{
 "type": "bundle",
 "id": "bundle--1afb29c8-1998-4cf2-9d38-d35182bd7748",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--2882ccb4-cf7a-57ea-b7db-ad34c3e3a0b5",
   "created": "2026-11-10T16:32:08.759Z",
   "modified": "2026-11-13T06:07:08.701Z",
   "name": "SPH Media hit by cyberattacks; no payment card details or financial information compromised",
   "description": "Detected automatically from 4 articles in 4 outlets (Channel News Asia, Free Malaysia Today, Mothership, The Straits Times), Nov 10, 2026. Type: data breach; sectors: financial services, media. Asia-Pacific countries affected: Singapore. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/sph-media-hit-by-cyberattacks-no-payment-card-details-or-financial-inf-20261110/"
    },
    {
     "source_name": "The Straits Times",
     "url": "https://www.straitstimes.com/singapore/politics/sph-media-hit-by-cyberattacks-no-payment-card-details-or-financial-information-compromised",
     "description": "SPH Media hit by cyberattacks; no payment card details or financial information compromised"
    },
    {
     "source_name": "Channel News Asia",
     "url": "https://www.channelnewsasia.com/singapore/sph-media-cyberattack-data-breach-6538681",
     "description": "SPH Media hit by cyberattacks; says no customer financial data or access exposed"
    },
    {
     "source_name": "Free Malaysia Today",
     "url": "https://www.freemalaysiatoday.com/category/highlight/2026/11/10/singapore-s-sph-media-hit-by-cyberattacks-personal-database-exposed",
     "description": "Singapore’s SPH media hit by cyberattacks, personal database exposed"
    },
    {
     "source_name": "Mothership",
     "url": "https://mothership.sg/2026/11/sph-media-hit-by-ai-enabled-cyberattacks-subscribers-names-phone-numbers-accessed/",
     "description": "SPH Media hit by AI-enabled cyberattacks; subscribers' names, phone numbers accessed"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-10",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Financial Services",
    "Media"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Singapore",
   "country": "SG"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--2971254a-e63e-57e7-86a9-28831990c695",
   "created": "2026-11-10T16:32:08.759Z",
   "modified": "2026-11-10T16:32:08.759Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2882ccb4-cf7a-57ea-b7db-ad34c3e3a0b5",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-13T06:07:08.404Z",
   "name": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack",
   "description": "Detected automatically from 8 articles in 7 outlets (Bangkok Post, Channel News Asia, Malay Mail, Matichon, South China Morning Post, The Straits Times and others), Oct 30 to Nov 10, 2026. Type: data breach; sectors: transportation, technology. Asia-Pacific countries affected: Thailand, Japan, Singapore, Hong Kong, Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/cathay-pacific-says-data-from-53000-bookings-compromised-in-amadeus-cy-20261030/"
    },
    {
     "source_name": "South China Morning Post",
     "url": "https://www.scmp.com/news/hong-kong/transport/article/3372722/cathay-pacific-says-data-53000-bookings-compromised-amadeus-cyberattack",
     "description": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack"
    },
    {
     "source_name": "Malay Mail",
     "url": "https://www.malaymail.com/news/malaysia/2026/11/01/malaysia-airlines-warns-customers-of-data-exposure-in-amadeus-cybersecurity-breach/241516",
     "description": "Malaysia Airlines warns customers of data exposure in Amadeus cybersecurity breach"
    },
    {
     "source_name": "The Straits Times",
     "url": "https://www.straitstimes.com/singapore/46000-sia-booking-records-accessed-illegally-in-data-breach-affecting-software-provider-amadeus",
     "description": "46,000 SIA booking records accessed illegally in data breach affecting software provider Amadeus"
    },
    {
     "source_name": "Channel News Asia",
     "url": "https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151",
     "description": "About 46,000 SIA booking records accessed in data breach involving travel tech company Amadeus"
    },
    {
     "source_name": "Matichon",
     "url": "https://www.matichon.co.th/economy/news_5969157",
     "description": "การบินไทย รับถูกแฮก ข้อมูลรั่ว 6 หมื่นรายการ แต่ไม่กระทบข้อมูลบัตรเครดิต"
    },
    {
     "source_name": "Bangkok Post",
     "url": "https://www.bangkokpost.com/thailand/general/3352180/60000-thai-bookings-compromised-in-amadeus-breach",
     "description": "THAI passenger data compromised in Amadeus security breach"
    },
    {
     "source_name": "The Thaiger",
     "url": "https://thethaiger.com/news/world/aviation/thai-airways-confirms-passenger-data-leak-but-credit-card-details-safe",
     "description": "Thai Airways confirms passenger data leak but credit card details safe"
    },
    {
     "source_name": "Matichon",
