{
 "type": "bundle",
 "id": "bundle--b635c20e-66af-40eb-89c6-fe1e64c33b70",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--01cc87e3-182b-5f02-a6e7-fe794c4418fb",
   "created": "2026-11-11T12:23:36.548Z",
   "modified": "2026-11-13T00:02:47.828Z",
   "name": "Fireworks AI reports new breach after cloud provider hack",
   "description": "Detected automatically from 1 article in 1 outlet (ETCISO (Economic Times)), Nov 11, 2026. Type: data breach; sectors: technology. Asia-Pacific countries affected: India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/fireworks-ai-reports-new-breach-after-cloud-provider-hack-20261111/"
    },
    {
     "source_name": "ETCISO (Economic Times)",
     "url": "https://ciso.economictimes.indiatimes.com/news/data-breaches/fireworks-ai-reports-new-breach-after-cloud-provider-hack/135723444",
     "description": "Fireworks AI reports new breach after cloud provider hack"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-11",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Technology"
   ],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--095279bc-69f1-5155-a576-8cfad052b57e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "India",
   "country": "IN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--55a915b5-aea9-5c6b-bbc3-36e8cf5a4b2b",
   "created": "2026-11-11T12:23:36.548Z",
   "modified": "2026-11-11T12:23:36.548Z",
   "relationship_type": "related-to",
   "source_ref": "incident--01cc87e3-182b-5f02-a6e7-fe794c4418fb",
   "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--6eb20c15-2e94-5172-8c2c-bb1d822f59b8",
   "created": "2026-11-10T16:32:08.678Z",
   "modified": "2026-11-13T00:02:47.668Z",
   "name": "Mirae Asset says data breaches exposed customer, employee information",
   "description": "Detected automatically from 4 articles in 3 outlets (ETCISO (Economic Times), The Korea Herald, Yonhap), Nov 6 to Nov 9, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: South Korea, India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/mirae-asset-says-data-breaches-exposed-customer-employee-information-20261106/"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261107000400315",
     "description": "Mirae Asset says data breaches exposed customer, employee information"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261107000451315",
     "description": "(LEAD) Personal info of some 39,000 leaked from Mirae Asset Securities"
    },
    {
     "source_name": "The Korea Herald",
     "url": "https://www.koreaherald.com/article/10929242",
     "description": "Personal info of some 39,000 leaked from Mirae Asset Securities"
    },
    {
     "source_name": "ETCISO (Economic Times)",
     "url": "https://ciso.economictimes.indiatimes.com/news/data-breaches/personal-info-of-39000-persons-leaked-from-mirae-asset-securities/135669047",
     "description": "Personal info of 39,000 persons leaked from Mirae Asset Securities"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-06",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8730a6a4-1342-5393-ac9d-7cfd7315a152",
   "created": "2026-11-10T16:32:08.678Z",
   "modified": "2026-11-10T16:32:08.678Z",
   "relationship_type": "related-to",
   "source_ref": "incident--6eb20c15-2e94-5172-8c2c-bb1d822f59b8",
   "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "South Korea",
   "country": "KR"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--65a71513-9667-5cbf-8f43-633d1647f9aa",
   "created": "2026-11-10T16:32:08.678Z",
   "modified": "2026-11-10T16:32:08.678Z",
   "relationship_type": "related-to",
   "source_ref": "incident--6eb20c15-2e94-5172-8c2c-bb1d822f59b8",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--31085285-db42-5c18-8a9a-3c132955b4d7",
   "created": "2026-11-10T16:32:08.553Z",
   "modified": "2026-11-13T00:02:47.539Z",
   "name": "PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia",
   "description": "Detected automatically from 1 article in 1 outlet (Dark Reading), Nov 2, 2026. Type: espionage campaign. Asia-Pacific countries affected: India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "espionage",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/paprat-cyber-espionage-campaign-leaves-a-bitter-taste-in-south-asia-20261102/"
    },
    {
     "source_name": "Dark Reading",
     "url": "https://www.darkreading.com/cyberattacks-data-breaches/paprat-cyberespionage-campaign-bitter-south-asia",
