{ "type": "bundle", "id": "bundle--9990da9a-2c8b-475a-8931-4a2e6eeeda8b", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "identity", "spec_version": "2.1", "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "SecurityStudies.info", "identity_class": "organization", "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated." }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "incident", "id": "incident--ed609681-141a-5889-9879-62a039024462", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-10T16:26:37.587Z", "name": "Anthropic disrupts APT29-linked GTG-20006 AI-assisted malware rebuild operation", "description": "Anthropic disclosed in September 2026 that it had disrupted GTG-20006, a cluster attributed to Midnight Blizzard/APT29/Cozy Bear, which had constructed an AI-driven process to monitor its malware against security products and automatically rebuild and redeploy any toolkit that was detected. The group additionally used the model to register domains, establish hosting and manage command-and-control channels. Operations ran July to September 2026 against more than 20 organisations across Ukraine, Europe, the Middle East and Asia, targeting military intelligence, diplomatic and defence bodies and individuals connected to US foreign policy. The malware set included PowerChrome, WUEngine, Shadow C2, MiniPlasma and CloudSyncSvc on Windows plus GiftDrop for Android and DarkSword for iOS, overlapping with the CaptiveCrunch campaign.", "confidence": 50, "labels": [ "espionage", "curated" ], "external_references": [ { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/incidents/anthropic-disrupts-apt29-linked-gtg-20006-ai-assisted-malware-rebuild-operation/" }, { "source_name": "source", "url": "https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.html" }, { "source_name": "source", "url": "https://www.bleepingcomputer.com/news/security/hackers-abused-claude-to-extract-secrets-from-18m-android-apps/" } ], "x_securitystudies_occurred_on": "2026-07-01", "x_securitystudies_severity": 4, "x_securitystudies_status": "curated", "x_securitystudies_sectors": [ "Government", "Military Intelligence", "Diplomatic Missions", "Defense" ], "x_securitystudies_eu_relevance": "high" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--ea0d7db0-76af-585f-abba-be0eedbdb5b0", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Ukraine", "country": "UA" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--7de38b3e-b581-521a-954a-cf97402f8960", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-08T21:16:16.721Z", "relationship_type": "related-to", "source_ref": "incident--ed609681-141a-5889-9879-62a039024462", "target_ref": "location--ea0d7db0-76af-585f-abba-be0eedbdb5b0", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--503459b5-8a45-54e9-a768-8ce4d09c7ddd", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Poland", "country": "PL" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--c947ebb1-ccbe-5435-a3aa-5746a0519b4f", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-08T21:16:16.721Z", "relationship_type": "related-to", "source_ref": "incident--ed609681-141a-5889-9879-62a039024462", "target_ref": "location--503459b5-8a45-54e9-a768-8ce4d09c7ddd", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Germany", "country": "DE" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--9b050480-c68d-567b-a270-2f566474c7fa", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-08T21:16:16.721Z", "relationship_type": "related-to", "source_ref": "incident--ed609681-141a-5889-9879-62a039024462", "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "United States", "country": "US" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--43dcc2a4-ccbb-5e52-8de5-7a787e33f88a", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-08T21:16:16.721Z", "relationship_type": "related-to", "source_ref": "incident--ed609681-141a-5889-9879-62a039024462", "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--280a4642-e073-52ad-bf40-8aec67acd6a6", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Israel", "country": "IL" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--6e2ba8b8-c6b1-5a12-b78e-aba7b2e53d7a", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-08T21:16:16.721Z", "relationship_type": "related-to", "source_ref": "incident--ed609681-141a-5889-9879-62a039024462", "target_ref": "location--280a4642-e073-52ad-bf40-8aec67acd6a6", "description": "country named in the coverage" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "location", "id": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "created": "2026-11-10T00:00:00.000Z", "modified": "2026-11-10T00:00:00.000Z", "name": "Japan", "country": "JP" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--25dc3af8-c83d-55aa-b685-bccd9b2b64ba", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-08T21:16:16.721Z", "relationship_type": "related-to", "source_ref": "incident--ed609681-141a-5889-9879-62a039024462", "target_ref": "location--82f471cb-7d16-5a5e-89ef-b8fed6d0f45e", "description": "affected country" }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "intrusion-set", "id": "intrusion-set--6fb07810-96dd-5ad6-a80a-1306e77f020a", "created": "2026-11-09T04:30:08.727Z", "modified": "2026-11-09T04:30:08.727Z", "name": "APT29", "aliases": [ "ATK7", "Blue Kitsune", "BlueBravo", "COZY BEAR", "Cloaked Ursa", "Cozy Bear", "CozyDuke", "Dark Halo", "G0016", "Grizzly Steppe", "Group 100", "ICE RELIC", "ICECAP", "IRON HEMLOCK", "IRON RITUAL", "ITG11", "Midnight Blizzard", "Minidionis", "NOBELIUM", "Nobelium", "NobleBaron", "SeaDuke", "SolarStorm", "TA421", "The Dukes", "UAC-0029", "UNC2452", "UNC3524", "YTTRIUM" ], "external_references": [ { "source_name": "mitre-attack", "external_id": "G0016", "url": "https://attack.mitre.org/groups/G0016/" }, { "source_name": "securitystudies.info", "url": "https://securitystudies.info/cyber/actors/apt29/" } ], "description": "A 2015 report by F-Secure describe APT29 as: 'The Dukes are a well-resourced, highly dedicated and organized cyberespionage group that we believe has been working for the Russian Federation since at least 2008 to collect intelligence in support of foreign and security policy decision-making. The Dukes show unusual confidence in their ability to continue successfully compromising their targets, as well as in their ability to operate with impunity. The Dukes primarily target Western governments and related organizations, such as government ministries and agencies, political think tanks, and governmental subcontractors. Their targets have also included the governments of members of the Commonwealth of Independent States;Asian, African, and Middle Eastern governments;organizations associated with Chechen extremism;and Russian speakers engaged in the illicit trade of controlled substances and drugs. The Dukes are known to employ a vast arsenal of malware toolsets, which we identify as MiniDuke, CosmicDuke, OnionDuke, CozyDuke, CloudDuke, SeaDuke, HammerDuke, PinchDuke, and GeminiDuke. In recent years, the Dukes have engaged in apparently biannual large - scale spear - phishing campaigns against hundreds or even thousands of recipients associated with governmental institutions and affiliated organizations. These campaigns utilize a smash - and - grab approach involving a fast but noisy breakin followed by the rapid collection and exfiltration of as much data as possible.If the compromised target is discovered to be of value, the Dukes will quickly switch the toolset used and move to using stealthier tactics focused on persistent compromise and long - term intelligence gathering. This threat actor targets government ministries and agencies in the West, Central Asia, East Africa, and the Middle East; Chechen extremist groups; Russian organized crime; and think tanks. It is suspected to be behind the 2015 compromise of unclassified networks at the White House, Department of " }, { "spec_version": "2.1", "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "type": "relationship", "id": "relationship--87f07adf-f81e-5fba-beac-50013a92727a", "created": "2026-11-08T21:16:16.721Z", "modified": "2026-11-08T21:16:16.721Z", "relationship_type": "related-to", "source_ref": "incident--ed609681-141a-5889-9879-62a039024462", "target_ref": "intrusion-set--6fb07810-96dd-5ad6-a80a-1306e77f020a", "description": "attribution" } ] }