{ "type": "bundle", "id": "bundle--6e7f1721-3b3b-45f4-bfb5-8ca4fab94dd9", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "SecurityStudies.info", "identity_class": "organization", "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--a967416f-84ac-5091-9236-eec7739030c4", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-13T06:07:08.404Z", "name": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack", "description": "Detected automatically from 8 articles in 7 outlets (Bangkok Post, Channel News Asia, Malay Mail, Matichon, South China Morning Post, The Straits Times and others), Oct 30 to Nov 10, 2026. Type: data breach; sectors: transportation, technology. Asia-Pacific countries affected: Thailand, Japan, Singapore, Hong Kong, Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "data_breach", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/cathay-pacific-says-data-from-53000-bookings-compromised-in-amadeus-cy-20261030/" }, { "source_name": "South China Morning Post", "url": "https://www.scmp.com/news/hong-kong/transport/article/3372722/cathay-pacific-says-data-53000-bookings-compromised-amadeus-cyberattack", "description": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack" }, { "source_name": "Malay Mail", "url": "https://www.malaymail.com/news/malaysia/2026/11/01/malaysia-airlines-warns-customers-of-data-exposure-in-amadeus-cybersecurity-breach/241516", "description": "Malaysia Airlines warns customers of data exposure in Amadeus cybersecurity breach" }, { "source_name": "The Straits Times", "url": "https://www.straitstimes.com/singapore/46000-sia-booking-records-accessed-illegally-in-data-breach-affecting-software-provider-amadeus", "description": "46,000 SIA booking records accessed illegally in data breach affecting software provider Amadeus" }, { "source_name": "Channel News Asia", "url": "https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151", "description": "About 46,000 SIA booking records accessed in data breach involving travel tech company Amadeus" }, { "source_name": "Matichon", "url": "https://www.matichon.co.th/economy/news_5969157", "description": "การบินไทย รับถูกแฮก ข้อมูลรั่ว 6 หมื่นรายการ แต่ไม่กระทบข้อมูลบัตรเครดิต" }, { "source_name": "Bangkok Post", "url": "https://www.bangkokpost.com/thailand/general/3352180/60000-thai-bookings-compromised-in-amadeus-breach", "description": "THAI passenger data compromised in Amadeus security breach" }, { "source_name": "The Thaiger", "url": "https://thethaiger.com/news/world/aviation/thai-airways-confirms-passenger-data-leak-but-credit-card-details-safe", "description": "Thai Airways confirms passenger data leak but credit card details safe" }, { "source_name": "Matichon", "url": "https://www.matichon.co.th/economy/news_5969937", "description": "การบินไทย แจ้ง ไซเบอร์โจมตี ข้อมูล 6 หมื่นรายการรั่วไหล ไชยชนก ถก ‘แอปเปิ้ล’ สกัด" } ], "x_securitystudies_occurred_on": "2026-10-30", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Transportation", "Technology" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Hong Kong", "country": "HK" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--d8dcd32a-245a-5e4c-b9bc-e5e43b9093eb", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Japan", "country": "JP" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--317010bf-0058-51a9-b822-d6d704efbe31", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--15974012-cc36-5adc-accd-f3f0770e8d4f", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Malaysia", "country": "MY" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--a3ed75f2-2699-5840-b35c-27be8a40c0cc", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Singapore", "country": "SG" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--dc48e5ec-d80c-5cbd-bea5-0fd84c8f8607", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Thailand", "country": "TH" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--6dac9bd3-fa51-5640-8e1c-99147e4a1ad5", "created": "2026-11-10T16:32:08.491Z", "modified": "2026-11-10T16:32:08.491Z", "relationship_type": "related-to", "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4", "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--78ef27eb-60bc-5670-94c2-70937008dde2", "created": "2026-11-10T16:32:08.267Z", "modified": "2026-11-11T20:40:49.496Z", "name": "Unauthorized access: 'Possibility that the stage has shifted to targeting financial institutions'", "description": "Detected automatically from 1 article in 1 outlet (NHK), Oct 21, 2026. Title machine-translated from Japanese. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: Japan. