{
 "type": "bundle",
 "id": "bundle--0ab5158e-47d7-4734-bd77-168123f1ea42",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--2eb074a2-3441-5531-816d-e5b4404363e0",
   "created": "2026-11-10T16:32:08.733Z",
   "modified": "2026-11-13T00:02:47.748Z",
   "name": "EC, MCMC take measures to protect website following reported cyber attack",
   "description": "Detected automatically from 2 articles in 2 outlets (Free Malaysia Today, Malay Mail), Nov 10, 2026. Type: other. Asia-Pacific countries affected: Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "other",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/ec-mcmc-take-measures-to-protect-website-following-reported-cyber-atta-20261110/"
    },
    {
     "source_name": "Malay Mail",
     "url": "https://www.malaymail.com/news/malaysia/2026/11/10/ec-mcmc-take-measures-to-protect-website-following-reported-cyber-attack/242677",
     "description": "EC, MCMC take measures to protect website following reported cyber attack"
    },
    {
     "source_name": "Free Malaysia Today",
     "url": "https://www.freemalaysiatoday.com/category/nation/2026/11/10/ec-working-with-mcmc-after-suspected-cyberattack",
     "description": "EC working with MCMC after suspected cyberattack"
    },
    {
     "source_name": "Free Malaysia Today",
     "url": "https://www.freemalaysiatoday.com/category/bahasa/tempatan/2026/11/10/spr-kerjasama-dengan-skmm-selepas-dakwaan-serangan-siber",
     "description": "SPR kerjasama dengan SKMM selepas dakwaan serangan siber"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-10",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Malaysia",
   "country": "MY"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--cf5165e8-f49d-5873-9f5b-6ed896c0cc8f",
   "created": "2026-11-10T16:32:08.733Z",
   "modified": "2026-11-10T16:32:08.733Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2eb074a2-3441-5531-816d-e5b4404363e0",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--2529a32d-ae58-5b7b-ae94-92dc50d4831a",
   "created": "2026-11-10T16:32:08.689Z",
   "modified": "2026-11-13T00:02:47.678Z",
   "name": "Fahmi says online banking remains safe despite cyberattacks and Bank Rakyat hack",
   "description": "Detected automatically from 2 articles in 2 outlets (Free Malaysia Today, Malay Mail), Nov 7, 2026. Type: intrusion; sectors: financial services. Asia-Pacific countries affected: Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "intrusion",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/fahmi-says-online-banking-remains-safe-despite-cyberattacks-and-bank-r-20261107/"
    },
    {
     "source_name": "Malay Mail",
     "url": "https://www.malaymail.com/news/malaysia/2026/11/07/fahmi-says-online-banking-remains-safe-despite-cyberattacks-and-bank-rakyat-hack/242378",
     "description": "Fahmi says online banking remains safe despite cyberattacks and Bank Rakyat hack"
    },
    {
     "source_name": "Free Malaysia Today",
     "url": "https://www.freemalaysiatoday.com/category/nation/2026/11/07/banking-system-secure-says-fahmi-after-bank-rakyat-hack",
     "description": "Banking system secure, says Fahmi after Bank Rakyat hack"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-07",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--63c5a92b-add4-519b-9d14-c21296e6b079",
   "created": "2026-11-10T16:32:08.689Z",
   "modified": "2026-11-10T16:32:08.689Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2529a32d-ae58-5b7b-ae94-92dc50d4831a",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-13T00:02:47.442Z",
   "name": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack",
   "description": "Detected automatically from 8 articles in 7 outlets (Bangkok Post, Channel News Asia, Malay Mail, Matichon, South China Morning Post, The Straits Times and others), Oct 30 to Nov 10, 2026. Type: data breach; sectors: transportation, technology. Asia-Pacific countries affected: Thailand, Japan, Singapore, Hong Kong, Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/cathay-pacific-says-data-from-53000-bookings-compromised-in-amadeus-cy-20261030/"
    },
    {
     "source_name": "South China Morning Post",
     "url": "https://www.scmp.com/news/hong-kong/transport/article/3372722/cathay-pacific-says-data-53000-bookings-compromised-amadeus-cyberattack",
