{
 "type": "bundle",
 "id": "bundle--46dbe513-3049-449a-97a0-9abb82f1a882",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--220b273c-a6dd-5a58-8673-4ff233fc2f63",
   "created": "2026-11-11T20:35:30.174Z",
   "modified": "2026-11-13T06:07:08.769Z",
   "name": "300 Italian Schools Receive \"From Taiwan\" Bomb Threat Letters, Da-Yeh University Alumnus Account Suspected Hacked",
   "description": "Detected automatically from 1 article in 1 outlet (Liberty Times), Nov 11, 2026. Title machine-translated from Chinese. Type: intrusion; sectors: education. Asia-Pacific countries affected: Taiwan. EU member states named: Italy. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "intrusion",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/300-italian-schools-receive-from-taiwan-bomb-threat-letters-da-yeh-uni-20261111/"
    },
    {
     "source_name": "Liberty Times",
     "url": "https://news.ltn.com.tw/news/society/breakingnews/5637677",
     "description": "義大利300校收「來自台灣」炸彈恐嚇信 大葉大學校友帳號疑遭盜用"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-11",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Education"
   ],
   "x_securitystudies_eu_relevance": "high"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--25d56fc8-0097-5c58-8db1-4aeb352be797",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Italy",
   "country": "IT"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1a8b590a-a0ee-5302-bd9b-51a47d6ce96d",
   "created": "2026-11-11T20:35:30.174Z",
   "modified": "2026-11-11T20:35:30.174Z",
   "relationship_type": "related-to",
   "source_ref": "incident--220b273c-a6dd-5a58-8673-4ff233fc2f63",
   "target_ref": "location--25d56fc8-0097-5c58-8db1-4aeb352be797",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Taiwan",
   "country": "TW"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--7b83b865-25b6-5afa-bafd-b174b6b44661",
   "created": "2026-11-11T20:35:30.174Z",
   "modified": "2026-11-11T20:35:30.174Z",
   "relationship_type": "related-to",
   "source_ref": "incident--220b273c-a6dd-5a58-8673-4ff233fc2f63",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--405f3569-5363-54ac-a5c2-56be7e0b152e",
   "created": "2026-11-10T16:32:08.743Z",
   "modified": "2026-11-13T06:07:08.686Z",
   "name": "Din Tai Fung shopping website hit by data breach! City councilor nearly falls for it, issues warning; official statement released urgently",
   "description": "Detected automatically from 1 article in 1 outlet (New Talk), Nov 10, 2026. Title machine-translated from Chinese. Type: data breach; sectors: government, technology, retail. Asia-Pacific countries affected: Taiwan. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/incident-20261110/"
    },
    {
     "source_name": "New Talk",
     "url": "https://newtalk.tw/news/view/2026-11-10/1070287",
     "description": "鼎泰豐購物網驚傳個資外洩！市議員險上當發文示警 官方急發聲明"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-10",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Government",
    "Technology",
    "Retail"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1707ef90-2b13-51cd-b1c7-e2d9616c5452",
   "created": "2026-11-10T16:32:08.743Z",
   "modified": "2026-11-10T16:32:08.743Z",
   "relationship_type": "related-to",
   "source_ref": "incident--405f3569-5363-54ac-a5c2-56be7e0b152e",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--3ca3953e-4381-5c42-a175-ce4ed966d19b",
   "created": "2026-11-11T12:23:36.534Z",
   "modified": "2026-11-13T06:07:08.729Z",
   "name": "Kang Chiao International School Linkou campus network hacked; parents receive ransom letters, realize all personal data leaked",
   "description": "Detected automatically from 2 articles in 2 outlets (Liberty Times, New Talk), Nov 10 to Nov 11, 2026. Title machine-translated from Chinese. Type: ransomware; sectors: education. Asia-Pacific countries affected: Taiwan. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "ransomware",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/incident-20261110-5/"
    },
    {
     "source_name": "Liberty Times",
     "url": "https://news.ltn.com.tw/news/society/breakingnews/5636370",
     "description": "「康橋國際學校」林口校區網路遭駭 家長收勒索信、驚覺個資全外洩"
    },
    {
     "source_name": "New Talk",
     "url": "https://newtalk.tw/news/view/2026-11-11/1070464",
     "description": "康橋林口校區驚傳駭客恐嚇！威脅洩露教職員與家長個資"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-10",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Education"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--d56cb139-dbbb-580b-ae0b-9356de50d760",
   "created": "2026-11-11T12:23:36.534Z",
