{
 "type": "bundle",
 "id": "bundle--dd474b0e-a2de-41cc-ad07-2e9b7e8b699c",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--98ed5a28-001f-5c9c-be72-67b4f6d8f172",
   "created": "2026-11-08T21:16:16.713Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "North Korea-linked backdoor found compiled inside HAProxy at two South Korean companies",
   "description": "Rapid7 Labs disclosed that DPRK-aligned operators compiled a backdoor named 'ted' directly into the victims' existing HAProxy 2.8.12 load balancers using native HAProxy filter APIs, accompanied by a tool named curlRAT and trojanised crond, agetty, atd, sshd and polkitd daemons. C2 mode was triggered by a request for a decoy image path, after which commands were passed via named pipes and the requests were erased from HAProxy logs and statistics without ever reaching the backend. Two South Korean companies in the automotive and media sectors were confirmed affected, with capabilities including credential harvesting, SSH keylogging, session cookie theft and fingerprint-matched drive-by injection. Attribution to APT37 is medium confidence, with possible Lazarus Group overlap.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/north-korea-linked-backdoor-found-compiled-inside-haproxy-at-two-south-korean-companies/"
    },
    {
     "source_name": "source",
     "url": "https://securityaffairs.com/198656/apt/north-korea-linked-hackers-hide-a-backdoor-inside-haproxy.html"
    },
    {
     "source_name": "source",
     "url": "https://www.cyfirma.com/news/weekly-intelligence-report-11-sep-2026/"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-01",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Automotive Manufacturing",
    "Media and Broadcasting"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "South Korea",
   "country": "KR"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--5f94e84a-ffce-5a57-a5e0-5a3451e7db0c",
   "created": "2026-11-08T21:16:16.713Z",
   "modified": "2026-11-08T21:16:16.713Z",
   "relationship_type": "related-to",
   "source_ref": "incident--98ed5a28-001f-5c9c-be72-67b4f6d8f172",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--4e396b0b-8285-592f-aca9-1f2ac1d1b837",
   "created": "2026-11-09T04:30:08.705Z",
   "modified": "2026-11-09T04:30:08.705Z",
   "name": "APT37",
   "aliases": [
    "APT 37",
    "APT-C-28",
    "ATK4",
    "G0067",
    "Group 123",
    "Group123",
    "InkySquid",
    "Moldy Pisces",
    "Operation Daybreak",
    "Operation Erebus",
    "PLAIN NEPTUNE",
    "Reaper",
    "Reaper Group",
    "Red Eyes",
    "Ricochet Chollima",
    "ScarCruft",
    "TEMP.Reaper",
    "Venus 121"
   ],
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "G0067",
     "url": "https://attack.mitre.org/groups/G0067/"
    },
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/apt37/"
    }
   ],
   "description": "APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--e29e5553-6900-5058-871f-f3e3b779c601",
   "created": "2026-11-08T21:16:16.713Z",
   "modified": "2026-11-08T21:16:16.713Z",
   "relationship_type": "related-to",
   "source_ref": "incident--98ed5a28-001f-5c9c-be72-67b4f6d8f172",
   "target_ref": "intrusion-set--4e396b0b-8285-592f-aca9-1f2ac1d1b837",
   "description": "attribution"
  }
 ]
}