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--446b346b-7a44-5532-8c71-35d337e2b559",
   "created": "2026-11-11T12:23:36.606Z",
   "modified": "2026-11-13T00:02:47.845Z",
   "name": "10 Philippine Government Institutions Fall Victim to Data Leak",
   "description": "Detected automatically from 1 article in 1 outlet (CNN Indonesia Technology (Indonesian)), Nov 11, 2026. Title machine-translated from Indonesian. Type: data breach; sectors: government. Asia-Pacific countries affected: Philippines. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/10-lembaga-pemerintah-filipina-jadi-korban-kebocoran-data-20261111/"
    },
    {
     "source_name": "CNN Indonesia Technology (Indonesian)",
     "url": "https://www.cnnindonesia.com/teknologi/20261111125419-185-1425837/10-lembaga-pemerintah-filipina-jadi-korban-kebocoran-data",
     "description": "10 Lembaga Pemerintah FIlipina jadi Korban Kebocoran Data"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-11",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Government"
   ],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Philippines",
   "country": "PH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--b876acee-2c8b-5588-b001-65eaf35e1ee1",
   "created": "2026-11-11T12:23:36.606Z",
   "modified": "2026-11-11T12:23:36.606Z",
   "relationship_type": "related-to",
   "source_ref": "incident--446b346b-7a44-5532-8c71-35d337e2b559",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--c60aa734-7703-58e5-9153-f565285c2a0c",
   "created": "2026-11-10T16:32:08.783Z",
   "modified": "2026-11-13T00:02:47.806Z",
   "name": "AFP probing into alleged Air Force data breach",
   "description": "Detected automatically from 2 articles in 1 outlet (Philippine Daily Inquirer), Nov 10 to Nov 11, 2026. Type: data breach; sectors: defence. Asia-Pacific countries affected: Philippines. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/afp-probing-into-alleged-air-force-data-breach-20261110/"
    },
    {
     "source_name": "Philippine Daily Inquirer",
     "url": "https://newsinfo.inquirer.net/2339099/afp-probing-into-alleged-air-force-data-breach",
     "description": "AFP probing into alleged Air Force data breach"
    },
    {
     "source_name": "Philippine Daily Inquirer",
     "url": "https://newsinfo.inquirer.net/2339430/afp-probes-alleged-data-breach-involving-air-force",
     "description": "AFP probes alleged data breach involving Air Force"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-10",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Defence"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--e0a6d849-7f69-51e7-b275-77afd414026e",
   "created": "2026-11-10T16:32:08.783Z",
   "modified": "2026-11-10T16:32:08.783Z",
   "relationship_type": "related-to",
   "source_ref": "incident--c60aa734-7703-58e5-9153-f565285c2a0c",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--efb0048b-1906-59f6-857f-a6c4b1fdb614",
   "created": "2026-11-10T16:32:08.729Z",
   "modified": "2026-11-13T00:02:47.743Z",
   "name": "SEC probes data breach",
   "description": "Detected automatically from 1 article in 1 outlet (The Manila Times), Nov 10, 2026. Type: data breach. Asia-Pacific countries affected: Philippines. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/sec-probes-data-breach-20261110/"
    },
    {
     "source_name": "The Manila Times",
     "url": "https://www.manilatimes.net/2026/11/10/news/sec-probes-data-breach/2465889",
     "description": "SEC probes data breach"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-10",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--0756ed32-1c43-5b7b-a4cc-8ea79b136c8c",
   "created": "2026-11-10T16:32:08.729Z",
   "modified": "2026-11-10T16:32:08.729Z",
   "relationship_type": "related-to",
   "source_ref": "incident--efb0048b-1906-59f6-857f-a6c4b1fdb614",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--f219f4b6-a053-5ace-86f8-a7159450a4f7",
   "created": "2026-11-10T16:32:08.683Z",
   "modified": "2026-11-13T00:02:47.673Z",
   "name": "BIR 'data leak' under gov't probe",
   "description": "Detected automatically from 1 article in 1 outlet (GMA Network), Nov 7, 2026. Type: data breach. Asia-Pacific countries affected: Philippines. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/bir-data-leak-under-govt-probe-20261107/"
    },
    {
     "source_name": "GMA Network",
     "url": "https://www.gmanetwork.com/news/topstories/nation/1008620/bir-data-leak-under-gov-t-probe/story/",
     "description": "BIR 'data leak' under gov't probe"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-07",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--089d4dcb-fad7-5708-9e59-e6dc3e618e42",
   "created": "2026-11-10T16:32:08.683Z",
