{
 "type": "bundle",
 "id": "bundle--13c7bf18-4ce6-4b47-9db5-feed3cf2ce19",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--1bc09e60-d48b-59ff-9227-e5d911f09a5f",
   "created": "2026-11-11T20:35:29.928Z",
   "modified": "2026-11-13T00:02:47.695Z",
   "name": "SonicWall SSL-VPN authentication bypass vulnerability exploited in actual attacks, multi-factor authentication also neutralized",
   "description": "Detected automatically from 1 article in 1 outlet (Dailysecu (Korean)), Nov 9, 2026. Title machine-translated from Korean. Type: exploitation. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "exploitation",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/sonicwall-ssl-vpn-authentication-bypass-vulnerability-exploited-in-act-20261109/"
    },
    {
     "source_name": "Dailysecu (Korean)",
     "url": "https://www.dailysecu.com/news/articleView.html?idxno=209394",
     "description": "소닉월 SSL-VPN 인증 우회 취약점 실제 공격에 악용, 다중인증도 무력화"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-09",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "South Korea",
   "country": "KR"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--fe97fcb5-287d-56c6-a798-914b08267c23",
   "created": "2026-11-11T20:35:29.928Z",
   "modified": "2026-11-11T20:35:29.928Z",
   "relationship_type": "related-to",
   "source_ref": "incident--1bc09e60-d48b-59ff-9227-e5d911f09a5f",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "vulnerability",
   "id": "vulnerability--502a9f8f-a5b4-5afc-abed-dfd1c77c5cd6",
   "created": "2026-11-13T05:15:33.953Z",
   "modified": "2026-11-13T05:15:33.953Z",
   "name": "CVE-2026-19868",
   "external_references": [
    {
     "source_name": "cve",
     "external_id": "CVE-2026-19868"
    }
   ],
   "description": "SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--fa591481-207c-519e-a125-a9c868ca1360",
   "created": "2026-11-11T20:35:29.928Z",
   "modified": "2026-11-11T20:35:29.928Z",
   "relationship_type": "related-to",
   "source_ref": "incident--1bc09e60-d48b-59ff-9227-e5d911f09a5f",
   "target_ref": "vulnerability--502a9f8f-a5b4-5afc-abed-dfd1c77c5cd6",
   "description": "vulnerability exploited"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-13T00:02:47.646Z",
   "name": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns",
   "description": "Detected automatically from 2 articles in 2 outlets (Check Point Research, Microsoft Threat Intelligence), Nov 5 to Nov 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea, Hong Kong, Thailand, Cambodia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "espionage",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/hacking-on-autopilot-inside-artex-cybercrime-campaigns-20261105/"
    },
    {
     "source_name": "Check Point Research",
     "url": "https://research.checkpoint.com/2026/hacking-on-autopilot-inside-artex-cybercrime-campaigns/",
     "description": "Hacking on Autopilot: Inside ARTEX Cybercrime Campaigns"
    },
    {
     "source_name": "Microsoft Threat Intelligence",
     "url": "https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/",
     "description": "ARTEX abuse expands as cybercriminals target financial sector"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-05",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Hong Kong",
   "country": "HK"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--ef85cfba-0238-5680-aea1-65608ed33612",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--045a1890-e799-520f-8119-ae91e4fb69bb",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Cambodia",
   "country": "KH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--9b12a351-49f3-59e1-9cc0-9a00ca31b2c8",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--045a1890-e799-520f-8119-ae91e4fb69bb",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--2990eb21-033c-5af2-8a5b-46e23b3cb343",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Thailand",
   "country": "TH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--7985a9d6-9e8b-57bc-9e3e-2829147cbdd9",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6",
   "created": "2026-11-09T04:30:05.339Z",
   "modified": "2026-11-09T04:30:05.339Z",
   "name": "Storm-0940",
   "aliases": [
    "CovertNetwork-1658",
    "ORB07"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/storm-0940/"
    }
   ],
