{
 "type": "bundle",
 "id": "bundle--74572723-41e0-460e-a2e1-61a84d2a2ce8",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--f7d316db-381f-51e6-a4ea-729844292af2",
   "created": "2026-11-08T21:16:16.715Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Qilin ransomware compromises the Philippine Ports Authority",
   "description": "The Philippine Ports Authority was compromised on 5 September 2026 in an intrusion attributed to the Qilin ransomware operation and subsequently added to the group's data-leak site as part of a double-extortion campaign. The victim sits squarely in the transportation and maritime logistics sector at a time of heightened South China Sea tension, giving the incident strategic as well as commercial significance. Qilin remained the most prolific ransomware brand globally in 2026, with more than 500 victims claimed during the year.",
   "confidence": 50,
   "labels": [
    "ransomware",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/qilin-ransomware-compromises-the-philippine-ports-authority/"
    },
    {
     "source_name": "source",
     "url": "https://www.hookphish.com/blog/ransomware-group-qilin-hits-philippine-ports-authority/"
    },
    {
     "source_name": "source",
     "url": "https://ctiwatch.com/victims/0e550d65-88dc-4a3b-9d25-8d5d367e65e4-philippine-ports-authority"
    },
    {
     "source_name": "source",
     "url": "https://www.moxfive.com/blog/qilin-ransomware-2026-ttps-victims-and-defense-guide"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-05",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Transportation and Maritime",
    "Government"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Philippines",
   "country": "PH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--851892c9-c7f0-5d2e-9644-a4577e6c74b4",
   "created": "2026-11-08T21:16:16.715Z",
   "modified": "2026-11-08T21:16:16.715Z",
   "relationship_type": "related-to",
   "source_ref": "incident--f7d316db-381f-51e6-a4ea-729844292af2",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  }
 ]
}