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "espionage", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/incident-20261021/" }, { "source_name": "NHK", "url": "https://news.web.nhk/newsweb/na/nd-20261021de62921", "description": "不正アクセス“金融機関が狙われる段階に変わってきた可能性”" } ], "x_securitystudies_occurred_on": "2026-10-21", "x_securitystudies_severity": 4, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--15167757-32a5-5dae-ac45-cb8bfc38855a", "created": "2026-11-10T16:32:08.267Z", "modified": "2026-11-10T16:32:08.267Z", "relationship_type": "related-to", "source_ref": "incident--78ef27eb-60bc-5670-94c2-70937008dde2", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--cb26a1f1-78b3-5e40-967a-728e6f29231c", "created": "2026-11-10T16:32:07.937Z", "modified": "2026-11-10T16:40:20.349Z", "name": "South Korea’s Lee says AI appears to have been used in bank hacks", "description": "Detected automatically from 1 article in 1 outlet (The Japan Times), Oct 6, 2026. Type: intrusion; sectors: financial services. Asia-Pacific countries affected: Japan. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.", "confidence": 15, "labels": [ "intrusion", "detected-unreviewed" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/south-koreas-lee-says-ai-appears-to-have-been-used-in-bank-hacks-20261006-2/" }, { "source_name": "The Japan Times", "url": "https://www.japantimes.co.jp/business/2026/10/06/south-korea-bank-hacks/", "description": "South Korea’s Lee says AI appears to have been used in bank hacks" } ], "x_securitystudies_occurred_on": "2026-10-06", "x_securitystudies_severity": 3, "x_securitystudies_status": "detected-unreviewed", "x_securitystudies_sectors": [ "Financial Services" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--bba5181e-a265-5339-b72f-a50a8cb172b5", "created": "2026-11-10T16:32:07.937Z", "modified": "2026-11-10T16:32:07.937Z", "relationship_type": "related-to", "source_ref": "incident--cb26a1f1-78b3-5e40-967a-728e6f29231c", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-10T16:26:37.587Z", "name": "GitLab maximum-severity path traversal exploited within hours of disclosure", "description": "CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal in the GitLab repository commits API, came under in-the-wild probing from 06:00 UTC on 11 September 2026 according to watchTowr, the same day CISA added it to the KEV catalog. Exploitation requires only that a single public project exists and allows arbitrary file reads of logs, configuration files, credentials and secrets. Successful exploitation creates a direct path to source code theft and CI/CD pipeline compromise. Patches are available in 19.3.2, 19.2.6 and 19.1.8, with a 14 September federal remediation deadline.", "confidence": 50, "labels": [ "supply_chain", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/gitlab-maximum-severity-path-traversal-exploited-within-hours-of-disclosure/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/gitlab-urges-users-to-patch-max-severity-path-traversal-flaw/" }, { "source_name": "source", "url": "https://www.cisa.gov/news-events/alerts/2026/09/11/cisa-adds-one-known-exploited-vulnerability-catalog" } ], "x_securitystudies_occurred_on": "2026-09-11", "x_securitystudies_severity": 5, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Technology and Software Supply Chain", "Financial Services", "Government" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "United States", "country": "US" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--fc3a7591-bd53-50ae-8a72-e41de1afbd37", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--41ac0fa7-2d80-5bda-afc1-65273a433364", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "United Kingdom", "country": "GB" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2659c6c3-953e-58b2-9aa3-3265700a2b97", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--41ac0fa7-2d80-5bda-afc1-65273a433364", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Germany", "country": "DE" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--689583b4-610b-5c43-be4e-fd6b7195d101", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--a7ac4e90-1e57-5eb8-ab78-8e93cbae1ba1", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--095279bc-69f1-5155-a576-8cfad052b57e", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "India", "country": "IN" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--1e5d137b-c900-551e-a96d-d91718577e9d", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--43d29671-3132-541c-b643-0985fe12aebb", "created": "2026-11-08T21:16:16.717Z", "modified": "2026-11-08T21:16:16.717Z", "relationship_type": "related-to", "source_ref": "incident--df93c624-4dac-5413-a1f3-71ded88e6b63", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31", "created": "2026-11-08T21:16:16.722Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Dutch NCSC warns critical Check Point VPN flaws face imminent exploitation", "description": "The Dutch National Cyber Security Centre issued a warning that exploitation of