     "description": "Cathay Pacific says data from 53,000 bookings compromised in Amadeus cyberattack"
    },
    {
     "source_name": "Malay Mail",
     "url": "https://www.malaymail.com/news/malaysia/2026/11/01/malaysia-airlines-warns-customers-of-data-exposure-in-amadeus-cybersecurity-breach/241516",
     "description": "Malaysia Airlines warns customers of data exposure in Amadeus cybersecurity breach"
    },
    {
     "source_name": "The Straits Times",
     "url": "https://www.straitstimes.com/singapore/46000-sia-booking-records-accessed-illegally-in-data-breach-affecting-software-provider-amadeus",
     "description": "46,000 SIA booking records accessed illegally in data breach affecting software provider Amadeus"
    },
    {
     "source_name": "Channel News Asia",
     "url": "https://www.channelnewsasia.com/singapore/sia-singapore-airlines-amadeus-data-breach-booking-records-6517151",
     "description": "About 46,000 SIA booking records accessed in data breach involving travel tech company Amadeus"
    },
    {
     "source_name": "Matichon",
     "url": "https://www.matichon.co.th/economy/news_5969157",
     "description": "การบินไทย รับถูกแฮก ข้อมูลรั่ว 6 หมื่นรายการ แต่ไม่กระทบข้อมูลบัตรเครดิต"
    },
    {
     "source_name": "Bangkok Post",
     "url": "https://www.bangkokpost.com/thailand/general/3352180/60000-thai-bookings-compromised-in-amadeus-breach",
     "description": "THAI passenger data compromised in Amadeus security breach"
    },
    {
     "source_name": "The Thaiger",
     "url": "https://thethaiger.com/news/world/aviation/thai-airways-confirms-passenger-data-leak-but-credit-card-details-safe",
     "description": "Thai Airways confirms passenger data leak but credit card details safe"
    },
    {
     "source_name": "Matichon",
     "url": "https://www.matichon.co.th/economy/news_5969937",
     "description": "การบินไทย แจ้ง ไซเบอร์โจมตี ข้อมูล 6 หมื่นรายการรั่วไหล ไชยชนก ถก ‘แอปเปิ้ล’ สกัด"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-30",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Transportation",
    "Technology"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Hong Kong",
   "country": "HK"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--d8dcd32a-245a-5e4c-b9bc-e5e43b9093eb",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--d5d32a33-2c36-553a-b6c6-1eeb931fa5f2",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Japan",
   "country": "JP"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--317010bf-0058-51a9-b822-d6d704efbe31",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--a3ed75f2-2699-5840-b35c-27be8a40c0cc",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Singapore",
   "country": "SG"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--dc48e5ec-d80c-5cbd-bea5-0fd84c8f8607",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--b22cb7ad-b9b2-5b37-8ef2-4d0765314d7e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Thailand",
   "country": "TH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--6dac9bd3-fa51-5640-8e1c-99147e4a1ad5",
   "created": "2026-11-10T16:32:08.491Z",
   "modified": "2026-11-10T16:32:08.491Z",
   "relationship_type": "related-to",
   "source_ref": "incident--a967416f-84ac-5091-9236-eec7739030c4",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--11c4e0f1-429d-54d2-9211-5695425d6870",
   "created": "2026-11-10T16:32:08.467Z",
   "modified": "2026-11-13T00:02:47.413Z",
   "name": "Kluang council files report over porn on hacked LED screens",
   "description": "Detected automatically from 4 articles in 2 outlets (Free Malaysia Today, Malay Mail), Oct 30 to Oct 31, 2026. Type: defacement; sectors: government. Asia-Pacific countries affected: Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "defacement",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/kluang-council-files-report-over-porn-on-hacked-led-screens-20261030/"
    },
    {
     "source_name": "Free Malaysia Today",
     "url": "https://www.freemalaysiatoday.com/category/bahasa/tempatan/2026/10/30/skrin-led-di-kluang-digodam-papar-video-lucah",
     "description": "Skrin LED di Kluang digodam papar video lucah"
    },
