{
 "type": "bundle",
 "id": "bundle--8b1227f1-fa12-438c-b643-de804a7b6494",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--56f903a0-faf9-553d-8ee8-6b13b9ced2d6",
   "created": "2026-11-11T20:35:30.031Z",
   "modified": "2026-11-13T00:02:47.760Z",
   "name": "Targeting the moment of receiving configuration files... China-linked hackers manipulate DNS of Chinese input method 'Sogou' to install backdoor",
   "description": "Detected automatically from 1 article in 1 outlet (Boannews (Korean)), Nov 10, 2026. Title machine-translated from Korean. Type: espionage campaign. Read the sources before relying on any of it: no analyst has reviewed this entry unless it says so.",
   "confidence": 15,
   "labels": [
    "espionage",
    "detected-unreviewed"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/targeting-the-moment-of-receiving-configuration-files-china-linked-hac-20261110/"
    },
    {
     "source_name": "Boannews (Korean)",
     "url": "https://www.boannews.com/news/articleView.html?idxno=147016",
     "description": "설정 파일 받는 순간 노려... 중국 연계 해커, 중국어 입력기 ‘소거우’ DNS 조작해 백도어 설치"
    }
   ],
   "x_securitystudies_occurred_on": "2026-11-10",
   "x_securitystudies_severity": 3,
   "x_securitystudies_status": "detected-unreviewed",
   "x_securitystudies_sectors": [],
   "x_securitystudies_eu_relevance": "low"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "intrusion-set",
   "id": "intrusion-set--ac69eb97-1be5-5ea5-a5ac-20e4a16f9b49",
   "created": "2026-11-09T04:30:05.297Z",
   "modified": "2026-11-09T04:30:05.297Z",
   "name": "UNC3569",
   "aliases": [],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/actors/unc3569/"
    }
   ],
   "description": "China-nexus espionage actor that has been observed exploiting vulnerabilities in Aspera Faspex, Microsoft Exchange, and Oracle Web Applications Desktop Integrator, among others, to gain initial access to target environments. "
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--bba82882-24e9-5227-a2a6-a8ba4b1df7f1",
   "created": "2026-11-11T20:35:30.031Z",
   "modified": "2026-11-11T20:35:30.031Z",
   "relationship_type": "related-to",
   "source_ref": "incident--56f903a0-faf9-553d-8ee8-6b13b9ced2d6",
   "target_ref": "intrusion-set--ac69eb97-1be5-5ea5-a5ac-20e4a16f9b49",
   "description": "actor named in the coverage (the sources' attribution)"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "vulnerability",
   "id": "vulnerability--9f4c69f1-58ce-541f-b4b1-0d1120faf7d6",
   "created": "2026-11-12T05:15:34.500Z",
   "modified": "2026-11-12T05:15:34.500Z",
   "name": "CVE-2026-120422",
   "external_references": [
    {
     "source_name": "cve",
     "external_id": "CVE-2026-120422"
    }
   ]
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--c7b93aa2-0404-5f88-9b27-ba6c82fd78a0",
   "created": "2026-11-11T20:35:30.031Z",
   "modified": "2026-11-11T20:35:30.031Z",
   "relationship_type": "related-to",
   "source_ref": "incident--56f903a0-faf9-553d-8ee8-6b13b9ced2d6",
   "target_ref": "vulnerability--9f4c69f1-58ce-541f-b4b1-0d1120faf7d6",
   "description": "vulnerability exploited"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "vulnerability",
   "id": "vulnerability--6f23c7aa-a4c0-5d30-a2b7-d14dee6130f8",
   "created": "2026-11-12T05:15:34.500Z",
   "modified": "2026-11-12T05:15:34.500Z",
   "name": "CVE-2026-51990",
   "external_references": [
    {
     "source_name": "cve",
     "external_id": "CVE-2026-51990"
    }
   ]
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--862c6066-3cb2-53b8-9db8-c80d2e2f8cb8",
   "created": "2026-11-11T20:35:30.031Z",
   "modified": "2026-11-11T20:35:30.031Z",
   "relationship_type": "related-to",
   "source_ref": "incident--56f903a0-faf9-553d-8ee8-6b13b9ced2d6",
   "target_ref": "vulnerability--6f23c7aa-a4c0-5d30-a2b7-d14dee6130f8",
   "description": "vulnerability exploited"
  }
 ]
}