CVE-2026-85102 and CVE-2026-85103 in Check Point VPN Security Gateway and Security Management Servers is imminent, assessing both likelihood and impact as high. CVE-2026-85102 is an improper certificate validation flaw during VPN negotiation enabling arbitrary code execution, while CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder permitting remote code execution; both are rated 9.8. Affected versions include R81.20, R82, R82.10, R81.10.x and R82.00.x plus end-of-support R80 through R81.10, with R82.20 unaffected. No public exploit code existed at time of reporting and neither CVE appears in the CISA KEV catalog as of version 2026.09.11. Patches shipped 9 September 2026.", "confidence": 50, "labels": [ "other", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/dutch-ncsc-warns-critical-check-point-vpn-flaws-face-imminent-exploitation/" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/check-point-discloses-two-98-rated-vpn.html" } ], "x_securitystudies_occurred_on": "2026-09-09", "x_securitystudies_severity": 4, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Government", "Financial Services", "Critical Infrastructure", "Manufacturing" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--fe267809-b98d-54a3-9e8a-636c61dfcb03", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Netherlands", "country": "NL" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--56561444-f2fa-5f98-a150-4192444a07ac", "created": "2026-11-08T21:16:16.722Z", "modified": "2026-11-08T21:16:16.722Z", "relationship_type": "related-to", "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31", "target_ref": "location--fe267809-b98d-54a3-9e8a-636c61dfcb03", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--5bde517c-7bdd-5a8b-9e12-4357c671ee3f", "created": "2026-11-08T21:16:16.722Z", "modified": "2026-11-08T21:16:16.722Z", "relationship_type": "related-to", "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--c8f1404a-837d-5b97-b4ef-9facfcc40be8", "created": "2026-11-08T21:16:16.722Z", "modified": "2026-11-08T21:16:16.722Z", "relationship_type": "related-to", "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31", "target_ref": "location--41ac0fa7-2d80-5bda-afc1-65273a433364", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--1620e02b-0832-534f-b54b-9b94c8547bc6", "created": "2026-11-08T21:16:16.722Z", "modified": "2026-11-08T21:16:16.722Z", "relationship_type": "related-to", "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--afcd4fe1-ec8e-5dad-b123-13144bc09f07", "created": "2026-11-08T21:16:16.722Z", "modified": "2026-11-08T21:16:16.722Z", "relationship_type": "related-to", "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Australia", "country": "AU" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--e458f5b5-c8f5-52a2-87ac-d3b80558d13c", "created": "2026-11-08T21:16:16.722Z", "modified": "2026-11-08T21:16:16.722Z", "relationship_type": "related-to", "source_ref": "incident--6d6d10d1-508f-5d26-829f-159c5a2f5a31", "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627", "created": "2026-11-08T21:16:16.709Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Unpatched StyleSmuggler Zero-Day Exploited Across Magento and Adobe Commerce Stores", "description": "Dutch security firm Sansec disclosed active exploitation, beginning 4 September 2026, of an unpatched flaw affecting Magento Open Source 2.4.6 through 2.4.9 and Adobe Commerce. Attackers plant PHP code into files Magento writes, such as failure reports, and execution is triggered automatically when the platform renders its routine Payment Transaction Failed Reminder email, requiring no user interaction. The resulting backdoor runs as a process disguised as the Linux kernel thread [kworker/u:8:0], installs binaries in the user home directory rather than the web root, and re-adds cron entries every five minutes. No CVE, patch or official workaround existed as of 6 September 2026, with the next scheduled Adobe security release set for 8 September.", "confidence": 50, "labels": [ "other", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/unpatched-stylesmuggler-zero-day-exploited-across-magento-and-adobe-commerce-stores/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html" } ], "x_securitystudies_occurred_on": "2026-09-04", "x_securitystudies_severity": 5, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Retail & E-commerce", "Technology" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--0e406bb3-0a39-5075-8f96-d9cd6e06de90", "created": "2026-11-08T21:16:16.709Z", "modified": "2026-11-08T21:16:16.709Z", "relationship_type": "related-to", "source_ref": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627", "target_ref": "location--fe267809-b98d-54a3-9e8a-636c61dfcb03", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--d0c66848-781e-57bb-9bb1-d2a4a77b0773", "created": "2026-11-08T21:16:16.709Z", "modified": "2026-11-08T21:16:16.709Z", "relationship_type": "related-to", "source_ref": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--3a268a25-e664-5085-8aa6-967531515923", "created": "2026-11-08T21:16:16.709Z", "modified": "2026-11-08T21:16:16.709Z", "relationship_type": "related-to", "source_ref": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--f51a42fc-c1bc-5f11-a014-b06620be9890", "created": "2026-11-08T21:16:16.709Z", "modified": "2026-11-08T21:16:16.709Z", "relationship_type": "related-to", "source_ref": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627", "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--d715dae8-45d7-58c8-9d8b-8b8fc6ebfdcc", "created": "2026-11-08T21:16:16.709Z", "modified": "2026-11-08T21:16:16.709Z", "relationship_type": "related-to", "source_ref": "incident--b85881eb-f31c-5ccc-a02d-32f30974e627", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Google Patches Sixth Actively Exploited Chrome Zero-Day of 2026", "description": "Google released an emergency Chrome update addressing CVE-2026-85046, a CVSS 8.8 type confusion vulnerability in the V8 JavaScript and WebAssembly engine that enables arbitrary code execution within the renderer sandbox via a crafted HTML page. The flaw was under active exploitation prior to patching and is the sixth exploited Chrome zero-day of 2026. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 September 2026, requiring Federal Civilian Executive Branch agencies to remediate by 18 September 2026. The fix ships in Chrome 152.0.7977.82.", "confidence": 50, "labels": [ "other", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/google-patches-sixth-actively-exploited-chrome-zero-day-of-2026/" }, { "source_name": "source", "url": "https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/" }, { "source_name": "source", "url": "https://securityaffairs.com/198405/security/google-fixes-the-sixth-actively-exploited-chrome-zero-day-of-2026.html" } ], "x_securitystudies_occurred_on": "2026-09-04", "x_securitystudies_severity": 4, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Government", "Technology", "Financial Services", "Healthcare" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--7f4ae124-6b26-520d-8306-f3df41bdc29a", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-08T21:16:16.711Z", "relationship_type": "related-to", "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--61f8abc6-b0fd-5c03-ac7f-45ee19b1d8a6", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-08T21:16:16.711Z", "relationship_type": "related-to", "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "South Korea", "country": "KR" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--0f08bb4e-8dc7-5fda-8c39-751c887e6e04", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-08T21:16:16.711Z", "relationship_type": "related-to", "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--343d1641-2005-55b4-a2ff-02e0f31e83a4", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-08T21:16:16.711Z", "relationship_type": "related-to", "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8d466d58-e466-5116-9c0d-9743d902f512", "created": "2026-11-08T21:16:16.711Z", "modified": "2026-11-08T21:16:16.711Z", "relationship_type": "related-to", "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44", "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7", "created": "2026-11-08T21:16:16.706Z", "modified": "2026-11-10T16:26:37.587Z", "name": "SonicWall SMA 1000 Zero-Day Chain Exploited for Remote Code Execution", "description": "SonicWall disclosed that threat actors are chaining two previously unknown vulnerabilities in SMA 1000 remote-access appliances. CVE-2026-83548, a CVSS 10.0 pre-authentication server-side request forgery in the WorkPlace interface, is used to reach internal functionality, and CVE-2026-83549, a CVSS 7.8 OS command injection in the Appliance Management Console, converts that access into arbitrary command execution. CISA added both to the Known Exploited Vulnerabilities catalogue on 2 September 2026 with a remediation deadline of 5 September. Compromise of these appliances yields authenticated network position behind perimeter controls.", "confidence": 50, "labels": [ "other", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/sonicwall-sma-1000-zero-day-chain-exploited-for-remote-code-execution/" }, { "source_name": "source", "url": "https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-actively-exploited-sma1000-zero-day-flaws/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html" } ], "x_securitystudies_occurred_on": "2026-09-02", "x_securitystudies_severity": 5, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Government", "Technology", "Financial