{
 "type": "bundle",
 "id": "bundle--0bf3a973-2254-4f83-80d0-d5b15e88b46e",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--c9349066-9a54-5b91-bd46-a5c1b44b1934",
   "created": "2026-11-10T16:32:08.273Z",
   "modified": "2026-11-11T20:40:49.504Z",
   "name": "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise",
   "description": "Detected automatically from 1 article in 1 outlet (Microsoft Threat Intelligence), Oct 21, 2026. Type: espionage campaign. Asia-Pacific countries affected: Japan. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "espionage",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/ai-driven-large-scale-nation-state-campaign-using-artex-enables-supply-20261021/"
    },
    {
     "source_name": "Microsoft Threat Intelligence",
     "url": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/",
     "description": "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-21",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Japan",
   "country": "JP"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--43517ba8-805e-5e4e-8bbb-ed2d85d3d515",
   "created": "2026-11-10T16:32:08.273Z",
   "modified": "2026-11-10T16:32:08.273Z",
   "relationship_type": "related-to",
   "source_ref": "incident--c9349066-9a54-5b91-bd46-a5c1b44b1934",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6",
   "created": "2026-11-09T04:30:05.339Z",
   "modified": "2026-11-09T04:30:05.339Z",
   "name": "Storm-0940",
   "aliases": [
    "CovertNetwork-1658",
    "ORB07"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/storm-0940/"
    }
   ],
   "description": "Storm-0940 is a Chinese threat actor active since at least 2021, known for gaining initial access through password spray and brute-force attacks, as well as exploiting network edge applications. Microsoft has observed Storm-0940 utilizing valid credentials obtained from CovertNetwork-1658's password spray operations, indicating a close operational relationship between the two. Once inside a victim environment, Storm-0940 has been seen leveraging compromised credentials for further malicious activities. Additionally, Storm-0940 has employed botnets, such as Quad7, to facilitate password spraying attacks."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--a79fcf4b-f426-5493-add9-64df31b69d4c",
   "created": "2026-11-10T16:32:08.273Z",
   "modified": "2026-11-10T16:32:08.273Z",
   "relationship_type": "related-to",
   "source_ref": "incident--c9349066-9a54-5b91-bd46-a5c1b44b1934",
   "target_ref": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6",
   "description": "actor named in the coverage (the sources' attribution)"
  }
 ]
}