   "description": "Storm-0940 is a Chinese threat actor active since at least 2021, known for gaining initial access through password spray and brute-force attacks, as well as exploiting network edge applications. Microsoft has observed Storm-0940 utilizing valid credentials obtained from CovertNetwork-1658's password spray operations, indicating a close operational relationship between the two. Once inside a victim environment, Storm-0940 has been seen leveraging compromised credentials for further malicious activities. Additionally, Storm-0940 has employed botnets, such as Quad7, to facilitate password spraying attacks."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1999587e-b927-574f-9ab1-fa9a82d2d58e",
   "created": "2026-11-10T16:32:08.658Z",
   "modified": "2026-11-10T16:32:08.658Z",
   "relationship_type": "related-to",
   "source_ref": "incident--e5be2210-f7e1-562b-8dc6-5c8f93a6d26a",
   "target_ref": "intrusion-set--835a37e4-da90-5154-9b53-7211e062dfb6",
   "description": "actor named in the coverage (the sources' attribution)"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--ca649294-37b3-58a6-b905-21498e809401",
   "created": "2026-11-10T16:32:08.548Z",
   "modified": "2026-11-13T00:02:47.531Z",
   "name": "Personal information of Lee, presidential staff leaked: report",
   "description": "Detected automatically from 11 articles in 6 outlets (Hankyoreh, NHK, New Talk, South China Morning Post, The Korea Herald, Yonhap), Nov 2 to Nov 4, 2026. Type: data breach; sectors: government. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/personal-information-of-lee-presidential-staff-leaked-report-20261102/"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261102013200320",
     "description": "Personal information of Lee, presidential staff leaked: report"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261102013251320",
     "description": "(LEAD) Personal information of Lee, presidential staff leaked: report"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261103003700315",
     "description": "Presidential office holds emergency meeting over leak of personal data of president, trip entourage"
    },
    {
     "source_name": "The Korea Herald",
     "url": "https://www.koreaherald.com/article/10923757",
     "description": "Presidential office holds emergency meeting over leak of personal data of president, trip entourage"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261103003751315",
     "description": "(LEAD) Presidential office holds emergency meeting over leak of personal data of president, trip entourage"
    },
    {
     "source_name": "South China Morning Post",
     "url": "https://www.scmp.com/news/asia/east-asia/article/3373065/south-korea-rushes-reissue-passports-president-lee-wife-after-data-leak",
     "description": "South Korea rushes to reissue passports to President Lee, wife after data leak"
    },
    {
     "source_name": "New Talk",
     "url": "https://newtalk.tw/news/view/2026-11-03/1069015",
     "description": "長達逾5個月！ 李在明護照資料遭公開 韓國政府急善後..."
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261103010400315",
     "description": "Main opposition slams presidential office for leak of Lee's personal data"
    },
    {
     "source_name": "NHK",
     "url": "https://news.web.nhk/newsweb/na/nd-20261103de70007",
     "description": "韓国大統領や高官の個人情報流出 イ大統領パスポート再発行へ"
    },
    {
     "source_name": "Hankyoreh",
     "url": "https://www.hani.co.kr/arti/english_edition/e_national/1285585.html",
     "description": "Passport numbers of Lee, 167 others leaked in presidential jet data breach"
    },
    {
     "source_name": "Hankyoreh",
     "url": "https://www.hani.co.kr/arti/english_edition/e_national/1285767.html",
     "description": "Foreign Ministry employee likely behind presidential jet passenger data leak"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-02",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Government"
   ],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--6dbd0ffd-b3ab-5689-9e97-81680954e607",
   "created": "2026-11-10T16:32:08.548Z",
   "modified": "2026-11-10T16:32:08.548Z",
   "relationship_type": "related-to",
   "source_ref": "incident--ca649294-37b3-58a6-b905-21498e809401",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--1936f227-2555-556b-92d4-7f48f4860626",
   "created": "2026-11-10T16:32:08.478Z",
   "modified": "2026-11-13T00:02:47.432Z",
   "name": "Binance TH pauses crypto transfers, says Thai funds safe after hack",