Services" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--93a4b897-9098-5258-8f78-c11ca62c9c2d", "created": "2026-11-08T21:16:16.706Z", "modified": "2026-11-08T21:16:16.706Z", "relationship_type": "related-to", "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--7c1fb9eb-6517-5d3f-a593-dbe41586b7ec", "created": "2026-11-08T21:16:16.706Z", "modified": "2026-11-08T21:16:16.706Z", "relationship_type": "related-to", "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7", "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--1e87d0f6-5cc6-563d-884f-7c283893a9e7", "created": "2026-11-08T21:16:16.706Z", "modified": "2026-11-08T21:16:16.706Z", "relationship_type": "related-to", "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--75c8ae31-9b94-5ba7-a159-38dd7168e3f1", "created": "2026-11-08T21:16:16.706Z", "modified": "2026-11-08T21:16:16.706Z", "relationship_type": "related-to", "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--70de3750-edaf-5bef-8617-848f92724d94", "created": "2026-11-08T21:16:16.706Z", "modified": "2026-11-08T21:16:16.706Z", "relationship_type": "related-to", "source_ref": "incident--77b198ef-5ab0-5a24-b4fb-c6ca80d2ebc7", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-10T16:26:37.587Z", "name": "JFrog Artifactory flaws chained to administrator access and Rust backdoor deployment", "description": "Wiz disclosed coordinated exploitation of CVE-2026-42018, which returns an internal anonymous-user token to an unauthenticated caller, chained with CVE-2026-42016 to escalate that token to administrator scope, taking attackers from first request to new admin account in under five minutes. Separately CVE-2026-82329, a CVSS 9.8 authentication bypass, was exploited between 1 and 8 September with approximately 406,000 attempts detected on 2 September alone. Post-compromise activity included persistent admin account creation, malicious Groovy plugin installation, custom Rust backdoor deployment and extraction of cluster join keys for lateral movement. Cloud instances were unaffected; CISA KEV-listed CVE-2026-42016 and CVE-2026-42018 on 11 September and CVE-2026-82329 on 2 September.", "confidence": 50, "labels": [ "supply_chain", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/jfrog-artifactory-flaws-chained-to-administrator-access-and-rust-backdoor-deployment/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/artifactory-flaws-chained-in-attacks-deploying-backdoor-malware/" }, { "source_name": "source", "url": "https://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog" } ], "x_securitystudies_occurred_on": "2026-09-01", "x_securitystudies_severity": 5, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Technology and Software Supply Chain", "Financial Services", "Telecommunications" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--cfec3d19-bfa2-575a-803c-48d5a663cd46", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-08T21:16:16.718Z", "relationship_type": "related-to", "source_ref": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--623d501b-23aa-52d8-a2d8-074c27fb5234", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-08T21:16:16.718Z", "relationship_type": "related-to", "source_ref": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--280a4642-e073-52ad-bf40-8aec67acd6a6", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Israel", "country": "IL" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--e6aba39b-8a85-516e-aec0-d40f54fe57cf", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-08T21:16:16.718Z", "relationship_type": "related-to", "source_ref": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "target_ref": "location--280a4642-e073-52ad-bf40-8aec67acd6a6", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--259590b5-9f37-55c7-b69b-83fb922fc57b", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-08T21:16:16.718Z", "relationship_type": "related-to", "source_ref": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8015834a-a6cd-53fd-804b-fde3f523a5d9", "created": "2026-11-08T21:16:16.718Z", "modified": "2026-11-08T21:16:16.718Z", "relationship_type": "related-to", "source_ref": "incident--82d67df5-545f-59b5-bdad-47706b5845aa", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--ed609681-141a-5889-9879-62a039024462", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Anthropic disrupts APT29-linked GTG-20006 AI-assisted malware rebuild operation", "description": "Anthropic disclosed in September 2026 that it had disrupted GTG-20006, a cluster attributed to Midnight Blizzard/APT29/Cozy Bear, which had constructed an AI-driven process to monitor its malware against security products and automatically rebuild and redeploy any toolkit that was detected. The group additionally used the model to register domains, establish hosting and manage command-and-control channels. Operations