     "url": "https://www.matichon.co.th/economy/news_5969937",
     "description": "การบินไทย แจ้ง ไซเบอร์โจมตี ข้อมูล 6 หมื่นรายการรั่วไหล ไชยชนก ถก ‘แอปเปิ้ล’ สกัด"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-30",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Transportation",
    "Technology"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Hong Kong",
   "country": "HK"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--d8dcd32a-245a-5e4c-b9bc-e5e43b9093eb",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Japan",
   "country": "JP"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--317010bf-0058-51a9-b822-d6d704efbe31",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Malaysia",
   "country": "MY"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--a3ed75f2-2699-5840-b35c-27be8a40c0cc",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--dc48e5ec-d80c-5cbd-bea5-0fd84c8f8607",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Thailand",
   "country": "TH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--6dac9bd3-fa51-5640-8e1c-99147e4a1ad5",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--bb33be26-9cb1-55d1-813e-f1315b7600ad",
   "created": "2026-11-10T16:32:07.760Z",
   "modified": "2026-11-10T16:40:20.195Z",
   "name": "North Korean cybercriminals linked to $352M heist from crypto exchange Bitget",
   "description": "Detected automatically from 4 articles in 3 outlets (Channel News Asia, NK Pro, Thanh Nien News), Sep 25 to Sep 30, 2026. Type: cryptocurrency theft; sectors: cryptocurrency. Asia-Pacific countries affected: Vietnam, Singapore. Largest figure in the headlines: 352,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "crypto_theft",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/north-korean-cybercriminals-linked-to-352m-heist-from-crypto-exchange-20260925/"
    },
    {
     "source_name": "NK Pro",
     "url": "https://www.nknews.org/pro/north-korean-cybercriminals-linked-to-352m-heist-from-crypto-exchange-bitget/",
     "description": "North Korean cybercriminals linked to $352M heist from crypto exchange Bitget"
    },
    {
     "source_name": "Channel News Asia",
     "url": "https://www.channelnewsasia.com/business/crypto-exchange-bitget-pauses-withdrawals-after-350-million-stolen-in-hack-6410806",
     "description": "Crypto exchange Bitget pauses withdrawals after $350 million stolen in hack"
    },
    {
     "source_name": "Thanh Nien News",
     "url": "https://thanhnien.vn/gia-bitcoin-hom-nay-2892026-tin-tac-tau-tan-xong-83-trieu-usd-trong-vu-hack-bitget-185260928081934906.htm",
     "description": "Giá Bitcoin hôm nay 28.9.2026: Tin tặc tẩu tán xong 83 triệu USD trong vụ hack Bitget"
    },
    {
     "source_name": "Thanh Nien News",
     "url": "https://thanhnien.vn/ceo-bitget-khong-may-lac-quan-ve-kha-nang-thu-hoi-3875-trieu-usd-bi-hack-185260930112333106.htm",
     "description": "CEO Bitget: 'Không mấy lạc quan về khả năng thu hồi 387,5 triệu USD bị hack'"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-25",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Cryptocurrency"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--db02ef0f-ae60-50ba-8bc8-cf8199b3ccbb",
   "created": "2026-11-10T16:32:07.760Z",
   "modified": "2026-11-10T16:32:07.760Z",
   "relationship_type": "related-to",
   "source_ref": "incident--bb33be26-9cb1-55d1-813e-f1315b7600ad",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Vietnam",
   "country": "VN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--03abcbf0-41cf-5c95-a2ec-d4428c33673c",
   "created": "2026-11-10T16:32:07.760Z",
   "modified": "2026-11-10T16:32:07.760Z",
   "relationship_type": "related-to",
   "source_ref": "incident--bb33be26-9cb1-55d1-813e-f1315b7600ad",
   "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63",
   "created": "2026-11-08T21:16:16.717Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "GitLab maximum-severity path traversal exploited within hours of disclosure",
   "description": "CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal in the GitLab repository commits API, came under in-the-wild probing from 06:00 UTC on 11 September 2026 according to watchTowr, the same day CISA added it to the KEV catalog. Exploitation requires only that a single public project exists and allows arbitrary file reads of logs, configuration files, credentials and secrets. Successful exploitation creates a direct path to source code theft and CI/CD pipeline compromise. Patches are available in 19.3.2, 19.2.6 and 19.1.8, with a 14 September federal remediation deadline.",
   "confidence": 50,
   "labels": [
    "supply_chain",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/gitlab-maximum-severity-path-traversal-exploited-within-hours-of-disclosure/"
    },
    {
     "source_name": "source",
     "url": "https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html"
    },
    {