   "description": "Detected automatically from 34 articles in 16 outlets (Channel News Asia, Daily NK, Free Malaysia Today, Hankyoreh, Japan Today, Liberty Times and others), Oct 30 to Nov 12, 2026. Type: cryptocurrency theft; sectors: cryptocurrency, technology. Asia-Pacific countries affected: South Korea, Thailand. Largest figure in the headlines: 200,000,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "crypto_theft",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/binance-th-pauses-crypto-transfers-says-thai-funds-safe-after-hack-20261030/"
    },
    {
     "source_name": "The Thaiger",
     "url": "https://thethaiger.com/news/business/binance-th-pauses-crypto-transfers-after-hack",
     "description": "Binance TH pauses crypto transfers, says Thai funds safe after hack"
    },
    {
     "source_name": "NK Pro",
     "url": "https://www.nknews.org/pro/north-korean-actors-steal-6-36b-from-binance-in-largest-crypto-theft-in-history/",
     "description": "North Korean actors steal $6.36B from Binance in largest crypto theft in history"
    },
    {
     "source_name": "New Talk",
     "url": "https://newtalk.tw/news/view/2026-10-30/1068375",
     "description": "金將軍又缺錢？ 幣安2千多億加密貨幣遭駭創歷來之最 北韓遭認是兇手"
    },
    {
     "source_name": "Liberty Times",
     "url": "https://ec.ltn.com.tw/article/breakingnews/5624143",
     "description": "史上最大駭客攻擊！幣安遭竊逾2000億 美分析指向北韓"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261031000200315",
     "description": "N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261031000251315",
     "description": "(LEAD) N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261031000252315",
     "description": "(2nd LD) N. Korean hackers blamed for record US$6.36 bln Binance cryptocurrency theft: U.S. firm"
    },
    {
     "source_name": "Japan Today",
     "url": "https://japantoday.com/category/world/hackers-steal-6.3-billion-from-binance-in-record-heist-blamed-on-north-korea4",
     "description": "Hackers steal $6.3 billion from Binance in record heist blamed on North Korea"
    },
    {
     "source_name": "The Korea Herald",
     "url": "https://www.koreaherald.com/article/10921226",
     "description": "N. Korean hackers blamed for record $6.3b Binance cryptocurrency theft: US firm"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261101000300315",
     "description": "FBI says N. Korea responsible for over US$6 bln crypto theft from Binance"
    },
    {
     "source_name": "The Japan Times",
     "url": "https://www.japantimes.co.jp/business/2026/11/01/tech/binance-hack-fbi-north-korea/",
     "description": "FBI blames North Korea for $6 billion Binance crypto hack"
    },
    {
     "source_name": "South China Morning Post",
     "url": "https://www.scmp.com/news/world/united-states-canada/article/3372858/fbi-blames-north-korea-stolen-billions-binance-biggest-hack-history",
     "description": "FBI blames North Korea for stolen billions from Binance in biggest hack in history"
    },
    {
     "source_name": "New Talk",
     "url": "https://newtalk.tw/news/view/2026-11-01/1068564",
     "description": "幣安逾60億美元資產遭竊　FBI指北韓所為"
    },
    {
     "source_name": "The Korea Herald",
     "url": "https://www.koreaherald.com/article/10921526",
     "description": "FBI says N. Korea responsible for over $6b crypto theft from Binance"
    },
    {
     "source_name": "NHK",
     "url": "https://news.web.nhk/newsweb/na/nd-20261101de69102",
     "description": "暗号資産大手バイナンスへのサイバー攻撃 FBI“北朝鮮が関与”"
    },
    {
     "source_name": "The Korea Herald",
     "url": "https://www.koreaherald.com/article/10921777",
     "description": "North Korean cyberterrorism gains renewed scrutiny after record Binance heist"
    },
    {
     "source_name": "Yonhap",
     "url": "https://en.yna.co.kr/view/AEN20261101000351315",
     "description": "(LEAD) Trump says U.S. will talk to N. Korea if it is behind Binance hack"
    },
    {
     "source_name": "Free Malaysia Today",
     "url": "https://www.freemalaysiatoday.com/category/business/2026/11/01/fbi-says-north-korea-behind-us-6bil-crypto-theft-from-binance",
     "description": "FBI says North Korea behind US$6bil crypto theft from Binance"
    },
    {
     "source_name": "Taipei Times",
     "url": "https://www.taipeitimes.com/News/biz/archives/2026/11/02/2003866975",
     "description": "N Korea behind US$6bn crypto theft, FBI says"
    },
    {
     "source_name": "New Talk",
     "url": "https://newtalk.tw/news/view/2026-11-02/1068750",
     "description": "20分鐘盜逾60億美元加密貨幣! 北韓駭客疑感情詐騙滲透幣安工程師 川普這樣說...."