     "description": "PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-02",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--47e86df0-ca50-50eb-bbdc-0ed3cd9795c9",
   "created": "2026-11-10T16:32:08.553Z",
   "modified": "2026-11-10T16:32:08.553Z",
   "relationship_type": "related-to",
   "source_ref": "incident--31085285-db42-5c18-8a9a-3c132955b4d7",
   "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--f930550a-e9fd-5a9b-b713-a6aecbb01a92",
   "created": "2026-11-10T16:32:08.256Z",
   "modified": "2026-11-11T20:40:49.481Z",
   "name": "State Bank of India reports cyberattack involving nearly 3,900 customer records",
   "description": "Detected automatically from 1 article in 1 outlet (Channel News Asia), Oct 21, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/state-bank-of-india-reports-cyberattack-involving-nearly-3900-customer-20261021/"
    },
    {
     "source_name": "Channel News Asia",
     "url": "https://www.channelnewsasia.com/business/state-bank-india-reports-cyberattack-involving-nearly-3900-customer-records-6477746",
     "description": "State Bank of India reports cyberattack involving nearly 3,900 customer records"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-21",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--c7d39e72-caa5-5141-9775-c82f2bf404ca",
   "created": "2026-11-10T16:32:08.256Z",
   "modified": "2026-11-10T16:32:08.256Z",
   "relationship_type": "related-to",
   "source_ref": "incident--f930550a-e9fd-5a9b-b713-a6aecbb01a92",
   "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--167ea1de-40ba-55d9-81b2-cbf681891ff2",
   "created": "2026-11-10T16:32:07.714Z",
   "modified": "2026-11-10T16:40:20.163Z",
   "name": "Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties",
   "description": "Detected automatically from 1 article in 1 outlet (SentinelLabs), Sep 18, 2026. Type: espionage campaign; sectors: cryptocurrency. Asia-Pacific countries affected: India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "espionage",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-20260918/"
    },
    {
     "source_name": "SentinelLabs",
     "url": "https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/",
     "description": "Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-18",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Cryptocurrency"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--b4e71c1e-9c90-5ae0-9b58-182232b8dfbc",
   "created": "2026-11-10T16:32:07.714Z",
   "modified": "2026-11-10T16:32:07.714Z",
   "relationship_type": "related-to",
   "source_ref": "incident--167ea1de-40ba-55d9-81b2-cbf681891ff2",
   "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--f7ec5c4f-7c84-552d-9249-9fd7f5a9263c",
   "created": "2026-11-09T04:30:08.704Z",
   "modified": "2026-11-09T04:30:08.704Z",
   "name": "WageMole",
   "aliases": [
    "Contagious Interview",
    "DEV#POPPER",
    "DeceptiveDevelopment",
    "Famous Chollima",
    "Gwisin Gang",
    "Nickel Tapestry",
    "PurpleBravo",
    "Storm-1877",
    "TAG-121",
    "Tenacious Pungsan",
    "UNC5267",
    "Void Dokkaebi",
    "Wagemole",
    "WaterPlum"
   ],
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "G1052",
     "url": "https://attack.mitre.org/groups/G1052/"
    },
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/wagemole/"
    }
   ],
   "description": "WageMole is a North Korean state-sponsored APT that employs social engineering and technology to secure remote job opportunities in Western countries, leveraging stolen personal data from the Contagious Interview campaign. Threat actors create fake identities, including passports and driver's licenses, and prepare study guides for interviews, often utilizing generative AI for well-structured responses. They target small to mid-sized businesses and utilize job platforms like Upwork and Indeed, while employing automation scripts for account creation. WageMole's activities include sharing code within their group and requesting payments through platforms like PayPal to conceal their identity."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--dc23a4b9-3aa3-52ec-a3a8-c6407a7f72db",
   "created": "2026-11-10T16:32:07.714Z",
   "modified": "2026-11-10T16:32:07.714Z",
   "relationship_type": "related-to",
   "source_ref": "incident--167ea1de-40ba-55d9-81b2-cbf681891ff2",
   "target_ref": "intrusion-set--f7ec5c4f-7c84-552d-9249-9fd7f5a9263c",
   "description": "actor named in the coverage (the sources' attribution)"
  }
 ]
}