{
 "type": "bundle",
 "id": "bundle--a4c2e7f0-8e84-406b-98fc-988f1ded8850",
 "objects": [
  {
   "type": "marking-definition",
   "spec_version": "2.1",
   "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
   "created": "2017-01-20T00:00:00.000Z",
   "definition_type": "tlp",
   "name": "TLP:WHITE",
   "definition": {
    "tlp": "white"
   }
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "SecurityStudies.info",
   "identity_class": "organization",
   "description": "Open-source security intelligence on Asia-Pacific. Incidents are detected by rules in the news unless marked curated."
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "incident",
   "id": "incident--8da29e79-0082-5823-b874-886f01521c8d",
   "created": "2026-11-08T21:16:16.716Z",
   "modified": "2026-11-10T16:26:37.587Z",
   "name": "Three threat clusters exploit Cisco Secure FMC flaws to steal credentials and deploy Qilin ransomware",
   "description": "Cisco Talos identified three distinct clusters exploiting CVE-2026-20079, a CVSS 10.0 authentication bypass in Cisco Secure Firewall Management Center, alongside the lower-severity CVE-2026-20316. UAT-12197 deployed JSP web shells and Java command executors to harvest credentials and authentication data from internal databases; UAT-11823 delivered reverse shells and configuration harvesting scripts and deployed Cyclops Blink, previously attributed to Russian state-sponsored Sandworm; UAT-11988 used legitimate FMC tooling for reconnaissance and credential collection before deploying Qilin ransomware. CISA added CVE-2026-20079 to the KEV catalog on 9 September 2026 with a 12 September federal deadline.",
   "confidence": 50,
   "labels": [
    "ransomware",
    "curated"
   ],
   "external_references": [
    {
     "source_name": "securitystudies.info",
     "url": "https://securitystudies.info/cyber/incidents/three-threat-clusters-exploit-cisco-secure-fmc-flaws-to-steal-credentials-and-deploy-qilin-ransomware/"
    },
    {
     "source_name": "source",
     "url": "https://thehackernews.com/2026/09/cisco-fmc-flaws-exploited-to-steal.html"
    },
    {
     "source_name": "source",
     "url": "https://securityaffairs.com/198884/cyber-crime/attackers-exploit-critical-cisco-fmc-flaw-to-deploy-qilin-ransomware.html"
    },
    {
     "source_name": "source",
     "url": "https://www.cisa.gov/news-events/alerts/2026/09/09/cisa-adds-three-known-exploited-vulnerabilities-catalog"
    }
   ],
   "x_securitystudies_occurred_on": "2026-08-15",
   "x_securitystudies_severity": 5,
   "x_securitystudies_status": "curated",
   "x_securitystudies_sectors": [
    "Technology",
    "Critical Infrastructure",
    "Government",
    "Financial Services"
   ],
   "x_securitystudies_eu_relevance": "high"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "United States",
   "country": "US"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--17605ae0-95ba-5855-9399-554213716d97",
   "created": "2026-11-08T21:16:16.716Z",
   "modified": "2026-11-08T21:16:16.716Z",
   "relationship_type": "related-to",
   "source_ref": "incident--8da29e79-0082-5823-b874-886f01521c8d",
   "target_ref": "location--b3751652-d71d-531c-bcee-513adc9d0b87",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--41ac0fa7-2d80-5bda-afc1-65273a433364",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "United Kingdom",
   "country": "GB"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--8afda179-e386-520e-9d50-139939763d98",
   "created": "2026-11-08T21:16:16.716Z",
   "modified": "2026-11-08T21:16:16.716Z",
   "relationship_type": "related-to",
   "source_ref": "incident--8da29e79-0082-5823-b874-886f01521c8d",
   "target_ref": "location--41ac0fa7-2d80-5bda-afc1-65273a433364",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--985edf3b-bbdc-5fce-808b-4e4869bff566",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Germany",
   "country": "DE"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--ace93ef1-0e87-532c-96b6-ee889dfbb28a",
   "created": "2026-11-08T21:16:16.716Z",
   "modified": "2026-11-08T21:16:16.716Z",
   "relationship_type": "related-to",
   "source_ref": "incident--8da29e79-0082-5823-b874-886f01521c8d",
   "target_ref": "location--985edf3b-bbdc-5fce-808b-4e4869bff566",
   "description": "country named in the coverage"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "location",
   "id": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "created": "2026-11-10T00:00:00.000Z",
   "modified": "2026-11-10T00:00:00.000Z",
   "name": "Australia",
   "country": "AU"
  },
  {
   "spec_version": "2.1",
   "created_by_ref": "identity--ad5643e6-164f-562c-87ee-e2b5840970aa",
   "object_marking_refs": [
    "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
   ],
   "type": "relationship",
   "id": "relationship--bf715ab9-663b-51d6-bc29-4d565ea0a3de",
   "created": "2026-11-08T21:16:16.716Z",
   "modified": "2026-11-08T21:16:16.716Z",
   "relationship_type": "related-to",
   "source_ref": "incident--8da29e79-0082-5823-b874-886f01521c8d",
   "target_ref": "location--982fc425-3b6a-5dbb-9934-af733bbc405c",
   "description": "affected country"
  }
 ]
}