     "source_name": "source",
     "url": "https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/"
    },
    {
     "source_name": "source",
     "url": "https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-one-known-exploited-vulnerability-catalog"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-11",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Technology and Software Supply Chain",
    "Financial Services",
    "Government"
   ],
   "x_securitystudies_eu_relevance": "high"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "United States",
   "country": "US"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--fc3a7591-bd53-50ae-8a72-e41de1afbd37",
   "created": "2026-11-08T21:16:16.717Z",
   "modified": "2026-11-08T21:16:16.717Z",
   "relationship_type": "related-to",
   "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--41ac0fa7-2d80-5bda-afc1-65273a433364",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "United Kingdom",
   "country": "GB"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--2659c6c3-953e-58b2-9aa3-3265700a2b97",
   "created": "2026-11-08T21:16:16.717Z",
   "modified": "2026-11-08T21:16:16.717Z",
   "relationship_type": "related-to",
   "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63",
   "target_ref": "location--41ac0fa7-2d80-5bda-afc1-65273a433364",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--985edf3b-bbdc-5fce-808b-4e4869bff566",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Germany",
   "country": "DE"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--689583b4-610b-5c43-be4e-fd6b7195d101",
   "created": "2026-11-08T21:16:16.717Z",
   "modified": "2026-11-08T21:16:16.717Z",
   "relationship_type": "related-to",
   "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63",
   "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--a7ac4e90-1e57-5eb8-ab78-8e93cbae1ba1",
   "created": "2026-11-08T21:16:16.717Z",
   "modified": "2026-11-08T21:16:16.717Z",
   "relationship_type": "related-to",
   "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--095279bc-69f1-5155-a576-8cfad052b57e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "India",
   "country": "IN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1e5d137b-c900-551e-a96d-d91718577e9d",
   "created": "2026-11-08T21:16:16.717Z",
   "modified": "2026-11-08T21:16:16.717Z",
   "relationship_type": "related-to",
   "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63",
   "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--43d29671-3132-541c-b643-0985fe12aebb",
   "created": "2026-11-08T21:16:16.717Z",
   "modified": "2026-11-08T21:16:16.717Z",
   "relationship_type": "related-to",
   "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31",
   "created": "2026-11-08T21:16:16.722Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Dutch NCSC warns critical Check Point VPN flaws face imminent exploitation",
   "description": "The Dutch National Cyber Security Centre issued a warning that exploitation of CVE-2026-85102 and CVE-2026-85103 in Check Point VPN Security Gateway and Security Management Servers is imminent, assessing both likelihood and impact as high. CVE-2026-85102 is an improper certificate validation flaw during VPN negotiation enabling arbitrary code execution, while CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder permitting remote code execution; both are rated 9.8. Affected versions include R81.20, R82, R82.10, R81.10.x and R82.00.x plus end-of-support R80 through R81.10, with R82.20 unaffected. No public exploit code existed at time of reporting and neither CVE appears in the CISA KEV catalog as of version 2026.09.11. Patches shipped 9 September 2026.",
   "confidence": 50,
   "labels": [
    "other",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/dutch-ncsc-warns-critical-check-point-vpn-flaws-face-imminent-exploitation/"
    },
    {
     "source_name": "source",
     "url": "https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/"
    },
    {
     "source_name": "source",
     "url": "https://thehackernews.com/2026/09/check-point-discloses-two-98-rated-vpn.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-09",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Financial Services",
    "Critical Infrastructure",
    "Manufacturing"
   ],
   "x_securitystudies_eu_relevance": "high"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--fe267809-b98d-54a3-9e8a-636c61dfcb03",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Netherlands",
   "country": "NL"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--56561444-f2fa-5f98-a150-4192444a07ac",
   "created": "2026-11-08T21:16:16.722Z",
   "modified": "2026-11-08T21:16:16.722Z",
   "relationship_type": "related-to",
   "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31",
   "target_ref": "location--fe267809-b98d-54a3-9e8a-636c61dfcb03",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--5bde517c-7bdd-5a8b-9e12-4357c671ee3f",
