{
 "type": "bundle",
 "id": "bundle--52575f39-de92-4f12-8708-76b6ed692a73",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--cd95d4e1-67d8-5194-b1c7-c10eac110489",
   "created": "2026-11-08T21:16:16.704Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Nine-Month Intrusion at Korea National Diplomatic Academy Exposes Diplomat Data",
   "description": "South Korea's Ministry of Foreign Affairs disclosed that attackers exploited a vulnerability in the Korea National Diplomatic Academy's online training platform and maintained access from April 2025 until detection in February 2026. Roughly 10,000 records covering about 6,000 current and former diplomats were exposed, including names, user IDs, emails, encrypted passwords, titles and department affiliations; investigators are examining possible North Korean involvement.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/nine-month-intrusion-at-korea-national-diplomatic-academy-exposes-diplomat-data/"
    },
    {
     "source_name": "source",
     "url": "https://therecord.media/south-korea-cyberattack-foreign-ministry"
    }
   ],
   "x_securitystudies_occurred_on": "2026-07-21",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "government",
    "diplomacy"
   ],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "South Korea",
   "country": "KR"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--0399b4ee-068b-5e3e-bb6e-2fa25ce7fc8b",
   "created": "2026-11-08T21:16:16.704Z",
   "modified": "2026-11-08T21:16:16.704Z",
   "relationship_type": "related-to",
   "source_ref": "incident--cd95d4e1-67d8-5194-b1c7-c10eac110489",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  }
 ]
}