   "modified": "2026-11-10T16:32:08.683Z",
   "relationship_type": "related-to",
   "source_ref": "incident--f219f4b6-a053-5ace-86f8-a7159450a4f7",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--49cda955-ac90-53e9-bff2-0397937d21fd",
   "created": "2026-11-10T16:32:08.648Z",
   "modified": "2026-11-13T00:02:47.635Z",
   "name": "OVP suffers alleged data leak – cybersecurity group",
   "description": "Detected automatically from 1 article in 1 outlet (Philippine Daily Inquirer), Nov 5, 2026. Type: data breach. Asia-Pacific countries affected: Philippines. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/ovp-suffers-alleged-data-leak-cybersecurity-group-20261105/"
    },
    {
     "source_name": "Philippine Daily Inquirer",
     "url": "https://newsinfo.inquirer.net/2336392/ovp-suffers-alleged-data-leak-cybersecurity-group",
     "description": "OVP suffers alleged data leak – cybersecurity group"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-05",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--4199c2ee-67b1-5ed6-a0b1-5f6f3367f4c6",
   "created": "2026-11-10T16:32:08.648Z",
   "modified": "2026-11-10T16:32:08.648Z",
   "relationship_type": "related-to",
   "source_ref": "incident--49cda955-ac90-53e9-bff2-0397937d21fd",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--d64046a9-94db-5aee-acb5-5296dca055d8",
   "created": "2026-11-10T16:32:08.611Z",
   "modified": "2026-11-13T00:02:47.592Z",
   "name": "St. Luke’s Medical Center reports personal data breach",
   "description": "Detected automatically from 1 article in 1 outlet (Philippine Daily Inquirer), Nov 4, 2026. Type: data breach; sectors: health. Asia-Pacific countries affected: Philippines. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/st-lukes-medical-center-reports-personal-data-breach-20261104/"
    },
    {
     "source_name": "Philippine Daily Inquirer",
     "url": "https://newsinfo.inquirer.net/2335706/st-lukes-medical-center-reports-personal-data-breach",
     "description": "St. Luke’s Medical Center reports personal data breach"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-04",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Health"
   ],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--15bb1652-d560-555d-bd96-77554aa87549",
   "created": "2026-11-10T16:32:08.611Z",
   "modified": "2026-11-10T16:32:08.611Z",
   "relationship_type": "related-to",
   "source_ref": "incident--d64046a9-94db-5aee-acb5-5296dca055d8",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--4a8a52c2-7e62-5ef0-8de0-c6323f11330c",
   "created": "2026-11-10T16:32:08.616Z",
   "modified": "2026-11-13T00:02:47.597Z",
   "name": "Philippine Migrant Worker Data Likely Leaked in 69GB Government Breach",
   "description": "Detected automatically from 1 article in 1 outlet (Dark Reading), Nov 4, 2026. Type: data breach; sectors: government. Asia-Pacific countries affected: Philippines. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/philippine-migrant-worker-data-likely-leaked-in-69gb-government-breach-20261104/"
    },
    {
     "source_name": "Dark Reading",
     "url": "https://www.darkreading.com/cyberattacks-data-breaches/philippine-migrant-worker-data-69gb-government-breach",
     "description": "Philippine Migrant Worker Data Likely Leaked in 69GB Government Breach"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-04",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Government"
   ],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--53aa867f-532b-5b9f-87a8-058374c20f4b",
   "created": "2026-11-10T16:32:08.616Z",
   "modified": "2026-11-10T16:32:08.616Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4a8a52c2-7e62-5ef0-8de0-c6323f11330c",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--3c2f8296-afc4-5ae1-b3c5-7c327d98475b",
   "created": "2026-11-10T16:32:08.524Z",
   "modified": "2026-11-13T00:02:47.477Z",
   "name": "NPC probes data breach",
   "description": "Detected automatically from 2 articles in 2 outlets (GMA Network, PhilStar Global), Oct 31 to Nov 10, 2026. Type: data breach. Asia-Pacific countries affected: Philippines. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/npc-probes-data-breach-20261031/"
    },
    {
     "source_name": "PhilStar Global",
     "url": "https://www.philstar.com/nation/2026/11/01/2566996/npc-probes-data-breach",
     "description": "NPC probes data breach"
    },
    {
     "source_name": "GMA Network",
     "url": "https://www.gmanetwork.com/news/topstories/nation/1008995/npc-confirms-data-breaches-in-doj-dict-8-other-gov-t-agencies/story/",
     "description": "NPC confirms data breaches in DOJ, DICT, 8 other gov't agencies"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-31",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--3d6f9d57-de0f-5ad7-ac76-972a723a8b1c",
