{
 "type": "bundle",
 "id": "bundle--05be6d8b-b77b-4882-805e-11a6fe1bc526",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--4da37fa4-4d5d-55ac-a9b1-1036b696dc20",
   "created": "2026-11-08T21:16:16.694Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Lazarus Group Cryptocurrency Exchange Heist — Singapore",
   "description": "Lazarus Group (DPRK) executed a sophisticated supply-chain compromise of a cryptocurrency custodial platform based in Singapore, stealing approximately USD 230 million in mixed crypto assets. The attack chain involved compromising a third-party trading SDK used by the exchange, injecting malicious transaction-signing code. FBI and MAS (Monetary Authority of Singapore) issued joint alert. Funds traced through Tornado Cash and cross-chain bridges to DPRK-linked wallets.",
   "confidence": 50,
   "labels": [
    "apt",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/lazarus-group-cryptocurrency-exchange-heist-singapore/"
    },
    {
     "source_name": "source",
     "url": {
      "title": "FBI Flash Alert",
      "url": "https://www.ic3.gov/"
     }
    },
    {
     "source_name": "source",
     "url": {
      "title": "Chainalysis Reactor Analysis",
      "url": "https://www.chainalysis.com/blog/"
     }
    }
   ],
   "x_securitystudies_occurred_on": "2026-04-28",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Financial Services",
    "Cryptocurrency"
   ],
   "x_securitystudies_eu_relevance": "high"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Singapore",
   "country": "SG"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--2fd59763-3328-5087-963a-aa90f344c88e",
   "created": "2026-11-08T21:16:16.694Z",
   "modified": "2026-11-08T21:16:16.694Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4da37fa4-4d5d-55ac-a9b1-1036b696dc20",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "South Korea",
   "country": "KR"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--65796606-a29d-51c5-ac34-bad363d7e87b",
   "created": "2026-11-08T21:16:16.694Z",
   "modified": "2026-11-08T21:16:16.694Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4da37fa4-4d5d-55ac-a9b1-1036b696dc20",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Japan",
   "country": "JP"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--fe350086-6cca-53b9-a30e-170b29fe9046",
   "created": "2026-11-08T21:16:16.694Z",
   "modified": "2026-11-08T21:16:16.694Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4da37fa4-4d5d-55ac-a9b1-1036b696dc20",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--1c81c67d-4875-5b86-9083-46b743ee21c5",
   "created": "2026-11-09T04:30:08.761Z",
   "modified": "2026-11-09T04:30:08.761Z",
   "name": "Lazarus Group",
   "aliases": [
    "APT 38",
    "APT-C-26",
    "APT38",
    "ATK117",
    "ATK3",
    "Andariel",
    "AppleJeus",
    "Appleworm",
    "BeagleBoyz",
    "Black Artemis",
    "Bluenoroff",
    "Bureau 121",
    "COPERNICIUM",
    "COVELLITE",
    "Citrine Sleet",
    "DEV-0139",
    "DEV-1222",
    "Dark Seoul",
    "Diamond Sleet",
    "G0032",
    "G0082",
    "Gleaming Pisces",
    "Group 77",
    "Guardians of Peace",
    "HIDDEN COBRA",
    "Hastati Group",
    "Hidden Cobra",
    "Labyrinth Chollima",
    "Lazarus group",
    "Moonstone Sleet",
    "NICKEL ACADEMY",
    "NICKEL GLADSTONE",
    "NewRomanic Cyber Army Team",
    "Nickel Academy",
    "Onyx Sleet",
    "Operation AppleJeus",
    "Operation DarkSeoul",
    "Operation GhostSecret",
    "Operation Troy",
    "PLUTONIUM"
   ],
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "G1036",
     "url": "https://attack.mitre.org/groups/G1036/"
    },
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/lazarus-group/"
    }
   ],
   "description": "Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Duuzer, and Hangman."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--428febc3-e79d-5bc3-8cb6-e88f3d375dbd",
   "created": "2026-11-08T21:16:16.694Z",
   "modified": "2026-11-08T21:16:16.694Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4da37fa4-4d5d-55ac-a9b1-1036b696dc20",
   "target_ref": "intrusion-set--1c81c67d-4875-5b86-9083-46b743ee21c5",
   "description": "attribution"
  }
 ]
}