   "modified": "2026-11-11T12:23:36.534Z",
   "relationship_type": "related-to",
   "source_ref": "incident--3ca3953e-4381-5c42-a175-ce4ed966d19b",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--1dff11a9-d126-5a2f-b82b-9ea8ccf8ebfa",
   "created": "2026-11-10T16:32:08.695Z",
   "modified": "2026-11-13T06:07:08.609Z",
   "name": "Cyberattack shuts down Internet fan fiction library",
   "description": "Detected automatically from 1 article in 1 outlet (Taipei Times), Nov 7, 2026. Type: other; sectors: technology. Asia-Pacific countries affected: Taiwan. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "other",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/cyberattack-shuts-down-internet-fan-fiction-library-20261107/"
    },
    {
     "source_name": "Taipei Times",
     "url": "https://www.taipeitimes.com/News/world/archives/2026/11/08/2003867379",
     "description": "Cyberattack shuts down Internet fan fiction library"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-07",
   "x_securitystudies_severity": 2,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Technology"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--12a00f13-b4b6-5af1-a7f5-6f2e6344f1b4",
   "created": "2026-11-10T16:32:08.695Z",
   "modified": "2026-11-10T16:32:08.695Z",
   "relationship_type": "related-to",
   "source_ref": "incident--1dff11a9-d126-5a2f-b82b-9ea8ccf8ebfa",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--7a33e88b-9d5a-5a8b-a999-6ada6710b702",
   "created": "2026-11-10T16:32:08.626Z",
   "modified": "2026-11-13T06:07:08.530Z",
   "name": "No evidence of customer data leak in unauthorized transactions: SinoPac",
   "description": "Detected automatically from 3 articles in 3 outlets (Liberty Times, New Talk, Taipei Times), Nov 4 to Nov 12, 2026. Type: data breach; sectors: government, financial services. Asia-Pacific countries affected: Taiwan. Largest figure in the headlines: 40,000,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/no-evidence-of-customer-data-leak-in-unauthorized-transactions-sinopac-20261104/"
    },
    {
     "source_name": "New Talk",
     "url": "https://newtalk.tw/news/view/2026-11-04/1069275",
     "description": "永豐銀行419人遭盜轉！金額約4千餘萬 北檢今分案偵辦"
    },
    {
     "source_name": "Taipei Times",
     "url": "https://www.taipeitimes.com/News/biz/archives/2026/11/05/2003867168",
     "description": "No evidence of customer data leak in unauthorized transactions: SinoPac"
    },
    {
     "source_name": "Liberty Times",
     "url": "https://ec.ltn.com.tw/article/breakingnews/5638871",
     "description": "永豐銀行資安事件今送報告 金管會全面調查缺失"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-04",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Government",
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--ea92fcab-e2b4-5704-8ab2-7dd9d7a0b086",
   "created": "2026-11-10T16:32:08.626Z",
   "modified": "2026-11-10T16:32:08.626Z",
   "relationship_type": "related-to",
   "source_ref": "incident--7a33e88b-9d5a-5a8b-a999-6ada6710b702",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--9ca06372-b640-5b3c-bbbe-f3d2f56f9c7c",
   "created": "2026-11-10T16:32:07.954Z",
   "modified": "2026-11-10T16:40:20.362Z",
   "name": "104人力銀行遭駭！12萬筆求職者個資恐外洩 官方發重訊證實了",
   "description": "Detected automatically from 1 article in 1 outlet (Liberty Times), Oct 6, 2026. Type: data breach; sectors: financial services. Asia-Pacific countries affected: Taiwan. Largest figure in the headlines: 120,000. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "data_breach",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/10412-20261006/"
    },
    {
     "source_name": "Liberty Times",
     "url": "https://news.ltn.com.tw/news/life/breakingnews/5597618",
     "description": "104人力銀行遭駭！12萬筆求職者個資恐外洩 官方發重訊證實了"
    }
   ],
   "x_securitystudies_occurred_on": "2026-10-06",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--cf3fc73f-9638-5020-b9e5-6214278e1199",
   "created": "2026-11-10T16:32:07.954Z",
   "modified": "2026-11-10T16:32:07.954Z",
   "relationship_type": "related-to",
   "source_ref": "incident--9ca06372-b640-5b3c-bbbe-f3d2f56f9c7c",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "SecFlow Campaign Uses Commercial AI Agents Against Taiwanese and Indonesian Government Targets",
