{
    "type": "bundle",
    "id": "bundle--39ded335-fe29-41fc-8fc1-676e9e260b07",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--a8d58fde-d21c-496d-a3ff-84409afef5b4",
            "created": "2023-03-08T12:51:56.363175Z",
            "modified": "2024-08-19T10:06:03.021098Z",
            "name": "Qianxin",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--728a0fb4-b9e8-48bf-ad4c-252cec2b6f1b",
            "hashes": {
                "MD5": "199674e87f437bdbd68884b155346d25",
                "SHA-1": "e8ff4264da0e3b774dee6575ad7b57fcb883b471",
                "SHA-256": "4252c0b130be39bf2258c84c436c17babfd650b6d665ac6c4e050f87fe34e46e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--89adfa51-ef75-49b6-a970-b05ee745ebb0",
            "hashes": {
                "MD5": "14b95dc99e797c6c717bf68440eae720",
                "SHA-1": "4906bcba2a92d8719799515d64710d815ee05b77",
                "SHA-256": "2b0565b5117895e296e67e480953c90c68bd6fa2a08fc99f7a490b77509d8acf"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9520a1a8-5c1e-44b0-a6ad-938127379665",
            "hashes": {
                "MD5": "10b9702f8096afa8c928de6507f7ecfe",
                "SHA-1": "9bc66fae5b7165e51fda2294223542f6960c131b",
                "SHA-256": "4a84eef46a1c579d94e35c35cb3befca9af6bb560f484f9f580c3ae6e0b0e3c6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9e70048f-bdc0-48dc-b0a4-217b382756d7",
            "hashes": {
                "MD5": "3a4ab11b25961becece1c358029ba611",
                "SHA-1": "abf6c901309f7a1a30380ff48fd870227c884a1b",
                "SHA-256": "3df07235793c8b7c850c173c4b29e9711a1ef71111d1034daf11a24335fcbc79"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6984e4b2-5577-4f21-bf8c-e5f07f39018a",
            "hashes": {
                "MD5": "80a2bb7884b8bad4a8e83c2cb03ee343",
                "SHA-1": "6620029006c7174987ddcbe48dc0d4ceb6fe584c",
                "SHA-256": "f8e972a26117bd14f5ec4dca9de0244d0bfd29bbbfd9104b2ccdc49fa93416d8"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--10e238ea-e2ee-4812-88bb-6128ccea5f4b",
            "value": "http://pootbal.med/ianewsonline.com/ro/ki.txt"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--75ce4c56-6792-4e4e-97dc-9549699a32ee",
            "value": "pootbal.med"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1",
            "created": "2026-10-09T12:02:50.919863Z",
            "modified": "2026-10-09T12:02:50.919863Z",
            "name": "Kimsuky"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--d2568b86-2eca-4197-b090-70a23dd08172",
            "created_by_ref": "identity--a8d58fde-d21c-496d-a3ff-84409afef5b4",
            "created": "2026-10-09T12:02:50.920153Z",
            "modified": "2026-10-09T12:02:50.920153Z",
            "name": "\u7591\u4f3cKimsuky APT\u7ec4\u7ec7\u5229\u7528\u97e9\u56fd\u5916\u4ea4\u90e8\u4e3a\u8bf1\u9975\u7684\u653b\u51fb\u6d3b\u52a8\u5206\u6790",
            "published": "2021-05-06T00:00:00Z",
            "object_refs": [
                "identity--a8d58fde-d21c-496d-a3ff-84409afef5b4",
                "file--728a0fb4-b9e8-48bf-ad4c-252cec2b6f1b",
                "file--89adfa51-ef75-49b6-a970-b05ee745ebb0",
                "file--9520a1a8-5c1e-44b0-a6ad-938127379665",
                "file--9e70048f-bdc0-48dc-b0a4-217b382756d7",
                "file--6984e4b2-5577-4f21-bf8c-e5f07f39018a",
                "url--10e238ea-e2ee-4812-88bb-6128ccea5f4b",
                "domain-name--75ce4c56-6792-4e4e-97dc-9549699a32ee",
                "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://ti.qianxin.com/blog/articles/Analysis-on-the-attack-activities-of-Kimsuky-APT-using-the-Foreign-Ministry-of-South-Korea-as-bait/"
                }
            ]
        }
    ]
}