   "created": "2026-11-10T16:32:08.524Z",
   "modified": "2026-11-10T16:32:08.524Z",
   "relationship_type": "related-to",
   "source_ref": "incident--3c2f8296-afc4-5ae1-b3c5-7c327d98475b",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--f3ce5f35-37d4-582a-9083-10bc1fa168b1",
   "created": "2026-11-10T16:32:08.176Z",
   "modified": "2026-11-11T20:40:49.378Z",
   "name": "Elderly man held over hacking of drinking buddy in Batac City",
   "description": "Detected automatically from 1 article in 1 outlet (Philippine Daily Inquirer), Oct 17, 2026. Type: intrusion. Asia-Pacific countries affected: Philippines. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "intrusion",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/elderly-man-held-over-hacking-of-drinking-buddy-in-batac-city-20261017/"
    },
    {
     "source_name": "Philippine Daily Inquirer",
     "url": "https://newsinfo.inquirer.net/2325428/elderly-man-held-over-hacking-of-drinking-buddy-in-batac-city",
     "description": "Elderly man held over hacking of drinking buddy in Batac City"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-17",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--4adba7d0-aa78-537d-a774-848a57f950c6",
   "created": "2026-11-10T16:32:08.176Z",
   "modified": "2026-11-10T16:32:08.176Z",
   "relationship_type": "related-to",
   "source_ref": "incident--f3ce5f35-37d4-582a-9083-10bc1fa168b1",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--80bdb79e-b771-53c3-a919-a5429e71344e",
   "created": "2026-11-10T16:32:08.143Z",
   "modified": "2026-11-11T20:40:49.342Z",
   "name": "DOJ reports five pending espionage-related cybercrime cases",
   "description": "Detected automatically from 1 article in 1 outlet (Philippine Daily Inquirer), Oct 15, 2026. Type: espionage campaign. Asia-Pacific countries affected: Philippines. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "espionage",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/doj-reports-five-pending-espionage-related-cybercrime-cases-20261015/"
    },
    {
     "source_name": "Philippine Daily Inquirer",
     "url": "https://newsinfo.inquirer.net/2324410/doj-reports-five-pending-espionage-related-cybercrime-cases",
     "description": "DOJ reports five pending espionage-related cybercrime cases"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-15",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--259ace9d-afe2-5c05-ab74-7614f0dd39a0",
   "created": "2026-11-10T16:32:08.143Z",
   "modified": "2026-11-10T16:32:08.143Z",
   "relationship_type": "related-to",
   "source_ref": "incident--80bdb79e-b771-53c3-a919-a5429e71344e",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--a7848b05-58f7-5601-b2af-2e0b00d4b9ce",
   "created": "2026-11-10T16:32:07.886Z",
   "modified": "2026-11-10T16:40:20.304Z",
   "name": "Two men hacked during drinking spree in Bukidnon",
   "description": "Detected automatically from 1 article in 1 outlet (Philippine Daily Inquirer), Oct 4, 2026. Type: intrusion. Asia-Pacific countries affected: Philippines. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "intrusion",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/two-men-hacked-during-drinking-spree-in-bukidnon-20261004/"
    },
    {
     "source_name": "Philippine Daily Inquirer",
     "url": "https://newsinfo.inquirer.net/2316742/two-men-hacked-during-drinking-spree-in-bukidnon",
     "description": "Two men hacked during drinking spree in Bukidnon"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-04",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--6a1f424f-b352-52cb-9288-f38929e5aec6",
   "created": "2026-11-10T16:32:07.886Z",
   "modified": "2026-11-10T16:32:07.886Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a7848b05-58f7-5601-b2af-2e0b00d4b9ce",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--baec1a13-8eb1-5558-ab71-f81eea027b1c",
   "created": "2026-11-10T16:32:07.768Z",
   "modified": "2026-11-10T16:40:20.199Z",
   "name": "DICT probes possible data breach involving 48 firms in accreditation program",
   "description": "Detected automatically from 1 article in 1 outlet (GMA Network), Sep 26, 2026. Type: data breach. Asia-Pacific countries affected: Philippines. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/dict-probes-possible-data-breach-involving-48-firms-in-accreditation-p-20260926/"
    },
    {
     "source_name": "GMA Network",
     "url": "https://www.gmanetwork.com/news/topstories/nation/1003779/dict-probes-possible-data-breach-involving-48-firms-in-accreditation-program/story/",
     "description": "DICT probes possible data breach involving 48 firms in accreditation program"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-26",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--08582de2-6fa1-5314-a238-9ad193909537",
