{
 "type": "bundle",
 "id": "bundle--2781a958-6945-452d-870a-35f2a318c513",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--636a9f6e-cdf1-51bb-89a1-4c7df294062b",
   "created": "2026-11-12T06:04:37.071Z",
   "modified": "2026-11-13T06:07:08.798Z",
   "name": "CAAT says only 2 from 7 main Thai airlines affected by data breach",
   "description": "Detected automatically from 1 article in 1 outlet (The Thaiger), Nov 12, 2026. Type: data breach; sectors: transportation. Asia-Pacific countries affected: Thailand. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/caat-says-only-2-from-7-main-thai-airlines-affected-by-data-breach-20261112/"
    },
    {
     "source_name": "The Thaiger",
     "url": "https://thethaiger.com/news/world/aviation/thai-airways-and-bangkok-airways-affected-by-data-leak",
     "description": "CAAT says only 2 from 7 main Thai airlines affected by data breach"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-12",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Transportation"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Thailand",
   "country": "TH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--10c85fd3-6296-5ad1-bea7-26bf577de962",
   "created": "2026-11-12T06:04:37.071Z",
   "modified": "2026-11-12T06:04:37.071Z",
   "relationship_type": "related-to",
   "source_ref": "incident--636a9f6e-cdf1-51bb-89a1-4c7df294062b",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--cef2404f-e717-5c0f-b1e7-cb8cefded577",
   "created": "2026-11-10T16:32:08.715Z",
   "modified": "2026-11-13T06:07:08.650Z",
   "name": "Deputy Chief of Kut Chok Subdistrict Administrative Organization files a report with Cyber Police to find the person who hacked his Facebook",
   "description": "Detected automatically from 2 articles in 2 outlets (Khaosod (Thai), Matichon), Nov 9, 2026. Title machine-translated from Thai. Type: intrusion; sectors: government. Asia-Pacific countries affected: Thailand. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "intrusion",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/incident-20261109-2/"
    },
    {
     "source_name": "Khaosod (Thai)",
     "url": "https://www.khaosod.co.th/around-thailand/news_10466378",
     "description": "ปลัด อบต.กุดจอก แจ้งความตร.ไซเบอร์ หาตัวคนแฮกเฟซบุ๊ก"
    },
    {
     "source_name": "Matichon",
     "url": "https://www.matichon.co.th/region/news_5968556",
     "description": "ยันถูกแฮก! ปลัด อบต.กุดจอก หอบหลักฐานแจ้งความ ปัดส่งเจ้าหน้าที่ด่าทอผู้สื่อข่าว"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-09",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Government"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--3c179534-43f4-56e6-a54a-d5010a4878d9",
   "created": "2026-11-10T16:32:08.715Z",
   "modified": "2026-11-10T16:32:08.715Z",
   "relationship_type": "related-to",
   "source_ref": "incident--cef2404f-e717-5c0f-b1e7-cb8cefded577",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-13T06:07:08.574Z",
   "name": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns",
   "description": "Detected automatically from 2 articles in 2 outlets (Check Point Research, Microsoft Threat Intelligence), Nov 5 to Nov 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea, Hong Kong, Thailand, Cambodia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "espionage",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/hacking-on-autopilot-inside-artex-cybercrime-campaigns-20261105/"
    },
    {
     "source_name": "Check Point Research",
     "url": "https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/",
     "description": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns"
    },
    {
     "source_name": "Microsoft Threat Intelligence",
     "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "description": "ARTEX abuse expands as cybercriminals target financial sector"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-05",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Hong Kong",
   "country": "HK"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--ef85cfba-0238-5680-aea1-65608ed33612",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--045a1890-e799-520f-8119-ae91e4fb69bb",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Cambodia",
   "country": "KH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--9b12a351-49f3-59e1-9cc0-9a00ca31b2c8",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--045a1890-e799-520f-8119-ae91e4fb69bb",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "South Korea",
   "country": "KR"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--2990eb21-033c-5af2-8a5b-46e23b3cb343",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--7985a9d6-9e8b-57bc-9e3e-2829147cbdd9",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6",
   "created": "2026-11-09T04:30:05.339Z",
   "modified": "2026-11-09T04:30:05.339Z",
   "name": "Storm-0940",
   "aliases": [
    "CovertNetwork-1658",
    "ORB07"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/storm-0940/"
    }
   ],
   "description": "Storm-0940 is a Chinese threat actor active since at least 2021, known for gaining initial access through password spray and brute-force attacks, as well as exploiting network edge applications. Microsoft has observed Storm-0940 utilizing valid credentials obtained from CovertNetwork-1658's password spray operations, indicating a close operational relationship between the two. Once inside a victim environment, Storm-0940 has been seen leveraging compromised credentials for further malicious activities. Additionally, Storm-0940 has employed botnets, such as Quad7, to facilitate password spraying attacks."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1999587e-b927-574f-9ab1-fa9a82d2d58e",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6",
   "description": "actor named in the coverage (the sources' attribution)"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-13T06:07:08.404Z",
   "name": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack",