    {
     "source_name": "Free Malaysia Today",
     "url": "https://www.freemalaysiatoday.com/category/nation/2026/10/30/kluang-council-files-report-over-porn-on-hacked-led-screens",
     "description": "Kluang council files report over porn on hacked LED screens"
    },
    {
     "source_name": "Malay Mail",
     "url": "https://www.malaymail.com/news/malaysia/2026/10/30/kluang-council-shuts-down-led-screens-after-obscene-video-appears-in-suspected-hack/241279",
     "description": "Kluang council shuts down LED screens after obscene video appears in suspected hack"
    },
    {
     "source_name": "Malay Mail",
     "url": "https://www.malaymail.com/news/malaysia/2026/10/31/police-probe-hacking-of-kluang-council-led-screens-after-obscene-content-displayed/241350",
     "description": "Police probe hacking of Kluang council LED screens after obscene content displayed"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-30",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Government"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--2ba1fba7-a52c-5834-b182-76d96b514956",
   "created": "2026-11-10T16:32:08.467Z",
   "modified": "2026-11-10T16:32:08.467Z",
   "relationship_type": "related-to",
   "source_ref": "incident--11c4e0f1-429d-54d2-9211-5695425d6870",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--3a1c6fa6-3d01-5851-8284-659c151198aa",
   "created": "2026-11-10T16:32:08.085Z",
   "modified": "2026-11-10T16:40:20.478Z",
   "name": "Tabung Haji services back following cyberattack",
   "description": "Detected automatically from 2 articles in 2 outlets (Free Malaysia Today, Malay Mail), Oct 12, 2026. Type: other. Asia-Pacific countries affected: Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "other",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/tabung-haji-services-back-following-cyberattack-20261012/"
    },
    {
     "source_name": "Free Malaysia Today",
     "url": "https://www.freemalaysiatoday.com/category/nation/2026/10/12/tabung-haji-services-back-following-cyberattack",
     "description": "Tabung Haji services back following cyberattack"
    },
    {
     "source_name": "Malay Mail",
     "url": "https://www.malaymail.com/news/malaysia/2026/10/12/tabung-haji-systems-resume-after-cyberattack-depositors-savings-confirmed-safe/238782",
     "description": "Tabung Haji systems resume after cyberattack, depositors’ savings confirmed safe"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-12",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--d0d7ef8a-2574-5aa2-8689-058634a1f9cd",
   "created": "2026-11-10T16:32:08.085Z",
   "modified": "2026-11-10T16:32:08.085Z",
   "relationship_type": "related-to",
   "source_ref": "incident--3a1c6fa6-3d01-5851-8284-659c151198aa",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--4b71dcd8-d94c-5772-9998-0cadd2336700",
   "created": "2026-11-10T16:32:08.071Z",
   "modified": "2026-11-10T16:40:20.464Z",
   "name": "Man loses over RM12mil in suspected crypto theft",
   "description": "Detected automatically from 2 articles in 2 outlets (Free Malaysia Today, Malay Mail), Oct 10, 2026. Type: cryptocurrency theft; sectors: cryptocurrency. Asia-Pacific countries affected: Malaysia. Largest figure in the headlines: 12,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "crypto_theft",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/man-loses-over-rm12mil-in-suspected-crypto-theft-20261010/"
    },
    {
     "source_name": "Free Malaysia Today",
     "url": "https://www.freemalaysiatoday.com/category/nation/2026/10/10/man-loses-over-rm12mil-in-suspected-crypto-theft",
     "description": "Man loses over RM12mil in suspected crypto theft"
    },
    {
     "source_name": "Malay Mail",
     "url": "https://www.malaymail.com/news/malaysia/2026/10/10/man-loses-over-rm12m-in-suspected-crypto-theft/238570",
     "description": "Man loses over RM12m in suspected crypto theft"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-10",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Cryptocurrency"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--437f539d-d38e-565c-83bb-b7434db3be93",
   "created": "2026-11-10T16:32:08.071Z",
