{
 "type": "bundle",
 "id": "bundle--c90f9350-292b-4692-8da1-c96512b81268",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--167ea1de-40ba-55d9-81b2-cbf681891ff2",
   "created": "2026-11-10T16:32:07.714Z",
   "modified": "2026-11-10T16:40:20.163Z",
   "name": "Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties",
   "description": "Detected automatically from 1 article in 1 outlet (SentinelLabs), Sep 18, 2026. Type: espionage campaign; sectors: cryptocurrency. Asia-Pacific countries affected: India. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "espionage",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-20260918/"
    },
    {
     "source_name": "SentinelLabs",
     "url": "https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/",
     "description": "Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-18",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Cryptocurrency"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--095279bc-69f1-5155-a576-8cfad052b57e",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "India",
   "country": "IN"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--b4e71c1e-9c90-5ae0-9b58-182232b8dfbc",
   "created": "2026-11-10T16:32:07.714Z",
   "modified": "2026-11-10T16:32:07.714Z",
   "relationship_type": "related-to",
   "source_ref": "incident--167ea1de-40ba-55d9-81b2-cbf681891ff2",
   "target_ref": "location--095279bc-69f1-5155-a576-8cfad052b57e",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--f7ec5c4f-7c84-552d-9249-9fd7f5a9263c",
   "created": "2026-11-09T04:30:08.704Z",
   "modified": "2026-11-09T04:30:08.704Z",
   "name": "WageMole",
   "aliases": [
    "Contagious Interview",
    "DEV#POPPER",
    "DeceptiveDevelopment",
    "Famous Chollima",
    "Gwisin Gang",
    "Nickel Tapestry",
    "PurpleBravo",
    "Storm-1877",
    "TAG-121",
    "Tenacious Pungsan",
    "UNC5267",
    "Void Dokkaebi",
    "Wagemole",
    "WaterPlum"
   ],
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "G1052",
     "url": "https://attack.mitre.org/groups/G1052/"
    },
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/wagemole/"
    }
   ],
   "description": "WageMole is a North Korean state-sponsored APT that employs social engineering and technology to secure remote job opportunities in Western countries, leveraging stolen personal data from the Contagious Interview campaign. Threat actors create fake identities, including passports and driver's licenses, and prepare study guides for interviews, often utilizing generative AI for well-structured responses. They target small to mid-sized businesses and utilize job platforms like Upwork and Indeed, while employing automation scripts for account creation. WageMole's activities include sharing code within their group and requesting payments through platforms like PayPal to conceal their identity."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--dc23a4b9-3aa3-52ec-a3a8-c6407a7f72db",
   "created": "2026-11-10T16:32:07.714Z",
   "modified": "2026-11-10T16:32:07.714Z",
   "relationship_type": "related-to",
   "source_ref": "incident--167ea1de-40ba-55d9-81b2-cbf681891ff2",
   "target_ref": "intrusion-set--f7ec5c4f-7c84-552d-9249-9fd7f5a9263c",
   "description": "actor named in the coverage (the sources' attribution)"
  }
 ]
}