ran July to September 2026 against more than 20 organisations across Ukraine, Europe, the Middle East and Asia, targeting military intelligence, diplomatic and defence bodies and individuals connected to US foreign policy. The malware set included PowerChrome, WUEngine, Shadow C2, MiniPlasma and CloudSyncSvc on Windows plus GiftDrop for Android and DarkSword for iOS, overlapping with the CaptiveCrunch campaign.", "confidence": 50, "labels": [ "espionage", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/anthropic-disrupts-apt29-linked-gtg-20006-ai-assisted-malware-rebuild-operation/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.html" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/hackers-abused-claude-to-extract-secrets-from-18m-android-apps/" } ], "x_securitystudies_occurred_on": "2026-07-01", "x_securitystudies_severity": 4, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Government", "Military Intelligence", "Diplomatic Missions", "Defense" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--ea0d7db0-76af-585f-abba-be0eedbdb5b0", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Ukraine", "country": "UA" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--7de38b3e-b581-521a-954a-cf97402f8960", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-08T21:16:16.721Z", "relationship_type": "related-to", "source_ref": "incident--ed609681-141a-5889-9879-62a039024462", "target_ref": "location--ea0d7db0-76af-585f-abba-be0eedbdb5b0", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--503459b5-8a45-54e9-a768-8ce4d09c7ddd", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Poland", "country": "PL" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--c947ebb1-ccbe-5435-a3aa-5746a0519b4f", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-08T21:16:16.721Z", "relationship_type": "related-to", "source_ref": "incident--ed609681-141a-5889-9879-62a039024462", "target_ref": "location--503459b5-8a45-54e9-a768-8ce4d09c7ddd", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--9b050480-c68d-567b-a270-2f566474c7fa", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-08T21:16:16.721Z", "relationship_type": "related-to", "source_ref": "incident--ed609681-141a-5889-9879-62a039024462", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--43dcc2a4-ccbb-5e52-8de5-7a787e33f88a", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-08T21:16:16.721Z", "relationship_type": "related-to", "source_ref": "incident--ed609681-141a-5889-9879-62a039024462", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--6e2ba8b8-c6b1-5a12-b78e-aba7b2e53d7a", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-08T21:16:16.721Z", "relationship_type": "related-to", "source_ref": "incident--ed609681-141a-5889-9879-62a039024462", "target_ref": "location--280a4642-e073-52ad-bf40-8aec67acd6a6", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--25dc3af8-c83d-55aa-b685-bccd9b2b64ba", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-08T21:16:16.721Z", "relationship_type": "related-to", "source_ref": "incident--ed609681-141a-5889-9879-62a039024462", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "intrusion-set", "id": "intrusion-set--6fb07810-96dd-5ad6-a80a-1306e77f020a", "created": "2026-11-09T04:30:08.727Z", "modified": "2026-11-09T04:30:08.727Z", "name": "APT29", "aliases": [ "ATK7", "Blue Kitsune", "BlueBravo", "COZY BEAR", "Cloaked Ursa", "Cozy Bear", "CozyDuke", "Dark Halo", "G0016", "Grizzly Steppe", "Group 100", "ICE RELIC", "ICECAP", "IRON HEMLOCK", "IRON RITUAL", "ITG11", "Midnight Blizzard", "Minidionis", "NOBELIUM", "Nobelium", "NobleBaron", "SeaDuke", "SolarStorm", "TA421", "The Dukes", "UAC-0029", "UNC2452", "UNC3524", "YTTRIUM" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "G0016", "url": "https://attack.mitre.org/groups/G0016/" }, { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/actors/apt29/" } ], "description": "A 2015 report by F-Secure describe APT29 as: 'The Dukes are a well-resourced, highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making. The Dukes show unusual confidence in their ability to continue successfully compromising their targets, as well as in their ability to operate with impunity. The Dukes primarily target Western governments and related organizations, such as government ministries and agencies, political think tanks, and governmental subcontractors. Their targets have also included the governments of members of the Commonwealth of Independent States;Asian, African, and Middle Eastern governments;organizations associated with Chechen extremism;and Russian speakers engaged in the illicit trade of controlled substances and drugs. The Dukes are known to employ a vast arsenal of malware toolsets, which we identify as MiniDuke, CosmicDuke, OnionDuke, CozyDuke, CloudDuke, SeaDuke, HammerDuke, PinchDuke, and