   "modified": "2026-11-10T16:32:08.071Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4b71dcd8-d94c-5772-9998-0cadd2336700",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--ff257aa0-5aba-5fb1-917c-bc40dcda6f76",
   "created": "2026-11-10T16:32:07.980Z",
   "modified": "2026-11-10T16:40:20.386Z",
   "name": "South Korean megachurches probe suspected AI-linked cyberattacks",
   "description": "Detected automatically from 1 article in 1 outlet (Free Malaysia Today), Oct 7, 2026. Type: other. Asia-Pacific countries affected: Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "other",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/south-korean-megachurches-probe-suspected-ai-linked-cyberattacks-20261007/"
    },
    {
     "source_name": "Free Malaysia Today",
     "url": "https://www.freemalaysiatoday.com/category/world/2026/10/07/south-korean-megachurches-probe-suspected-ai-linked-cyberattacks",
     "description": "South Korean megachurches probe suspected AI-linked cyberattacks"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-07",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--a16085e9-8e8f-5f63-a5f3-bfa653bedf81",
   "created": "2026-11-10T16:32:07.980Z",
   "modified": "2026-11-10T16:32:07.980Z",
   "relationship_type": "related-to",
   "source_ref": "incident--ff257aa0-5aba-5fb1-917c-bc40dcda6f76",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--8560875a-c105-5b1b-9f18-146635126e17",
   "created": "2026-11-10T16:32:07.925Z",
   "modified": "2026-11-10T16:40:20.340Z",
   "name": "South Korea’s Lee says AI appears to have been used in bank hacks",
   "description": "Detected automatically from 1 article in 1 outlet (Free Malaysia Today), Oct 6, 2026. Type: intrusion; sectors: financial services. Asia-Pacific countries affected: Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "intrusion",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/south-koreas-lee-says-ai-appears-to-have-been-used-in-bank-hacks-20261006/"
    },
    {
     "source_name": "Free Malaysia Today",
     "url": "https://www.freemalaysiatoday.com/category/business/2026/10/06/south-korea-s-lee-says-ai-appears-to-have-been-used-in-bank-hacks",
     "description": "South Korea’s Lee says AI appears to have been used in bank hacks"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-06",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--d0de1fb1-1e6e-58f2-879f-92c195592038",
   "created": "2026-11-10T16:32:07.925Z",
   "modified": "2026-11-10T16:32:07.925Z",
   "relationship_type": "related-to",
   "source_ref": "incident--8560875a-c105-5b1b-9f18-146635126e17",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--fc628008-8939-5f2f-b928-6496ee23e7c5",
   "created": "2026-11-10T16:32:07.942Z",
   "modified": "2026-11-10T16:40:20.353Z",
   "name": "Jaya Grocer warns customers after Instagram account hacked, fake ‘Anniversary Promo’ posts push Telegram links",
   "description": "Detected automatically from 1 article in 1 outlet (Malay Mail), Oct 6, 2026. Type: intrusion. Asia-Pacific countries affected: Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "intrusion",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/jaya-grocer-warns-customers-after-instagram-account-hacked-fake-annive-20261006/"
    },
    {
     "source_name": "Malay Mail",
     "url": "https://www.malaymail.com/news/malaysia/2026/10/06/jaya-grocer-warns-customers-after-instagram-account-hacked-fake-anniversary-promo-posts-push-telegram-links/237925",
     "description": "Jaya Grocer warns customers after Instagram account hacked, fake ‘Anniversary Promo’ posts push Telegram links"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-06",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--af984955-d44d-5ce7-be58-ed527c96d684",
   "created": "2026-11-10T16:32:07.942Z",
   "modified": "2026-11-10T16:32:07.942Z",
   "relationship_type": "related-to",
   "source_ref": "incident--fc628008-8939-5f2f-b928-6496ee23e7c5",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--95278c9a-b6e3-56cc-9452-fb41c33de6ee",
   "created": "2026-11-10T16:32:07.725Z",
   "modified": "2026-11-10T16:40:20.172Z",
   "name": "Gemini hacked 3 companies in first known breakout by Google’s AI",