   "description": "Detected automatically from 8 articles in 7 outlets (Bangkok Post, Channel News Asia, Malay Mail, Matichon, South China Morning Post, The Straits Times and others), Oct 30 to Nov 10, 2026. Type: data breach; sectors: transportation, technology. Asia-Pacific countries affected: Thailand, Japan, Singapore, Hong Kong, Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/cathay-pacific-says-data-from-53000-bookings-compromised-in-amadeus-cy-20261030/"
    },
    {
     "source_name": "South China Morning Post",
     "url": "https://www.scmp.com/news/hong-kong/transport/article/3372722/cathay-pacific-says-data-53000-bookings-compromised-amadeus-cyberattack",
     "description": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack"
    },
    {
     "source_name": "Malay Mail",
     "url": "https://www.malaymail.com/news/malaysia/2026/11/01/malaysia-airlines-warns-customers-of-data-exposure-in-amadeus-cybersecurity-breach/241516",
     "description": "Malaysia Airlines warns customers of data exposure in Amadeus cybersecurity breach"
    },
    {
     "source_name": "The Straits Times",
     "url": "https://www.straitstimes.com/singapore/46000-sia-booking-records-accessed-illegally-in-data-breach-affecting-software-provider-amadeus",
     "description": "46,000 SIA booking records accessed illegally in data breach affecting software provider Amadeus"
    },
    {
     "source_name": "Channel News Asia",
     "url": "https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151",
     "description": "About 46,000 SIA booking records accessed in data breach involving travel tech company Amadeus"
    },
    {
     "source_name": "Matichon",
     "url": "https://www.matichon.co.th/economy/news_5969157",
     "description": "การบินไทย รับถูกแฮก ข้อมูลรั่ว 6 หมื่นรายการ แต่ไม่กระทบข้อมูลบัตรเครดิต"
    },
    {
     "source_name": "Bangkok Post",
     "url": "https://www.bangkokpost.com/thailand/general/3352180/60000-thai-bookings-compromised-in-amadeus-breach",
     "description": "THAI passenger data compromised in Amadeus security breach"
    },
    {
     "source_name": "The Thaiger",
     "url": "https://thethaiger.com/news/world/aviation/thai-airways-confirms-passenger-data-leak-but-credit-card-details-safe",
     "description": "Thai Airways confirms passenger data leak but credit card details safe"
    },
    {
     "source_name": "Matichon",
     "url": "https://www.matichon.co.th/economy/news_5969937",
     "description": "การบินไทย แจ้ง ไซเบอร์โจมตี ข้อมูล 6 หมื่นรายการรั่วไหล ไชยชนก ถก ‘แอปเปิ้ล’ สกัด"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-30",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Transportation",
    "Technology"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--d8dcd32a-245a-5e4c-b9bc-e5e43b9093eb",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Japan",
   "country": "JP"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--317010bf-0058-51a9-b822-d6d704efbe31",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Malaysia",
   "country": "MY"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--a3ed75f2-2699-5840-b35c-27be8a40c0cc",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Singapore",
   "country": "SG"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--dc48e5ec-d80c-5cbd-bea5-0fd84c8f8607",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--6dac9bd3-fa51-5640-8e1c-99147e4a1ad5",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "SecFlow Campaign Uses Commercial AI Agents Against Taiwanese and Indonesian Government Targets",
   "description": "Hunt.io researchers documented Chinese-speaking operators running the SecFlow framework across five exposed directories, routing requests to Claude, Qwen and DeepSeek through private proxy servers on the niestools.com domain as interchangeable operational components. Confirmed targets include Kuomintang Party political archives in Taiwan, the Indonesian Ministry of Foreign Affairs, industrial hosts in Vietnam, and government, education and industrial entities in China. The operators deployed the GLUTTON webshell framework and ASPX web shells, used steganographic PNG payload delivery and a fake MySQL deserialization service, and dumped LSASS memory in 37-block segments. Confirmed impact totals 822 compromised office-automation user records and 1.28GB of exfiltrated data including patient health information.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/secflow-campaign-uses-commercial-ai-agents-against-taiwanese-and-indonesian-government-targets/"
    },
    {
     "source_name": "source",
     "url": "https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-04",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Education",
    "Manufacturing",
    "Healthcare"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Taiwan",
   "country": "TW"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--e7abb989-2773-57b7-ae68-ece06d3664fd",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Indonesia",
   "country": "ID"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--4f4f93e7-0fc6-5ae0-a6a0-54fca02eacca",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Vietnam",
   "country": "VN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--46ddf5df-0dfa-5683-b9b8-91ab537721e4",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--231e90b4-4920-54e1-af65-e3447d240a54",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "China",
   "country": "CN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--fb865868-8a32-500d-8fd8-2f35681509ce",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--231e90b4-4920-54e1-af65-e3447d240a54",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1df41102-2f1d-5e81-b020-e232fb5f92f8",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--51e9a2ca-ecb1-5c26-a8b7-e7de025a6086",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Afghanistan",