   "description": "Hunt.io researchers documented Chinese-speaking operators running the SecFlow framework across five exposed directories, routing requests to Claude, Qwen and DeepSeek through private proxy servers on the niestools.com domain as interchangeable operational components. Confirmed targets include Kuomintang Party political archives in Taiwan, the Indonesian Ministry of Foreign Affairs, industrial hosts in Vietnam, and government, education and industrial entities in China. The operators deployed the GLUTTON webshell framework and ASPX web shells, used steganographic PNG payload delivery and a fake MySQL deserialization service, and dumped LSASS memory in 37-block segments. Confirmed impact totals 822 compromised office-automation user records and 1.28GB of exfiltrated data including patient health information.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/secflow-campaign-uses-commercial-ai-agents-against-taiwanese-and-indonesian-government-targets/"
    },
    {
     "source_name": "source",
     "url": "https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-04",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Education",
    "Manufacturing",
    "Healthcare"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--e7abb989-2773-57b7-ae68-ece06d3664fd",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Indonesia",
   "country": "ID"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--4f4f93e7-0fc6-5ae0-a6a0-54fca02eacca",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Vietnam",
   "country": "VN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--46ddf5df-0dfa-5683-b9b8-91ab537721e4",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--231e90b4-4920-54e1-af65-e3447d240a54",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "China",
   "country": "CN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--fb865868-8a32-500d-8fd8-2f35681509ce",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--231e90b4-4920-54e1-af65-e3447d240a54",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Thailand",
   "country": "TH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--1df41102-2f1d-5e81-b020-e232fb5f92f8",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--51e9a2ca-ecb1-5c26-a8b7-e7de025a6086",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Afghanistan",
   "country": "AF"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8e9b5194-01ee-57c0-8e08-073a02c4576d",
   "created": "2026-11-08T21:16:16.708Z",
   "modified": "2026-11-08T21:16:16.708Z",
   "relationship_type": "related-to",
   "source_ref": "incident--4993de8b-1eda-598c-b85b-f897f4c292c8",
   "target_ref": "location--51e9a2ca-ecb1-5c26-a8b7-e7de025a6086",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--74657fff-2b96-5e87-8bba-660969e4162e",
   "created": "2026-11-08T21:16:16.719Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "China-linked SecFlow campaign uses AI agents against Asian government and industrial targets",
   "description": "Hunt.io documented a Chinese-speaking operation tracked as SecFlow, linked to a username 'Nie' recurring across its infrastructure, which routed Claude, Qwen and DeepSeek through private proxies at niestools.com to automate reconnaissance and exploitation. The toolkit included the GLUTTON webshell framework delivering steganographic payloads inside PNG files, a fake MySQL deserialization service, a Java and CAS exploitation workspace, and Shellshock and credential-testing nodes. Confirmed targeting spanned Kuomintang Party archives in Taiwan, the Indonesian Ministry of Foreign Affairs, and Chinese and Vietnamese government, education and industrial hosts. A confirmed breach of the Fengtai District government office-automation environment yielded 822 OA user records and 1.28GB of data including patient health information.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/china-linked-secflow-campaign-uses-ai-agents-against-asian-government-and-industrial-targets/"
    },
    {
     "source_name": "source",
     "url": "https://securityaffairs.com/198417/ai/chinese-hackers-use-ai-agents-in-multi-country-cyber-campaign.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-08-20",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Government",
    "Education",
    "Defense",
    "Industrial"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--71e28321-0abc-5e25-965c-aa00c51fe6c5",
   "created": "2026-11-08T21:16:16.719Z",
   "modified": "2026-11-08T21:16:16.719Z",
   "relationship_type": "related-to",
   "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--6f5180ac-106f-503e-86ac-5890fc36ea67",
   "created": "2026-11-08T21:16:16.719Z",
   "modified": "2026-11-08T21:16:16.719Z",
   "relationship_type": "related-to",
   "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e",
   "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--25b1769c-a3f9-5501-9181-7fe452a1ef4b",
   "created": "2026-11-08T21:16:16.719Z",
