{
 "type": "bundle",
 "id": "bundle--6cae815b-5557-4b82-89b3-4b0f5af699c2",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--91b0e4ed-1cae-581b-804b-aaed6cc8a5f8",
   "created": "2026-11-08T21:16:16.707Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "North Korean 'ted' Linux Backdoor Found Inside Trojanised HAProxy at South Korean Firms",
   "description": "Rapid7 Labs disclosed a previously undocumented Linux toolkit compiled directly into trojanised HAProxy 2.8.12 load balancers at two South Korean organisations in the automotive and media sectors. The 'ted' implant and companion 'curlRAT' were delivered by replacing legitimate binaries, including crond, sshd, agetty, atd and polkitd, rather than through vulnerability exploitation, allowing web traffic interception, encrypted SSH credential harvesting and log sanitisation. Rapid7 attributed the activity with medium confidence to North Korean state-sponsored actors, drawing on APT37 domain infrastructure, Lazarus delivery-model similarities and a Kimsuky-consistent initial access hypothesis involving a compromised groupware vendor.",
   "confidence": 50,
   "labels": [
    "espionage",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/north-korean-ted-linux-backdoor-found-inside-trojanised-haproxy-at-south-korean-firms/"
    },
    {
     "source_name": "source",
     "url": "https://thehackernews.com/2026/09/new-ted-backdoor-hides-inside-victims.html"
    }
   ],
   "x_securitystudies_occurred_on": "2026-09-04",
   "x_securitystudies_severity": 4,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Manufacturing",
    "Media",
    "Technology"
   ],
   "x_securitystudies_eu_relevance": "medium"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "South Korea",
   "country": "KR"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--c4eb5c6c-d312-591e-9abd-78b237948d1e",
   "created": "2026-11-08T21:16:16.707Z",
   "modified": "2026-11-08T21:16:16.707Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91b0e4ed-1cae-581b-804b-aaed6cc8a5f8",
   "target_ref": "location--81a671e7-38c1-562b-8b65-125fadcac6b4",
   "description": "affected country"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--4e396b0b-8285-592f-aca9-1f2ac1d1b837",
   "created": "2026-11-09T04:30:08.705Z",
   "modified": "2026-11-09T04:30:08.705Z",
   "name": "APT37",
   "aliases": [
    "APT 37",
    "APT-C-28",
    "ATK4",
    "G0067",
    "Group 123",
    "Group123",
    "InkySquid",
    "Moldy Pisces",
    "Operation Daybreak",
    "Operation Erebus",
    "PLAIN NEPTUNE",
    "Reaper",
    "Reaper Group",
    "Red Eyes",
    "Ricochet Chollima",
    "ScarCruft",
    "TEMP.Reaper",
    "Venus 121"
   ],
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "G0067",
     "url": "https://attack.mitre.org/groups/G0067/"
    },
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/apt37/"
    }
   ],
   "description": "APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea. In 2017, APT37 expanded its targeting beyond the Korean peninsula to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--02c303aa-d0a6-5130-bbee-416e070f1828",
   "created": "2026-11-08T21:16:16.707Z",
   "modified": "2026-11-08T21:16:16.707Z",
   "relationship_type": "related-to",
   "source_ref": "incident--91b0e4ed-1cae-581b-804b-aaed6cc8a5f8",
   "target_ref": "intrusion-set--4e396b0b-8285-592f-aca9-1f2ac1d1b837",
   "description": "attribution"
  }
 ]
}