{
 "type": "bundle",
 "id": "bundle--d43be036-78a1-4593-9366-04cb9f0a7cb1",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--5f9dcf4f-58d3-5a6c-a295-e75e096c521f",
   "created": "2026-11-08T21:16:16.692Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Volt Typhoon Pre-Positioning in Critical Infrastructure",
   "description": "Volt Typhoon (also Vanguard Panda) continues pre-positioning operations inside US, Japanese, and Australian critical infrastructure networks. Using living-off-the-land techniques and compromised SOHO routers as relay nodes, the group has maintained persistent access to water utilities, energy grids, transportation, and communications infrastructure across the Indo-Pacific. May 2026 CISA guidance highlights new detections in Guam-based military support infrastructure.",
   "confidence": 50,
   "labels": [
    "apt",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/volt-typhoon-pre-positioning-in-critical-infrastructure/"
    },
    {
     "source_name": "source",
     "url": {
      "title": "CISA Advisory — Volt Typhoon",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a"
     }
    },
    {
     "source_name": "source",
     "url": {
      "title": "Five Eyes Joint Advisory",
      "url": "https://www.cisa.gov/news-events/alerts/2024/02/07/cisa-and-partners-release-advisory-prc-state-sponsored-actors"
     }
    }
   ],
   "x_securitystudies_occurred_on": "2023-06-01",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Energy",
    "Water & Wastewater",
    "Transportation",
    "Communications",
    "Defense Industrial Base"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "United States",
   "country": "US"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8d927dbf-caa8-5da5-b48b-62e4f85c3211",
   "created": "2026-11-08T21:16:16.692Z",
   "modified": "2026-11-08T21:16:16.692Z",
   "relationship_type": "related-to",
   "source_ref": "incident--5f9dcf4f-58d3-5a6c-a295-e75e096c521f",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Japan",
   "country": "JP"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--3958eb33-a0da-5460-bd87-2c009c57d87b",
   "created": "2026-11-08T21:16:16.692Z",
   "modified": "2026-11-08T21:16:16.692Z",
   "relationship_type": "related-to",
   "source_ref": "incident--5f9dcf4f-58d3-5a6c-a295-e75e096c521f",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Australia",
   "country": "AU"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1dfce6ec-cd90-5d17-b051-47ecf0b9d11c",
   "created": "2026-11-08T21:16:16.692Z",
   "modified": "2026-11-08T21:16:16.692Z",
   "relationship_type": "related-to",
   "source_ref": "incident--5f9dcf4f-58d3-5a6c-a295-e75e096c521f",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--577f2ba2-fcc5-56f5-9ebd-5cfbcb60214a",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Guam",
   "country": "GU"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--4ebaeb5d-08a6-52d2-a636-562cbb457bbb",
   "created": "2026-11-08T21:16:16.692Z",
   "modified": "2026-11-08T21:16:16.692Z",
   "relationship_type": "related-to",
   "source_ref": "incident--5f9dcf4f-58d3-5a6c-a295-e75e096c521f",
   "target_ref": "location--577f2ba2-fcc5-56f5-9ebd-5cfbcb60214a",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Philippines",
   "country": "PH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--3bb50dc6-438d-5f3c-bc0a-e9d97c50e091",
   "created": "2026-11-08T21:16:16.692Z",
   "modified": "2026-11-08T21:16:16.692Z",
   "relationship_type": "related-to",
   "source_ref": "incident--5f9dcf4f-58d3-5a6c-a295-e75e096c521f",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--257df6a5-c6a4-5ea0-b30c-d36c6e83d4e9",
   "created": "2026-11-09T04:30:08.677Z",
   "modified": "2026-11-09T04:30:08.677Z",
   "name": "Volt Typhoon",
   "aliases": [
    "BRONZE SILHOUETTE",
    "DEV-0391",
    "DazedToad",
    "Dev-0391",
    "Insidious Taurus",
    "Storm-0391",
    "UNC3236",
    "VANGUARD PANDA",
    "VOLTZITE",
    "Vanguard Panda",
    "Voltzite"
   ],
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "G1017",
     "url": "https://attack.mitre.org/groups/G1017/"
    },
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/volt-typhoon/"
    }
   ],
   "description": "[Microsoft] Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.\n\n[Secureworks] BRONZE SILHOUETTE likely operates on behalf the PRC. The targeting of U.S. government and defense organizations for intelligence gain aligns with PRC requirements, and the tradecraft observed in these engagements overlap with other state-sponsored Chinese threat groups."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1c943648-05f7-51aa-8345-f44cec5ae134",
   "created": "2026-11-08T21:16:16.692Z",
   "modified": "2026-11-08T21:16:16.692Z",
   "relationship_type": "related-to",
   "source_ref": "incident--5f9dcf4f-58d3-5a6c-a295-e75e096c521f",
   "target_ref": "intrusion-set--257df6a5-c6a4-5ea0-b30c-d36c6e83d4e9",
   "description": "attribution"
  }
 ]
}