   "country": "AF"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8e9b5194-01ee-57c0-8e08-073a02c4576d",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--51e9a2ca-ecb1-5c26-a8b7-e7de025a6086",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Earth Alux Espionage Campaign Targets ASEAN Defense Ministries",
   "description": "Trend Micro researchers disclosed an ongoing espionage campaign by Earth Alux (China-linked) targeting defense ministries and military contractors across Thailand, Philippines, Vietnam, and Malaysia. The group deployed VARGEIT and COBEACON implants via trojanized military procurement documents. The campaign has been active since at least Q4 2025, with lateral movement into classified networks confirmed at two ASEAN defense organizations.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/earth-alux-espionage-campaign-targets-asean-defense-ministries/"
    },
    {
     "source_name": "source",
     "url": {
      "title": "Trend Micro Research",
      "url": "https://www.trendmicro.com/en_us/research.html"
     }
    }
   ],
   "x_securitystudies_occurred_on": "2025-10-15",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Defense",
    "Government",
    "Defense Industrial Base"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--c0026139-5643-5d47-bac1-71c57ff02bda",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-08T21:16:16.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Philippines",
   "country": "PH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--c47a29ab-212b-5f0b-97dc-f1d5ac028775",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-08T21:16:16.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--53a044f5-0589-5f74-8b1e-d49911eede50",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-08T21:16:16.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--5e562017-2630-53a9-8411-2e18c658a7e4",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-08T21:16:16.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--84c9386a-a191-5067-af66-85089b12bc28",
   "created": "2026-11-09T04:30:05.352Z",
   "modified": "2026-11-09T04:30:05.352Z",
   "name": "Earth Alux",
   "aliases": [],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/earth-alux/"
    }
   ],
   "description": "Earth Alux is a China-linked APT group known for conducting cyberespionage attacks across various sectors, including government, technology, and telecommunications. They primarily exploit vulnerable services in exposed servers to gain initial access, implanting web shells like GODZILLA and deploying backdoors such as VARGEIT and COBEACON. The group employs tools like RSBINJECT and MASQLOADER for lateral movement and network discovery, while also utilizing RAILSETTER for persistence through mspaint injection. Their operations have predominantly targeted the APAC region and have extended to Latin America, with a focus on exfiltrating sensitive information to attacker-controlled cloud storage."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--2e655fb6-f447-589e-b353-53cbe2ca73fc",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-08T21:16:16.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "target_ref": "intrusion-set--84c9386a-a191-5067-af66-85089b12bc28",
   "description": "attribution"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Salt Typhoon Telecom Espionage Campaign — Ongoing",
   "description": "Chinese state-sponsored group Salt Typhoon (also tracked as GhostEmperor/FamousSparrow) continues to maintain persistent access to major US, Southeast Asian, and Australian telecommunications networks. The campaign, first publicly disclosed in late 2024, has been confirmed to compromise call detail records and lawful intercept systems across at least 9 major carriers. As of May 2026, incident response is ongoing at several ASEAN-region telecoms. CISA has issued updated advisories recommending encrypted communications for government officials.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/salt-typhoon-telecom-espionage-campaign-ongoing/"
    },
    {
     "source_name": "source",
     "url": {
      "title": "CISA Advisory AA24-340A",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-340a"
     }
    },
    {
     "source_name": "source",
     "url": {
      "title": "Microsoft Threat Intelligence",
      "url": "https://www.microsoft.com/en-us/security/blog/"
     }
    }
   ],
   "x_securitystudies_occurred_on": "2024-09-15",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Telecommunications",
    "Government",
    "Defense"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "United States",
   "country": "US"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--435d00ae-93cc-5b82-973d-553a2ad2316c",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8108d9cb-277e-53fe-b5e8-3795c21eb8aa",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--9072f4ee-c5de-5753-a3e6-9be0f67cbc1b",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Australia",
   "country": "AU"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--d963c41d-ea95-5987-a1e4-a461feb2cbdc",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--26c5417c-4add-561a-9231-6a9797918e9d",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8be3764b-86b0-5fde-af53-2f87940a6fa2",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--642c612d-bcf7-5030-bd96-c51cad00d04e",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--994a786f-903b-5827-8b99-fb2bcf62d3db",
   "created": "2026-11-09T04:30:08.681Z",
   "modified": "2026-11-09T04:30:08.681Z",
   "name": "GhostEmperor",
   "aliases": [
    "FamousSparrow",
    "OPERATOR PANDA",
    "RedMike",
    "Salt Typhoon",
    "UNC2286"
   ],
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "G1045",
     "url": "https://attack.mitre.org/groups/G1045/"
    },
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/ghostemperor/"
    }
   ],
   "description": "GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--344356d8-39e3-5c5b-b48f-9b5cf793a03a",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "intrusion-set--994a786f-903b-5827-8b99-fb2bcf62d3db",
   "description": "attribution"
  }
 ]
}