{
 "type": "bundle",
 "id": "bundle--ef44e7fa-d986-4371-bbc6-5061604634cb",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "SecFlow Campaign Uses Commercial AI Agents Against Taiwanese and Indonesian Government Targets",
   "description": "Hunt.io researchers documented Chinese-speaking operators running the SecFlow framework across five exposed directories, routing requests to Claude, Qwen and DeepSeek through private proxy servers on the niestools.com domain as interchangeable operational components. Confirmed targets include Kuomintang Party political archives in Taiwan, the Indonesian Ministry of Foreign Affairs, industrial hosts in Vietnam, and government, education and industrial entities in China. The operators deployed the GLUTTON webshell framework and ASPX web shells, used steganographic PNG payload delivery and a fake MySQL deserialization service, and dumped LSASS memory in 37-block segments. Confirmed impact totals 822 compromised office-automation user records and 1.28GB of exfiltrated data including patient health information.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/secflow-campaign-uses-commercial-ai-agents-against-taiwanese-and-indonesian-government-targets/"
    },
    {
     "source_name": "source",
     "url": "https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-04",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Education",
    "Manufacturing",
    "Healthcare"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Taiwan",
   "country": "TW"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--e7abb989-2773-57b7-ae68-ece06d3664fd",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Indonesia",
   "country": "ID"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--4f4f93e7-0fc6-5ae0-a6a0-54fca02eacca",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Vietnam",
   "country": "VN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--46ddf5df-0dfa-5683-b9b8-91ab537721e4",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--231e90b4-4920-54e1-af65-e3447d240a54",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "China",
   "country": "CN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--fb865868-8a32-500d-8fd8-2f35681509ce",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--231e90b4-4920-54e1-af65-e3447d240a54",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Thailand",
   "country": "TH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1df41102-2f1d-5e81-b020-e232fb5f92f8",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--51e9a2ca-ecb1-5c26-a8b7-e7de025a6086",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Afghanistan",
   "country": "AF"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8e9b5194-01ee-57c0-8e08-073a02c4576d",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--51e9a2ca-ecb1-5c26-a8b7-e7de025a6086",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04",
   "created": "2026-11-08T21:16:16.712Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Four nation-state actors deploy shared BlueMoon Chrome and Windows zero-day exploit kit within twelve days",
   "description": "TA412 (APT31) and three suspected China-aligned clusters tracked as UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket independently deployed the same exploit chain combining Chrome V8 type confusion CVE-2026-85046, an unnamed V8 sandbox escape and Windows kernel privilege escalation CVE-2026-85880. TA412 activity began on 28 August 2026 against US NGOs, mining companies and commodity traders; the other clusters followed from 2 September, hitting Vietnamese manufacturing and then Indonesian and Singaporean government, consulting and financial entities. The Chromium patch had been public since 7 August but Chrome stable only shipped on 3 September, giving the actors a wide exploitation window. The convergence on one kit points to a shared exploit broker or quartermaster.",
   "confidence": 50,
   "labels": [
    "apt",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/four-nation-state-actors-deploy-shared-bluemoon-chrome-and-windows-zero-day-exploit-kit-within-twelve-days/"
    },
    {
     "source_name": "source",
     "url": "https://securityaffairs.com/198783/apt/four-nation-state-actors-used-the-same-chrome-zero-day-exploit-kit-within-12-days.html"
    },
    {
     "source_name": "source",
     "url": "https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog"
    },
    {
     "source_name": "source",
     "url": "https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog"
    }
   ],
   "x_securitystudies_occurred_on": "2026-08-28",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Non-Governmental Organisations",
    "Financial Services",
    "Manufacturing",
    "Mining and Commodities",
    "Consulting"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "United States",
   "country": "US"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--33536cf2-31dc-52b6-9de7-2540505f4ff7",
   "created": "2026-11-08T21:16:16.712Z",
   "modified": "2026-11-08T21:16:16.712Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1428f606-b7b8-5664-8d37-1a536e6adc6c",
   "created": "2026-11-08T21:16:16.712Z",
   "modified": "2026-11-08T21:16:16.712Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04",
   "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--404fb36c-6be0-553e-bab5-abe8231b4b39",
   "created": "2026-11-08T21:16:16.712Z",
   "modified": "2026-11-08T21:16:16.712Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04",
   "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Singapore",
   "country": "SG"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--ccd3bd92-7e66-5469-9340-df2377d29dfc",
   "created": "2026-11-08T21:16:16.712Z",