    },
    {
     "source_name": "NK Pro",
     "url": "https://www.nknews.org/pro/fbi-confirms-north-korea-behind-record-6-36b-binance-crypto-heist/",
     "description": "FBI confirms North Korea behind record $6.36B Binance crypto heist"
    },
    {
     "source_name": "The Japan Times",
     "url": "https://www.japantimes.co.jp/business/2026/11/02/binance-outflows-north-korea-hack/",
     "description": "Binance outflows hit $4.7 billion after record North Korea hack"
    },
    {
     "source_name": "Hankyoreh",
     "url": "https://www.hani.co.kr/arti/english_edition/e_northkorea/1285383.html",
     "description": "FBI identifies North Korean hackers as responsible for unprecedented Binance breach"
    },
    {
     "source_name": "NK News",
     "url": "https://www.nknews.org/2026/11/kim-yo-jong-denies-north-korean-involvement-in-6b-binance-crypto-theft/",
     "description": "Kim Yo Jong denies North Korean involvement in $6B Binance crypto theft"
    },
    {
     "source_name": "Channel News Asia",
     "url": "https://www.channelnewsasia.com/east-asia/north-korea-binance-hack-fbi-grave-provocation-6514311",
     "description": "North Korea slams FBI allegations over Binance hack as 'grave' provocation"
    },
    {
     "source_name": "The Japan Times",
     "url": "https://www.japantimes.co.jp/news/2026/11/03/asia-pacific/north-korea-binance-us-hacking/",
     "description": "North Korea calls U.S. claims it was behind Binance hack ‘a grave political provocation’"
    },
    {
     "source_name": "Free Malaysia Today",
     "url": "https://www.freemalaysiatoday.com/category/world/2026/11/03/n-korea-slams-fbi-allegations-over-binance-hack-as-grave-provocation",
     "description": "N. Korea slams FBI allegations over Binance hack as ‘grave’ provocation"
    },
    {
     "source_name": "South China Morning Post",
     "url": "https://www.scmp.com/news/world/united-states-canada/article/3373050/sister-north-koreas-kim-slams-fbis-binance-hack-allegations-grave-provocation",
     "description": "Sister of North Korea’s Kim slams FBI’s Binance hack allegations as ‘grave’ provocation"
    },
    {
     "source_name": "VN Express",
     "url": "https://vnexpress.net/trieu-tien-dap-tra-cao-buoc-tan-cong-mang-binance-tu-fbi-5139936.html",
     "description": "Triều Tiên đáp trả cáo buộc 'tấn công mạng Binance' từ FBI"
    },
    {
     "source_name": "NHK",
     "url": "https://news.web.nhk/newsweb/na/nd-20261103de69881",
     "description": "世界的な暗号資産取引所へのサイバー攻撃　北朝鮮が関与否定"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-30",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Cryptocurrency",
    "Technology"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--2dc31aa3-0df9-5ff5-8935-df97ac69a0c9",
   "created": "2026-11-10T16:32:08.478Z",
   "modified": "2026-11-10T16:32:08.478Z",
   "relationship_type": "related-to",
   "source_ref": "incident--1936f227-2555-556b-92d4-7f48f4860626",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8d42d050-12da-57fe-addc-71e86dc8ac78",
   "created": "2026-11-10T16:32:08.478Z",
   "modified": "2026-11-10T16:32:08.478Z",
   "relationship_type": "related-to",
   "source_ref": "incident--1936f227-2555-556b-92d4-7f48f4860626",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--6d1328a3-2c4d-5dbf-8ff6-4cae78790d3a",
   "created": "2026-11-09T04:30:05.217Z",
   "modified": "2026-11-09T04:30:05.217Z",
   "name": "TraderTraitor",
   "aliases": [
    "Jade Sleet",
    "Pukchong",
    "UNC4899"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/tradertraitor/"
    }
   ],
   "description": "TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, intended to gain access to these start-up and high-tech companies. TraderTraitor may be the work of operators previously responsible for APT38 activity."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--55952837-5ab0-5bcc-b705-b0d57744ac9d",
