{
 "type": "bundle",
 "id": "bundle--d722a2b8-037f-4870-ba7f-e6ae29f2366d",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--51e06f0c-b2a8-5e54-9c15-0e1109b3e9d3",
   "created": "2026-11-10T16:32:08.538Z",
   "modified": "2026-11-13T00:02:47.509Z",
   "name": "North Korea’s hackers supercharge crypto heists with AI skills",
   "description": "Detected automatically from 2 articles in 2 outlets (Taipei Times, The Japan Times), Nov 2, 2026. Type: cryptocurrency theft; sectors: cryptocurrency. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "crypto_theft",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/north-koreas-hackers-supercharge-crypto-heists-with-ai-skills-20261102/"
    },
    {
     "source_name": "The Japan Times",
     "url": "https://www.japantimes.co.jp/news/2026/11/02/asia-pacific/north-korea-hackers-crypto-heist-ai/",
     "description": "North Korea’s hackers supercharge crypto heists with AI skills"
    },
    {
     "source_name": "Taipei Times",
     "url": "https://www.taipeitimes.com/News/world/archives/2026/11/03/2003867075",
     "description": "North Korea supercharges crypto heists with AI skills"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-02",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [
    "Cryptocurrency"
   ],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--6d1328a3-2c4d-5dbf-8ff6-4cae78790d3a",
   "created": "2026-11-09T04:30:05.217Z",
   "modified": "2026-11-09T04:30:05.217Z",
   "name": "TraderTraitor",
   "aliases": [
    "Jade Sleet",
    "Pukchong",
    "UNC4899"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/tradertraitor/"
    }
   ],
   "description": "TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, intended to gain access to these start-up and high-tech companies. TraderTraitor may be the work of operators previously responsible for APT38 activity."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--bd0761b5-d7aa-5f5a-9abe-4978d2e8edcd",
   "created": "2026-11-10T16:32:08.538Z",
   "modified": "2026-11-10T16:32:08.538Z",
   "relationship_type": "related-to",
   "source_ref": "incident--51e06f0c-b2a8-5e54-9c15-0e1109b3e9d3",
   "target_ref": "intrusion-set--6d1328a3-2c4d-5dbf-8ff6-4cae78790d3a",
   "description": "actor named in the coverage (the sources' attribution)"
  }
 ]
}