   "description": "Detected automatically from 1 article in 1 outlet (Free Malaysia Today), Sep 19, 2026. Type: intrusion. Asia-Pacific countries affected: Malaysia. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "intrusion",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/gemini-hacked-3-companies-in-first-known-breakout-by-googles-ai-20260919/"
    },
    {
     "source_name": "Free Malaysia Today",
     "url": "https://www.freemalaysiatoday.com/category/business/2026/09/19/gemini-hacked-3-companies-in-first-known-breakout-by-google-s-ai",
     "description": "Gemini hacked 3 companies in first known breakout by Google’s AI"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-19",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--e136678e-e44d-52fa-a7a6-d509f0500d27",
   "created": "2026-11-10T16:32:07.725Z",
   "modified": "2026-11-10T16:32:07.725Z",
   "relationship_type": "related-to",
   "source_ref": "incident--95278c9a-b6e3-56cc-9452-fb41c33de6ee",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Earth Alux Espionage Campaign Targets ASEAN Defense Ministries",
   "description": "Trend Micro researchers disclosed an ongoing espionage campaign by Earth Alux (China-linked) targeting defense ministries and military contractors across Thailand, Philippines, Vietnam, and Malaysia. The group deployed VARGEIT and COBEACON implants via trojanized military procurement documents. The campaign has been active since at least Q4 2025, with lateral movement into classified networks confirmed at two ASEAN defense organizations.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/earth-alux-espionage-campaign-targets-asean-defense-ministries/"
    },
    {
     "source_name": "source",
     "url": {
      "title": "Trend Micro Research",
      "url": "https://www.trendmicro.com/en_us/research.html"
     }
    }
   ],
   "x_securitystudies_occurred_on": "2025-10-15",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Defense",
    "Government",
    "Defense Industrial Base"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--c0026139-5643-5d47-bac1-71c57ff02bda",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-08T21:16:16.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Philippines",
   "country": "PH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--c47a29ab-212b-5f0b-97dc-f1d5ac028775",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-08T21:16:16.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Vietnam",
   "country": "VN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--53a044f5-0589-5f74-8b1e-d49911eede50",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-08T21:16:16.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--5e562017-2630-53a9-8411-2e18c658a7e4",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-08T21:16:16.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "target_ref": "location--15974012-cc36-5adc-accd-f3f0770e8d4f",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--84c9386a-a191-5067-af66-85089b12bc28",
   "created": "2026-11-09T04:30:05.352Z",
   "modified": "2026-11-09T04:30:05.352Z",
   "name": "Earth Alux",
   "aliases": [],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/earth-alux/"
    }
   ],
   "description": "Earth Alux is a China-linked APT group known for conducting cyberespionage attacks across various sectors, including government, technology, and telecommunications. They primarily exploit vulnerable services in exposed servers to gain initial access, implanting web shells like GODZILLA and deploying backdoors such as VARGEIT and COBEACON. The group employs tools like RSBINJECT and MASQLOADER for lateral movement and network discovery, while also utilizing RAILSETTER for persistence through mspaint injection. Their operations have predominantly targeted the APAC region and have extended to Latin America, with a focus on exfiltrating sensitive information to attacker-controlled cloud storage."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--2e655fb6-f447-589e-b353-53cbe2ca73fc",
   "created": "2026-11-08T21:16:16.695Z",
   "modified": "2026-11-08T21:16:16.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--2f3f0da8-0a2d-56d3-817a-eba0777e6843",
   "target_ref": "intrusion-set--84c9386a-a191-5067-af66-85089b12bc28",
   "description": "attribution"
  }
 ]
}