   "created": "2026-11-10T16:32:08.478Z",
   "modified": "2026-11-10T16:32:08.478Z",
   "relationship_type": "related-to",
   "source_ref": "incident--1936f227-2555-556b-92d4-7f48f4860626",
   "target_ref": "intrusion-set--6d1328a3-2c4d-5dbf-8ff6-4cae78790d3a",
   "description": "actor named in the coverage (the sources' attribution)"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--27acc24b-612d-5aeb-8722-ac242eefbaeb",
   "created": "2026-11-10T16:32:08.007Z",
   "modified": "2026-11-10T16:40:20.409Z",
   "name": "Online-only lenders KakaoBank and Kbank are latest targets of cyberattacks on Korean banks",
   "description": "Detected automatically from 1 article in 1 outlet (Hankyoreh), Oct 7, 2026. Type: espionage campaign; sectors: financial services. Asia-Pacific countries affected: South Korea. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "espionage",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/online-only-lenders-kakaobank-and-kbank-are-latest-targets-of-cyberatt-20261007/"
    },
    {
     "source_name": "Hankyoreh",
     "url": "https://www.hani.co.kr/arti/english_edition/e_business/1281364.html",
     "description": "Online-only lenders KakaoBank and Kbank are latest targets of cyberattacks on Korean banks"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-07",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--9b735b72-62fa-5c94-980b-26bd9658327a",
   "created": "2026-11-10T16:32:08.007Z",
   "modified": "2026-11-10T16:32:08.007Z",
   "relationship_type": "related-to",
   "source_ref": "incident--27acc24b-612d-5aeb-8722-ac242eefbaeb",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--91b0e4ed-1cae-581b-804b-aaed6cc8a5f8",
   "created": "2026-11-08T21:16:16.707Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "North Korean 'ted' Linux Backdoor Found Inside Trojanised HAProxy at South Korean Firms",
   "description": "Rapid7 Labs disclosed a previously undocumented Linux toolkit compiled directly into trojanised HAProxy 2.8.12 load balancers at two South Korean organisations in the automotive and media sectors. The 'ted' implant and companion 'curlRAT' were delivered by replacing legitimate binaries, including crond, sshd, agetty, atd and polkitd, rather than through vulnerability exploitation, allowing web traffic interception, encrypted SSH credential harvesting and log sanitisation. Rapid7 attributed the activity with medium confidence to North Korean state-sponsored actors, drawing on APT37 domain infrastructure, Lazarus delivery-model similarities and a Kimsuky-consistent initial access hypothesis involving a compromised groupware vendor.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/north-korean-ted-linux-backdoor-found-inside-trojanised-haproxy-at-south-korean-firms/"
    },
    {
     "source_name": "source",
     "url": "https://thehackernews.com/2026/09/new-ted-backdoor-hides-inside-victims.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-04",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Manufacturing",
    "Media",
    "Technology"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--c4eb5c6c-d312-591e-9abd-78b237948d1e",
   "created": "2026-11-08T21:16:16.707Z",
   "modified": "2026-11-08T21:16:16.707Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91b0e4ed-1cae-581b-804b-aaed6cc8a5f8",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--4e396b0b-8285-592f-aca9-1f2ac1d1b837",
   "created": "2026-11-09T04:30:08.705Z",
   "modified": "2026-11-09T04:30:08.705Z",
   "name": "APT37",
   "aliases": [
    "APT 37",
    "APT-C-28",
    "ATK4",
    "G0067",
    "Group 123",
    "Group123",
    "InkySquid",
    "Moldy Pisces",
    "Operation Daybreak",