   "modified": "2026-11-08T21:16:16.712Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--eba46e04-3a48-519e-92af-b6843d4a64e9",
   "created": "2026-11-09T04:30:08.701Z",
   "modified": "2026-11-09T04:30:08.701Z",
   "name": "APT31",
   "aliases": [
    "BRONZE VINEWOOD",
    "JUDGMENT PANDA",
    "Red keres",
    "TA412",
    "TIDE CASTLE",
    "Violet Typhoon",
    "ZIRCONIUM",
    "Zirconium"
   ],
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "G0128",
     "url": "https://attack.mitre.org/groups/G0128/"
    },
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/apt31/"
    }
   ],
   "description": "FireEye characterizes APT31 as an actor specialized on intellectual property theft, focusing on data and projects that make a particular organization competetive in its field. Based on available data (April 2016), FireEye assesses that APT31 conducts network operations at the behest of the Chinese Government. Also according to Crowdstrike, this adversary is suspected of continuing to target upstream providers (e.g., law firms and managed service providers) to support additional intrusions against high-profile assets. In 2018, CrowdStrike observed this adversary using spear-phishing, URL “web bugs” and scheduled tasks to automate credential harvesting."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8930a8c1-02ca-5f17-ab1b-f6a440f98dbe",
   "created": "2026-11-08T21:16:16.712Z",
   "modified": "2026-11-08T21:16:16.712Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7c4fd82c-a984-5d50-abdc-b98dedbb7e04",
   "target_ref": "intrusion-set--eba46e04-3a48-519e-92af-b6843d4a64e9",
   "description": "attribution"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--65ed60ac-e929-5669-9c28-a3ae6d173352",
   "created": "2026-11-08T21:16:16.705Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Gunra Ransomware Steals 150GB from Indonesian Agri-Biotech Manufacturer",
   "description": "An Indonesian agricultural biotechnology and fertilizer manufacturing company was claimed by the Gunra ransomware group in August 2026, with approximately 150 GB of confidential corporate data compromised. The attack adds to Indonesia's intensifying threat landscape, where the country is both a major source of botnet infrastructure and a frequent ransomware and DDoS target.",
   "confidence": 50,
   "labels": [
    "ransomware",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/gunra-ransomware-steals-150gb-from-indonesian-agri-biotech-manufacturer/"
    },
    {
     "source_name": "source",
     "url": "https://www.cyfirma.com/news/weekly-intelligence-report-21-aug-2026/"
    }
   ],
   "x_securitystudies_occurred_on": "2026-08-21",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "agriculture",
    "manufacturing"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--f69f2eec-be46-5f31-b1c7-2be3abaae725",
   "created": "2026-11-08T21:16:16.705Z",
   "modified": "2026-11-08T21:16:16.705Z",
   "relationship_type": "related-to",
   "source_ref": "incident--65ed60ac-e929-5669-9c28-a3ae6d173352",
   "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--74657fff-2b96-5e87-8bba-660969e4162e",
   "created": "2026-11-08T21:16:16.719Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "China-linked SecFlow campaign uses AI agents against Asian government and industrial targets",
   "description": "Hunt.io documented a Chinese-speaking operation tracked as SecFlow, linked to a username 'Nie' recurring across its infrastructure, which routed Claude, Qwen and DeepSeek through private proxies at niestools.com to automate reconnaissance and exploitation. The toolkit included the GLUTTON webshell framework delivering steganographic payloads inside PNG files, a fake MySQL deserialization service, a Java and CAS exploitation workspace, and Shellshock and credential-testing nodes. Confirmed targeting spanned Kuomintang Party archives in Taiwan, the Indonesian Ministry of Foreign Affairs, and Chinese and Vietnamese government, education and industrial hosts. A confirmed breach of the Fengtai District government office-automation environment yielded 822 OA user records and 1.28GB of data including patient health information.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/china-linked-secflow-campaign-uses-ai-agents-against-asian-government-and-industrial-targets/"
    },
    {
     "source_name": "source",
     "url": "https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-08-20",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Education",
    "Defense",
    "Industrial"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--71e28321-0abc-5e25-965c-aa00c51fe6c5",
   "created": "2026-11-08T21:16:16.719Z",
   "modified": "2026-11-08T21:16:16.719Z",
   "relationship_type": "related-to",
   "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--6f5180ac-106f-503e-86ac-5890fc36ea67",
   "created": "2026-11-08T21:16:16.719Z",
   "modified": "2026-11-08T21:16:16.719Z",
   "relationship_type": "related-to",
   "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e",
   "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--25b1769c-a3f9-5501-9181-7fe452a1ef4b",
   "created": "2026-11-08T21:16:16.719Z",
   "modified": "2026-11-08T21:16:16.719Z",
   "relationship_type": "related-to",
   "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e",
   "target_ref": "location--231e90b4-4920-54e1-af65-e3447d240a54",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--6ca59b95-4835-5e06-8708-e735d0538a5c",
   "created": "2026-11-08T21:16:16.719Z",
   "modified": "2026-11-08T21:16:16.719Z",
   "relationship_type": "related-to",
   "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e",
   "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "description": "affected country"
  }
 ]
}