   "created": "2026-11-08T21:16:16.722Z",
   "modified": "2026-11-08T21:16:16.722Z",
   "relationship_type": "related-to",
   "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31",
   "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--c8f1404a-837d-5b97-b4ef-9facfcc40be8",
   "created": "2026-11-08T21:16:16.722Z",
   "modified": "2026-11-08T21:16:16.722Z",
   "relationship_type": "related-to",
   "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31",
   "target_ref": "location--41ac0fa7-2d80-5bda-afc1-65273a433364",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1620e02b-0832-534f-b54b-9b94c8547bc6",
   "created": "2026-11-08T21:16:16.722Z",
   "modified": "2026-11-08T21:16:16.722Z",
   "relationship_type": "related-to",
   "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--afcd4fe1-ec8e-5dad-b123-13144bc09f07",
   "created": "2026-11-08T21:16:16.722Z",
   "modified": "2026-11-08T21:16:16.722Z",
   "relationship_type": "related-to",
   "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Australia",
   "country": "AU"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--e458f5b5-c8f5-52a2-87ac-d3b80558d13c",
   "created": "2026-11-08T21:16:16.722Z",
   "modified": "2026-11-08T21:16:16.722Z",
   "relationship_type": "related-to",
   "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7",
   "created": "2026-11-08T21:16:16.706Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "SonicWall SMA 1000 Zero-Day Chain Exploited for Remote Code Execution",
   "description": "SonicWall disclosed that threat actors are chaining two previously unknown vulnerabilities in SMA 1000 remote-access appliances. CVE-2026-83548, a CVSS 10.0 pre-authentication server-side request forgery in the WorkPlace interface, is used to reach internal functionality, and CVE-2026-83549, a CVSS 7.8 OS command injection in the Appliance Management Console, converts that access into arbitrary command execution. CISA added both to the Known Exploited Vulnerabilities catalogue on 2 September 2026 with a remediation deadline of 5 September. Compromise of these appliances yields authenticated network position behind perimeter controls.",
   "confidence": 50,
   "labels": [
    "other",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/sonicwall-sma-1000-zero-day-chain-exploited-for-remote-code-execution/"
    },
    {
     "source_name": "source",
     "url": "https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog"
    },
    {
     "source_name": "source",
     "url": "https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/"
    },
    {
     "source_name": "source",
     "url": "https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-02",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Technology",
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "high"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--93a4b897-9098-5258-8f78-c11ca62c9c2d",
   "created": "2026-11-08T21:16:16.706Z",
   "modified": "2026-11-08T21:16:16.706Z",
   "relationship_type": "related-to",
   "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--7c1fb9eb-6517-5d3f-a593-dbe41586b7ec",
   "created": "2026-11-08T21:16:16.706Z",
   "modified": "2026-11-08T21:16:16.706Z",
   "relationship_type": "related-to",
   "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1e87d0f6-5cc6-563d-884f-7c283893a9e7",
   "created": "2026-11-08T21:16:16.706Z",
   "modified": "2026-11-08T21:16:16.706Z",
   "relationship_type": "related-to",
   "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7",
   "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--75c8ae31-9b94-5ba7-a159-38dd7168e3f1",
   "created": "2026-11-08T21:16:16.706Z",
   "modified": "2026-11-08T21:16:16.706Z",
   "relationship_type": "related-to",
   "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--70de3750-edaf-5bef-8617-848f92724d94",
   "created": "2026-11-08T21:16:16.706Z",
   "modified": "2026-11-08T21:16:16.706Z",
   "relationship_type": "related-to",
   "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04",
   "created": "2026-11-08T21:16:16.712Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Four nation-state actors deploy shared BlueMoon Chrome and Windows zero-day exploit kit within twelve days",
   "description": "TA412 (APT31) and three suspected China-aligned clusters tracked as UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket independently deployed the same exploit chain combining Chrome V8 type confusion CVE-2026-85046, an unnamed V8 sandbox escape and Windows kernel privilege escalation CVE-2026-85880. TA412 activity began on 28 August 2026 against US NGOs, mining companies and commodity traders; the other clusters followed from 2 September, hitting Vietnamese manufacturing and then Indonesian and Singaporean government, consulting and financial entities. The Chromium patch had been public since 7 August but Chrome stable only shipped on 3 September, giving the actors a wide exploitation window. The convergence on one kit points to a shared exploit broker or quartermaster.",