   "created": "2026-11-10T16:32:07.768Z",
   "modified": "2026-11-10T16:32:07.768Z",
   "relationship_type": "related-to",
   "source_ref": "incident--baec1a13-8eb1-5558-ab71-f81eea027b1c",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--290561ca-30e3-5285-a009-abd8b087da6b",
   "created": "2026-11-10T16:32:07.743Z",
   "modified": "2026-11-10T16:40:20.185Z",
   "name": "LTFRB flags data breach",
   "description": "Detected automatically from 1 article in 1 outlet (PhilStar Global), Sep 21, 2026. Type: data breach. Asia-Pacific countries affected: Philippines. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/ltfrb-flags-data-breach-20260921/"
    },
    {
     "source_name": "PhilStar Global",
     "url": "https://www.philstar.com/nation/2026/09/22/2557918/ltfrb-flags-data-breach",
     "description": "LTFRB flags data breach"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-21",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1b9da3b5-2c40-5379-a717-21f309a3f5ce",
   "created": "2026-11-10T16:32:07.743Z",
   "modified": "2026-11-10T16:32:07.743Z",
   "relationship_type": "related-to",
   "source_ref": "incident--290561ca-30e3-5285-a009-abd8b087da6b",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--f1476ab0-3323-5ac3-b877-7ff0d1f46d07",
   "created": "2026-11-10T16:32:07.738Z",
   "modified": "2026-11-10T16:40:20.181Z",
   "name": "LTFRB addresses security breach in online support platform",
   "description": "Detected automatically from 3 articles in 3 outlets (GMA Network, Philippine Daily Inquirer, The Manila Times), Sep 19 to Sep 20, 2026. Type: data breach; sectors: technology. Asia-Pacific countries affected: Philippines. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/ltfrb-addresses-security-breach-in-online-support-platform-20260919/"
    },
    {
     "source_name": "The Manila Times",
     "url": "https://www.manilatimes.net/2026/09/19/news/ltfrb-addresses-security-breach-in-online-support-platform/2428770",
     "description": "LTFRB addresses security breach in online support platform"
    },
    {
     "source_name": "Philippine Daily Inquirer",
     "url": "https://newsinfo.inquirer.net/2308133/ltfrb-probes-data-breach-as-platform-goes-offline",
     "description": "LTFRB probes data breach as platform goes offline"
    },
    {
     "source_name": "GMA Network",
     "url": "https://www.gmanetwork.com/news/topstories/nation/1003007/ltfrb-platform-down-amid-security-breach-probe/story/",
     "description": "LTFRB platform down amid security breach probe"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-19",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Technology"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--08b0afc8-fe02-5675-8326-09abad2d8e8b",
   "created": "2026-11-10T16:32:07.738Z",
   "modified": "2026-11-10T16:32:07.738Z",
   "relationship_type": "related-to",
   "source_ref": "incident--f1476ab0-3323-5ac3-b877-7ff0d1f46d07",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--f7d316db-381f-51e6-a4ea-729844292af2",
   "created": "2026-11-08T21:16:16.715Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Qilin ransomware compromises the Philippine Ports Authority",
   "description": "The Philippine Ports Authority was compromised on 5 September 2026 in an intrusion attributed to the Qilin ransomware operation and subsequently added to the group's data-leak site as part of a double-extortion campaign. The victim sits squarely in the transportation and maritime logistics sector at a time of heightened South China Sea tension, giving the incident strategic as well as commercial significance. Qilin remained the most prolific ransomware brand globally in 2026, with more than 500 victims claimed during the year.",
   "confidence": 50,
   "labels": [
    "ransomware",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/qilin-ransomware-compromises-the-philippine-ports-authority/"
    },
    {
     "source_name": "source",
     "url": "https://www.hookphish.com/blog/ransomware-group-qilin-hits-philippine-ports-authority/"
    },
    {
     "source_name": "source",
     "url": "https://ctiwatch.com/victims/0e550d65-88dc-4a3b-9d25-8d5d367e65e4-philippine-ports-authority"
    },
    {
     "source_name": "source",
     "url": "https://www.moxfive.com/blog/qilin-ransomware-2026-ttps-victims-and-defense-guide"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-05",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Transportation and Maritime",
    "Government"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--851892c9-c7f0-5d2e-9644-a4577e6c74b4",
   "created": "2026-11-08T21:16:16.715Z",