   "modified": "2026-11-08T21:16:16.719Z",
   "relationship_type": "related-to",
   "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e",
   "target_ref": "location--231e90b4-4920-54e1-af65-e3447d240a54",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--6ca59b95-4835-5e06-8708-e735d0538a5c",
   "created": "2026-11-08T21:16:16.719Z",
   "modified": "2026-11-08T21:16:16.719Z",
   "relationship_type": "related-to",
   "source_ref": "incident--74657fff-2b96-5e87-8bba-660969e4162e",
   "target_ref": "location--0db555ff-32c2-502e-b17e-a5deb6a6218d",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Salt Typhoon Telecom Espionage Campaign — Ongoing",
   "description": "Chinese state-sponsored group Salt Typhoon (also tracked as GhostEmperor/FamousSparrow) continues to maintain persistent access to major US, Southeast Asian, and Australian telecommunications networks. The campaign, first publicly disclosed in late 2024, has been confirmed to compromise call detail records and lawful intercept systems across at least 9 major carriers. As of May 2026, incident response is ongoing at several ASEAN-region telecoms. CISA has issued updated advisories recommending encrypted communications for government officials.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/salt-typhoon-telecom-espionage-campaign-ongoing/"
    },
    {
     "source_name": "source",
     "url": {
      "title": "CISA Advisory AA24-340A",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-340a"
     }
    },
    {
     "source_name": "source",
     "url": {
      "title": "Microsoft Threat Intelligence",
      "url": "https://www.microsoft.com/en-us/security/blog/"
     }
    }
   ],
   "x_securitystudies_occurred_on": "2024-09-15",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Telecommunications",
    "Government",
    "Defense"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "United States",
   "country": "US"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--435d00ae-93cc-5b82-973d-553a2ad2316c",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Philippines",
   "country": "PH"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8108d9cb-277e-53fe-b5e8-3795c21eb8aa",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--0d9b3799-93cc-5514-bcce-1b14ce539dc0",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--9072f4ee-c5de-5753-a3e6-9be0f67cbc1b",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--14de3cce-749c-5917-9e8b-93dfde8f4e13",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Australia",
   "country": "AU"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--d963c41d-ea95-5987-a1e4-a461feb2cbdc",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--26c5417c-4add-561a-9231-6a9797918e9d",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--c2c1b570-cc1c-557e-ac00-8cbd10cb8abc",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8be3764b-86b0-5fde-af53-2f87940a6fa2",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--d7045683-84de-5d5f-9d3a-9c69b67a5023",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Japan",
   "country": "JP"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--642c612d-bcf7-5030-bd96-c51cad00d04e",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--994a786f-903b-5827-8b99-fb2bcf62d3db",
   "created": "2026-11-09T04:30:08.681Z",
   "modified": "2026-11-09T04:30:08.681Z",
   "name": "GhostEmperor",
   "aliases": [
    "FamousSparrow",
    "OPERATOR PANDA",
    "RedMike",
    "Salt Typhoon",
    "UNC2286"
   ],
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "G1045",
     "url": "https://attack.mitre.org/groups/G1045/"
    },
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/ghostemperor/"
    }
   ],
   "description": "GhostEmperor is a Chinese-speaking threat actor that targets government entities and telecom companies in Southeast Asia. They employ a Windows kernel-mode rootkit called Demodex to gain remote control over their targeted servers. The actor demonstrates a high level of sophistication and uses various anti-forensic and anti-analysis techniques to evade detection. They have been active for a significant period of time and continue to pose a threat to their targets."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--344356d8-39e3-5c5b-b48f-9b5cf793a03a",
   "created": "2026-11-08T21:16:16.690Z",
   "modified": "2026-11-08T21:16:16.690Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91156f08-77d1-56e9-a07f-3cdbff47a209",
   "target_ref": "intrusion-set--994a786f-903b-5827-8b99-fb2bcf62d3db",
   "description": "attribution"
  }
 ]
}