   "confidence": 50,
   "labels": [
    "apt",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/four-nation-state-actors-deploy-shared-bluemoon-chrome-and-windows-zero-day-exploit-kit-within-twelve-days/"
    },
    {
     "source_name": "source",
     "url": "https://securityaffairs.com/198783/apt/four-nation-state-actors-used-the-same-chrome-zero-day-exploit-kit-within-12-days.html"
    },
    {
     "source_name": "source",
     "url": "https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog"
    },
    {
     "source_name": "source",
     "url": "https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog"
    }
   ],
   "x_securitystudies_occurred_on": "2026-08-28",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Non-Governmental Organisations",
    "Financial Services",
    "Manufacturing",
    "Mining and Commodities",
    "Consulting"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--33536cf2-31dc-52b6-9de7-2540505f4ff7",
   "created": "2026-11-08T21:16:16.712Z",
   "modified": "2026-11-08T21:16:16.712Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1428f606-b7b8-5664-8d37-1a536e6adc6c",
   "created": "2026-11-08T21:16:16.712Z",
   "modified": "2026-11-08T21:16:16.712Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04",
   "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Indonesia",
   "country": "ID"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--404fb36c-6be0-553e-bab5-abe8231b4b39",
   "created": "2026-11-08T21:16:16.712Z",
   "modified": "2026-11-08T21:16:16.712Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04",
   "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--ccd3bd92-7e66-5469-9340-df2377d29dfc",
   "created": "2026-11-08T21:16:16.712Z",
   "modified": "2026-11-08T21:16:16.712Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--eba46e04-3a48-519e-92af-b6843d4a64e9",
   "created": "2026-11-09T04:30:08.701Z",
   "modified": "2026-11-09T04:30:08.701Z",
   "name": "APT31",
   "aliases": [
    "BRONZE VINEWOOD",
    "JUDGMENT PANDA",
    "Red keres",
    "TA412",
    "TIDE CASTLE",
    "Violet Typhoon",
    "ZIRCONIUM",
    "Zirconium"
   ],
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "G0128",
     "url": "https://attack.mitre.org/groups/G0128/"
    },
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/apt31/"
    }
   ],
   "description": "FireEye characterizes APT31 as an actor specialized on intellectual property theft, focusing on data and projects that make a particular organization competetive in its field. Based on available data (April 2016), FireEye assesses that APT31 conducts network operations at the behest of the Chinese Government. Also according to Crowdstrike, this adversary is suspected of continuing to target upstream providers (e.g., law firms and managed service providers) to support additional intrusions against high-profile assets. In 2018, CrowdStrike observed this adversary using spear-phishing, URL “web bugs” and scheduled tasks to automate credential harvesting."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8930a8c1-02ca-5f17-ab1b-f6a440f98dbe",
   "created": "2026-11-08T21:16:16.712Z",
   "modified": "2026-11-08T21:16:16.712Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04",
   "target_ref": "intrusion-set--eba46e04-3a48-519e-92af-b6843d4a64e9",
   "description": "attribution"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--d2795c2b-3198-57f2-be34-4960c872b853",
   "created": "2026-11-08T21:16:16.701Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Krybit Ransomware Publishes 114GB from Singapore Clinic Group",
   "description": "A private primary healthcare group operating 11 clinics across Singapore was compromised by the Krybit ransomware operation, with approximately 114.15 GB of data exfiltrated and published on the group's leak site in August 2026. The leak exposes sensitive patient and clinical data amid a wave of ransomware activity that has made Singapore healthcare a prime regional target.",
   "confidence": 50,
   "labels": [
    "ransomware",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/krybit-ransomware-publishes-114gb-from-singapore-clinic-group/"
    },
    {
     "source_name": "source",
     "url": "https://www.cyfirma.com/news/weekly-intelligence-report-21-aug-2026/"
    }
   ],
   "x_securitystudies_occurred_on": "2026-08-21",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "healthcare"
   ],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--88980630-775e-5089-bc25-7c928d8f2a06",
   "created": "2026-11-08T21:16:16.701Z",
   "modified": "2026-11-08T21:16:16.701Z",
   "relationship_type": "related-to",
   "source_ref": "incident--d2795c2b-3198-57f2-be34-4960c872b853",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  }
 ]
}