   "modified": "2026-11-08T21:16:16.715Z",
   "relationship_type": "related-to",
   "source_ref": "incident--f7d316db-381f-51e6-a4ea-729844292af2",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--a6563912-5ce5-5cf1-9ab1-d7a45734bf80",
   "created": "2026-11-08T21:16:16.702Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Philippine SMS Provider Breach Allegedly Exposes 160 Million Messages",
   "description": "A Philippine SMS/telecommunications provider was reported compromised in August 2026, with threat actors alleging exposure of around 160 million SMS messages along with associated user data. The incident comes as Viettel Cyber Security reported more than 19.2 million Philippine account credentials compromised in the first half of 2026 amid surging phishing and breach activity.",
   "confidence": 50,
   "labels": [
    "data_breach",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/philippine-sms-provider-breach-allegedly-exposes-160-million-messages/"
    },
    {
     "source_name": "source",
     "url": "https://www.cyfirma.com/news/weekly-intelligence-report-14-aug-2026/"
    }
   ],
   "x_securitystudies_occurred_on": "2026-08-14",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "telecommunications"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--d1cef0e9-cc21-58b0-9022-081edf9450e0",
   "created": "2026-11-08T21:16:16.702Z",
   "modified": "2026-11-08T21:16:16.702Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a6563912-5ce5-5cf1-9ab1-d7a45734bf80",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--1d3efc68-6633-5157-bde1-788fe362998d",
   "created": "2026-11-08T21:16:16.696Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Massive DDoS Attack on Philippine Election Infrastructure",
   "description": "Philippine COMELEC (Commission on Elections) voter verification systems experienced sustained DDoS attacks peaking at 3.2 Tbps during the May 2026 midterm election preparation period. Attacks originated from a botnet comprising compromised IoT devices across Southeast Asia. Philippine DICT (Department of Information and Communications Technology) and Cloudflare mitigated the attacks within 6 hours, but voter registration portal experienced intermittent outages over 3 days.",
   "confidence": 50,
   "labels": [
    "ddos",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/massive-ddos-attack-on-philippine-election-infrastructure/"
    },
    {
     "source_name": "source",
     "url": {
      "title": "DICT Philippines Advisory",
      "url": "https://dict.gov.ph/"
     }
    },
    {
     "source_name": "source",
     "url": {
      "title": "Rappler Coverage",
      "url": "https://www.rappler.com/technology/"
     }
    }
   ],
   "x_securitystudies_occurred_on": "2026-05-05",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Election Infrastructure"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--cbc503d3-29fb-5cac-b43a-71e3543b5d72",
   "created": "2026-11-08T21:16:16.696Z",
   "modified": "2026-11-08T21:16:16.696Z",
   "relationship_type": "related-to",
   "source_ref": "incident--1d3efc68-6633-5157-bde1-788fe362998d",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Earth Alux Espionage Campaign Targets ASEAN Defense Ministries",
   "description": "Trend Micro researchers disclosed an ongoing espionage campaign by Earth Alux (China-linked) targeting defense ministries and military contractors across Thailand, Philippines, Vietnam, and Malaysia. The group deployed VARGEIT and COBEACON implants via trojanized military procurement documents. The campaign has been active since at least Q4 2025, with lateral movement into classified networks confirmed at two ASEAN defense organizations.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/earth-alux-espionage-campaign-targets-asean-defense-ministries/"
    },
    {
     "source_name": "source",
     "url": {
      "title": "Trend Micro Research",
      "url": "https://www.trendmicro.com/en_us/research.html"
     }
    }
   ],
   "x_securitystudies_occurred_on": "2025-10-15",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Defense",
    "Government",
    "Defense Industrial Base"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Thailand",
   "country": "TH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--c0026139-5643-5d47-bac1-71c57ff02bda",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-08T21:16:16.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--c47a29ab-212b-5f0b-97dc-f1d5ac028775",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-08T21:16:16.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Vietnam",
   "country": "VN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--53a044f5-0589-5f74-8b1e-d49911eede50",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-08T21:16:16.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Malaysia",