GeminiDuke. In recent years, the Dukes have engaged in apparently biannual large - scale spear - phishing campaigns against hundreds or even thousands of recipients associated with governmental institutions and affiliated organizations. These campaigns utilize a smash - and - grab approach involving a fast but noisy breakin followed by the rapid collection and exfiltration of as much data as possible.If the compromised target is discovered to be of value, the Dukes will quickly switch the toolset used and move to using stealthier tactics focused on persistent compromise and long - term intelligence gathering. This threat actor targets government ministries and agencies in the West, Central Asia, East Africa, and the Middle East; Chechen extremist groups; Russian organized crime; and think tanks. It is suspected to be behind the 2015 compromise of unclassified networks at the White House, Department of " }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--87f07adf-f81e-5fba-beac-50013a92727a", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-08T21:16:16.721Z", "relationship_type": "related-to", "source_ref": "incident--ed609681-141a-5889-9879-62a039024462", "target_ref": "intrusion-set--6fb07810-96dd-5ad6-a80a-1306e77f020a", "description": "attribution" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--4da37fa4-4d5d-55ac-a9b1-1036b696dc20", "created": "2026-11-08T21:16:16.694Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Lazarus Group Cryptocurrency Exchange Heist — Singapore", "description": "Lazarus Group (DPRK) executed a sophisticated supply-chain compromise of a cryptocurrency custodial platform based in Singapore, stealing approximately USD 230 million in mixed crypto assets. The attack chain involved compromising a third-party trading SDK used by the exchange, injecting malicious transaction-signing code. FBI and MAS (Monetary Authority of Singapore) issued joint alert. Funds traced through Tornado Cash and cross-chain bridges to DPRK-linked wallets.", "confidence": 50, "labels": [ "apt", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/lazarus-group-cryptocurrency-exchange-heist-singapore/" }, { "source_name": "source", "url": { "title": "FBI Flash Alert", "url": "https://www.ic3.gov/" } }, { "source_name": "source", "url": { "title": "Chainalysis Reactor Analysis", "url": "https://www.chainalysis.com/blog/" } } ], "x_securitystudies_occurred_on": "2026-04-28", "x_securitystudies_severity": 5, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Financial Services", "Cryptocurrency" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--2fd59763-3328-5087-963a-aa90f344c88e", "created": "2026-11-08T21:16:16.694Z", "modified": "2026-11-08T21:16:16.694Z", "relationship_type": "related-to", "source_ref": "incident--4da37fa4-4d5d-55ac-a9b1-1036b696dc20", "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--65796606-a29d-51c5-ac34-bad363d7e87b", "created": "2026-11-08T21:16:16.694Z", "modified": "2026-11-08T21:16:16.694Z", "relationship_type": "related-to", "source_ref": "incident--4da37fa4-4d5d-55ac-a9b1-1036b696dc20", "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--fe350086-6cca-53b9-a30e-170b29fe9046", "created": "2026-11-08T21:16:16.694Z", "modified": "2026-11-08T21:16:16.694Z", "relationship_type": "related-to", "source_ref": "incident--4da37fa4-4d5d-55ac-a9b1-1036b696dc20", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "intrusion-set", "id": "intrusion-set--1c81c67d-4875-5b86-9083-46b743ee21c5", "created": "2026-11-09T04:30:08.761Z", "modified": "2026-11-09T04:30:08.761Z", "name": "Lazarus Group", "aliases": [ "APT 38", "APT-C-26", "APT38", "ATK117", "ATK3", "Andariel", "AppleJeus", "Appleworm", "BeagleBoyz", "Black Artemis", "Bluenoroff", "Bureau 121", "COPERNICIUM", "COVELLITE", "Citrine Sleet", "DEV-0139", "DEV-1222", "Dark Seoul", "Diamond Sleet", "G0032", "G0082", "Gleaming Pisces", "Group 77", "Guardians of Peace", "HIDDEN COBRA", "Hastati Group", "Hidden Cobra", "Labyrinth Chollima", "Lazarus group", "Moonstone Sleet", "NICKEL ACADEMY", "NICKEL GLADSTONE", "NewRomanic Cyber Army Team", "Nickel Academy", "Onyx Sleet", "Operation AppleJeus", "Operation DarkSeoul", "Operation GhostSecret", "Operation Troy", "PLUTONIUM" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "G1036", "url": "https://attack.mitre.org/groups/G1036/" }, { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/actors/lazarus-group/" } ], "description": "Since 2009, HIDDEN COBRA actors have leveraged their capabilities to target and compromise a range of victims; some intrusions have resulted in the exfiltration of data while others have been disruptive in nature. Commercial reporting has referred to this activity as Lazarus Group and Guardians of Peace. Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware. Variants of malware and tools used by HIDDEN COBRA actors include Destover, Duuzer, and Hangman." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--428febc3-e79d-5bc3-8cb6-e88f3d375dbd", "created": "2026-11-08T21:16:16.694Z", "modified": "2026-11-08T21:16:16.694Z", "relationship_type": "related-to", "source_ref": "incident--4da37fa4-4d5d-55ac-a9b1-1036b696dc20", "target_ref": "intrusion-set--1c81c67d-4875-5b86-9083-46b743ee21c5", "description": "attribution" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209", "created": "2026-11-08T21:16:16.690Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Salt Typhoon Telecom Espionage Campaign — Ongoing", "description": "Chinese state-sponsored group Salt Typhoon (also tracked as GhostEmperor/FamousSparrow) continues to maintain persistent access to major US, Southeast Asian, and Australian telecommunications networks. The campaign, first publicly disclosed in late 2024, has been confirmed to compromise call detail records and lawful intercept systems across at least 9 major carriers. As of May 2026, incident response is ongoing at several ASEAN-region telecoms. CISA has issued updated advisories recommending encrypted communications for government officials.", "confidence": 50, "labels": [ "espionage", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/salt-typhoon-telecom-espionage-campaign-ongoing/" }, { "source_name": "source", "url": { "title": "CISA Advisory AA24-340A", "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-340a" } }, { "source_name": "source", "url": { "title": "Microsoft Threat Intelligence", "url": "https://www.microsoft.com/en-us/security/blog/" } } ], "x_securitystudies_occurred_on": "2024-09-15", "x_securitystudies_severity": 5, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Telecommunications", "Government", "Defense" ], "x_securitystudies_eu_relevance": "medium" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--435d00ae-93cc-5b82-973d-553a2ad2316c", "created": "2026-11-08T21:16:16.690Z", "modified": "2026-11-08T21:16:16.690Z", "relationship_type": "related-to", "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Philippines", "country": "PH" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8108d9cb-277e-53fe-b5e8-3795c21eb8aa", "created": "2026-11-08T21:16:16.690Z", "modified": "2026-11-08T21:16:16.690Z", "relationship_type": "related-to", "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209", "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--9072f4ee-c5de-5753-a3e6-9be0f67cbc1b", "created": "2026-11-08T21:16:16.690Z", "modified": "2026-11-08T21:16:16.690Z", "relationship_type": "related-to", "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209", "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--d963c41d-ea95-5987-a1e4-a461feb2cbdc", "created": "2026-11-08T21:16:16.690Z", "modified": "2026-11-08T21:16:16.690Z", "relationship_type": "related-to", "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209", "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Indonesia", "country": "ID" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--26c5417c-4add-561a-9231-6a9797918e9d", "created": "2026-11-08T21:16:16.690Z", "modified": "2026-11-08T21:16:16.690Z", "relationship_type": "related-to", "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209", "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Taiwan", "country": "TW" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--8be3764b-86b0-5fde-af53-2f87940a6fa2", "created": "2026-11-08T21:16:16.690Z", "modified": "2026-11-08T21:16:16.690Z", "relationship_type": "related-to", "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209", "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--642c612d-bcf7-5030-bd96-c51cad00d04e", "created": "2026-11-08T21:16:16.690Z", "modified": "2026-11-08T21:16:16.690Z", "relationship_type": "related-to", "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "intrusion-set", "id": "intrusion-set--994a786f-903b-5827-8b99-fb2bcf62d3db", "created": "2026-11-09T04:30:08.681Z", "modified": "2026-11-09T04:30:08.681Z", "name": "GhostEmperor", "aliases": [ "FamousSparrow", "OPERATOR PANDA", "RedMike", "Salt Typhoon", "UNC2286" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "G1045", "url": "https://attack.mitre.org/groups/G1045/" }, { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/actors/ghostemperor/" } ], "description": "GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--344356d8-39e3-5c5b-b48f-9b5cf793a03a", "created": "2026-11-08T21:16:16.690Z", "modified": "2026-11-08T21:16:16.690Z", "relationship_type": "related-to", "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209", "target_ref": "intrusion-set--994a786f-903b-5827-8b99-fb2bcf62d3db", "description": "attribution" } ] }