    "Operation Erebus",
    "PLAIN NEPTUNE",
    "Reaper",
    "Reaper Group",
    "Red Eyes",
    "Ricochet Chollima",
    "ScarCruft",
    "TEMP.Reaper",
    "Venus 121"
   ],
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "G0067",
     "url": "https://attack.mitre.org/groups/G0067/"
    },
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/apt37/"
    }
   ],
   "description": "APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--02c303aa-d0a6-5130-bbee-416e070f1828",
   "created": "2026-11-08T21:16:16.707Z",
   "modified": "2026-11-08T21:16:16.707Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91b0e4ed-1cae-581b-804b-aaed6cc8a5f8",
   "target_ref": "intrusion-set--4e396b0b-8285-592f-aca9-1f2ac1d1b837",
   "description": "attribution"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44",
   "created": "2026-11-08T21:16:16.711Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Google Patches Sixth Actively Exploited Chrome Zero-Day of 2026",
   "description": "Google released an emergency Chrome update addressing CVE-2026-85046, a CVSS 8.8 type confusion vulnerability in the V8 JavaScript and WebAssembly engine that enables arbitrary code execution within the renderer sandbox via a crafted HTML page. The flaw was under active exploitation prior to patching and is the sixth exploited Chrome zero-day of 2026. CISA added it to the Known Exploited Vulnerabilities catalogue on 4 September 2026, requiring Federal Civilian Executive Branch agencies to remediate by 18 September 2026. The fix ships in Chrome 152.0.7977.82.",
   "confidence": 50,
   "labels": [
    "other",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/google-patches-sixth-actively-exploited-chrome-zero-day-of-2026/"
    },
    {
     "source_name": "source",
     "url": "https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog"
    },
    {
     "source_name": "source",
     "url": "https://thehackernews.com/2026/09/google-releases-chrome-update-to-patch.html"
    },
    {
     "source_name": "source",
     "url": "https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/"
    },
    {
     "source_name": "source",
     "url": "https://securityaffairs.com/198405/security/google-fixes-the-sixth-actively-exploited-chrome-zero-day-of-2026.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-04",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Technology",
    "Financial Services",
    "Healthcare"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "United States",
   "country": "US"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--7f4ae124-6b26-520d-8306-f3df41bdc29a",
   "created": "2026-11-08T21:16:16.711Z",
   "modified": "2026-11-08T21:16:16.711Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Japan",
   "country": "JP"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--61f8abc6-b0fd-5c03-ac7f-45ee19b1d8a6",
   "created": "2026-11-08T21:16:16.711Z",
   "modified": "2026-11-08T21:16:16.711Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--0f08bb4e-8dc7-5fda-8c39-751c887e6e04",
   "created": "2026-11-08T21:16:16.711Z",
   "modified": "2026-11-08T21:16:16.711Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Australia",
   "country": "AU"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--343d1641-2005-55b4-a2ff-02e0f31e83a4",
   "created": "2026-11-08T21:16:16.711Z",
   "modified": "2026-11-08T21:16:16.711Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--095279bc-69f1-5155-a576-8cfad052b57e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "India",
   "country": "IN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8d466d58-e466-5116-9c0d-9743d902f512",
   "created": "2026-11-08T21:16:16.711Z",
   "modified": "2026-11-08T21:16:16.711Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a33a801c-155e-55ff-a042-ba68fbef2d44",