   "country": "MY"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--5e562017-2630-53a9-8411-2e18c658a7e4",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-08T21:16:16.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--84c9386a-a191-5067-af66-85089b12bc28",
   "created": "2026-11-09T04:30:05.352Z",
   "modified": "2026-11-09T04:30:05.352Z",
   "name": "Earth Alux",
   "aliases": [],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/earth-alux/"
    }
   ],
   "description": "Earth Alux is a China-linked APT group known for conducting cyberespionage attacks across various sectors, including government, technology, and telecommunications. They primarily exploit vulnerable services in exposed servers to gain initial access, implanting web shells like GODZILLA and deploying backdoors such as VARGEIT and COBEACON. The group employs tools like RSBINJECT and MASQLOADER for lateral movement and network discovery, while also utilizing RAILSETTER for persistence through mspaint injection. Their operations have predominantly targeted the APAC region and have extended to Latin America, with a focus on exfiltrating sensitive information to attacker-controlled cloud storage."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--2e655fb6-f447-589e-b353-53cbe2ca73fc",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-08T21:16:16.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "target_ref": "intrusion-set--84c9386a-a191-5067-af66-85089b12bc28",
   "description": "attribution"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Salt Typhoon Telecom Espionage Campaign — Ongoing",
   "description": "Chinese state-sponsored group Salt Typhoon (also tracked as GhostEmperor/FamousSparrow) continues to maintain persistent access to major US, Southeast Asian, and Australian telecommunications networks. The campaign, first publicly disclosed in late 2024, has been confirmed to compromise call detail records and lawful intercept systems across at least 9 major carriers. As of May 2026, incident response is ongoing at several ASEAN-region telecoms. CISA has issued updated advisories recommending encrypted communications for government officials.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/salt-typhoon-telecom-espionage-campaign-ongoing/"
    },
    {
     "source_name": "source",
     "url": {
      "title": "CISA Advisory AA24-340A",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-340a"
     }
    },
    {
     "source_name": "source",
     "url": {
      "title": "Microsoft Threat Intelligence",
      "url": "https://www.microsoft.com/en-us/security/blog/"
     }
    }
   ],
   "x_securitystudies_occurred_on": "2024-09-15",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Telecommunications",
    "Government",
    "Defense"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "United States",
   "country": "US"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--435d00ae-93cc-5b82-973d-553a2ad2316c",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8108d9cb-277e-53fe-b5e8-3795c21eb8aa",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--9072f4ee-c5de-5753-a3e6-9be0f67cbc1b",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Australia",
   "country": "AU"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--d963c41d-ea95-5987-a1e4-a461feb2cbdc",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Indonesia",
   "country": "ID"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--26c5417c-4add-561a-9231-6a9797918e9d",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Taiwan",
   "country": "TW"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8be3764b-86b0-5fde-af53-2f87940a6fa2",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Japan",
   "country": "JP"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--642c612d-bcf7-5030-bd96-c51cad00d04e",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--994a786f-903b-5827-8b99-fb2bcf62d3db",
   "created": "2026-11-09T04:30:08.681Z",
   "modified": "2026-11-09T04:30:08.681Z",
   "name": "GhostEmperor",
   "aliases": [
    "FamousSparrow",
    "OPERATOR PANDA",
    "RedMike",
    "Salt Typhoon",
    "UNC2286"
   ],
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "G1045",
     "url": "https://attack.mitre.org/groups/G1045/"
    },
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/ghostemperor/"
    }
   ],
   "description": "GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--344356d8-39e3-5c5b-b48f-9b5cf793a03a",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "intrusion-set--994a786f-903b-5827-8b99-fb2bcf62d3db",
   "description": "attribution"
  }
 ]
}