   "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--98ed5a28-001f-5c9c-be72-67b4f6d8f172",
   "created": "2026-11-08T21:16:16.713Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "North Korea-linked backdoor found compiled inside HAProxy at two South Korean companies",
   "description": "Rapid7 Labs disclosed that DPRK-aligned operators compiled a backdoor named 'ted' directly into the victims' existing HAProxy 2.8.12 load balancers using native HAProxy filter APIs, accompanied by a tool named curlRAT and trojanised crond, agetty, atd, sshd and polkitd daemons. C2 mode was triggered by a request for a decoy image path, after which commands were passed via named pipes and the requests were erased from HAProxy logs and statistics without ever reaching the backend. Two South Korean companies in the automotive and media sectors were confirmed affected, with capabilities including credential harvesting, SSH keylogging, session cookie theft and fingerprint-matched drive-by injection. Attribution to APT37 is medium confidence, with possible Lazarus Group overlap.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/north-korea-linked-backdoor-found-compiled-inside-haproxy-at-two-south-korean-companies/"
    },
    {
     "source_name": "source",
     "url": "https://securityaffairs.com/198656/apt/north-korea-linked-hackers-hide-a-backdoor-inside-haproxy.html"
    },
    {
     "source_name": "source",
     "url": "https://www.cyfirma.com/news/weekly-intelligence-report-11-sep-2026/"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-01",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Automotive Manufacturing",
    "Media and Broadcasting"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--5f94e84a-ffce-5a57-a5e0-5a3451e7db0c",
   "created": "2026-11-08T21:16:16.713Z",
   "modified": "2026-11-08T21:16:16.713Z",
   "relationship_type": "related-to",
   "source_ref": "incident--98ed5a28-001f-5c9c-be72-67b4f6d8f172",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--e29e5553-6900-5058-871f-f3e3b779c601",
   "created": "2026-11-08T21:16:16.713Z",
   "modified": "2026-11-08T21:16:16.713Z",
   "relationship_type": "related-to",
   "source_ref": "incident--98ed5a28-001f-5c9c-be72-67b4f6d8f172",
   "target_ref": "intrusion-set--4e396b0b-8285-592f-aca9-1f2ac1d1b837",
   "description": "attribution"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--555c9614-2fc1-5b9c-9a58-8d1170ae14cd",
   "created": "2026-11-08T21:16:16.699Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "SafePay Ransomware Claims Air Liquide Korea",
   "description": "The SafePay ransomware group listed industry.airliquide.kr, the Korean industrial-gases arm of Air Liquide, on its leak site on 25 August 2026. Air Liquide Korea supplies essential gases to major South Korean industries including semiconductor manufacturing; SafePay operates a double-extortion model and had claimed over 530 victims globally by August 2026.",
   "confidence": 50,
   "labels": [
    "ransomware",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/safepay-ransomware-claims-air-liquide-korea/"
    },
    {
     "source_name": "source",
     "url": "https://www.ransomware.live/id/aW5kdXN0cnkuYWlybGlxdWlkZS5rckBzYWZlcGF5"
    }
   ],
   "x_securitystudies_occurred_on": "2026-08-25",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "manufacturing",
    "chemicals",
    "industrial gases"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--c017906f-0b88-5d27-8b94-96d5b382c1b7",
   "created": "2026-11-08T21:16:16.699Z",
   "modified": "2026-11-08T21:16:16.699Z",
   "relationship_type": "related-to",
   "source_ref": "incident--555c9614-2fc1-5b9c-9a58-8d1170ae14cd",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  }
 ]
}