{
    "type": "bundle",
    "id": "bundle--b24b4f8d-2509-4abf-b5b1-369a26ad423b",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--d6060d27-a078-4b68-808e-0f825436ce05",
            "created": "2025-02-20T01:00:01.713031Z",
            "modified": "2025-02-20T01:01:57.020342Z",
            "name": "ENKI",
            "identity_class": "organization"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--8b252eaa-1b19-47f7-b8b5-46b7e0b00933",
            "created": "2026-07-21T20:59:18.288859Z",
            "modified": "2026-07-21T20:59:18.288859Z",
            "name": "YARA Rule",
            "pattern": "rule BirdTroy_Linux {\n meta:\n  description = \"BirdTroy - Go-based Linux backdoor (Bird/module namespace)\"\n  date = \"2026-05-28\"\n  hash1 = \"ca98a51cebdc802d255030b4baa44ca0\"\n  hash2 = \"c2e37232556357944a04edf1dec3934b\"\n strings:\n  $ns1 = \"Bird/module/packet.\"\n  $ns2 = \"Bird/module/autorun.\"\n  $ns3 = \"Bird/module/shell.\"\n  $ns4 = \"Bird/module/protocol.\"\n  $resp1 = \"success upload file\"\n  $resp2 = \"usege: sleep [hour]\"\n  $resp3 = \"delete success\"\n  $code_bswap = { 8B 00 00 0F C8 48 81 C4 B8 00 00 00 00 00 00 5D C3 }\n condition:\n  uint32(0) == 0x464C457F and (3 of ($ns*) or (2 of ($resp*) and 1 of ($ns*)) or ($code_bswap and 1 of ($ns*)))\n}",
            "pattern_type": "yara",
            "valid_from": "2026-07-20T00:00:00Z"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--194a26d1-0bc8-4f84-abae-2792c8aef735",
            "value": "vcenter.secmail@gmail.com"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--474b8eb3-4e3f-448b-9ee2-ee9f48562a33",
            "value": "https://69.10.50.165:8443"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--97095083-51a7-4c08-9eb5-c169a3012b62",
            "value": "https://oauth.shacloud.o-r.kr:8443"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--0e6c68d0-dfe2-48e3-afb2-9decbefa34b1",
            "value": "http://www.ilskdeid.o-r.kr:8000/"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--498f5c2a-438a-45a9-998e-01c009004d2c",
            "value": "https://global.webjine.o-r.kr/index.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--e94ddd82-2e10-4aa9-a20f-e1efc2acf31c",
            "value": "https://oobe.webjine.o-r.kr/index.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--8034d118-5799-408f-af71-d987dc97ed5f",
            "value": "https://commit.hanbiro.o-r.kr/index.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--13b197ee-e4d8-4911-a71d-77d01393053a",
            "value": "https://auth.samecloud.o-r.kr/index.php"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--00f1a145-0038-4610-b7ec-e5f7c3c65199",
            "value": "163.245.195.172"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--a850ea5f-74cd-49b9-9a6f-13b23ca20240",
            "value": "208.73.202.29"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--fa85fcf8-7375-41d5-b95c-fce877e3ada5",
            "value": "69.10.50.165"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2b5188b4-1c0d-4e08-b8ba-ed8dcbd4fc49",
            "hashes": {
                "MD5": "dff787bce68c7653495f153c0534cb96"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3325664c-44d8-4603-a6e0-9f3892b848b0",
            "hashes": {
                "MD5": "633c3076c396f2200048d1b62da204d2"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--41d6072a-900a-4b94-9c44-2d43517e0e24",
            "hashes": {
                "MD5": "a452a860f973c7a43ea804c17e9427d2"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6442b66e-a785-43cd-96a5-16ec82050b7d",
            "hashes": {
                "MD5": "c2e37232556357944a04edf1dec3934b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--06a38216-1bd5-42f0-8318-05191d4e4fe9",
            "hashes": {
                "MD5": "ca98a51cebdc802d255030b4baa44ca0"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1c0fe38b-e21e-4359-be28-29959795ea74",
            "hashes": {
                "MD5": "aa61e76255a6e13313439655bc02bdf5"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8e85cef3-f068-4349-a3af-4bfd88546956",
            "hashes": {
                "MD5": "e911f8f7c49476806ada37f3ebb7a28a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ff69c2b6-c08b-4456-9a47-65770a1ceb22",
            "hashes": {
                "MD5": "84e9b066bebd49036b7fc71b5f5f8d83"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2fafc3bf-b35c-42c8-803e-fec032b25fb8",
            "hashes": {
                "MD5": "b1c72139f2cdd9419562369fc6ced4fc"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a2559b50-8139-4837-9a85-ddaa63d5a466",
            "hashes": {
                "MD5": "e6c6fa32da47d9341b778bfa424abb4c"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1",
            "created": "2026-07-21T20:59:18.291974Z",
            "modified": "2026-07-21T20:59:18.291974Z",
            "name": "Kimsuky"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--cc7d5970-8877-4915-86e2-e6b11a81d07c",
            "created_by_ref": "identity--d6060d27-a078-4b68-808e-0f825436ce05",
            "created": "2026-07-21T20:59:18.293534Z",
            "modified": "2026-07-21T20:59:18.293534Z",
            "name": "Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant",
            "published": "2026-07-20T00:00:00Z",
            "object_refs": [
                "identity--d6060d27-a078-4b68-808e-0f825436ce05",
                "indicator--8b252eaa-1b19-47f7-b8b5-46b7e0b00933",
                "email-addr--194a26d1-0bc8-4f84-abae-2792c8aef735",
                "url--474b8eb3-4e3f-448b-9ee2-ee9f48562a33",
                "url--97095083-51a7-4c08-9eb5-c169a3012b62",
                "url--0e6c68d0-dfe2-48e3-afb2-9decbefa34b1",
                "url--498f5c2a-438a-45a9-998e-01c009004d2c",
                "url--e94ddd82-2e10-4aa9-a20f-e1efc2acf31c",
                "url--8034d118-5799-408f-af71-d987dc97ed5f",
                "url--13b197ee-e4d8-4911-a71d-77d01393053a",
                "ipv4-addr--00f1a145-0038-4610-b7ec-e5f7c3c65199",
                "ipv4-addr--a850ea5f-74cd-49b9-9a6f-13b23ca20240",
                "ipv4-addr--fa85fcf8-7375-41d5-b95c-fce877e3ada5",
                "file--2b5188b4-1c0d-4e08-b8ba-ed8dcbd4fc49",
                "file--3325664c-44d8-4603-a6e0-9f3892b848b0",
                "file--41d6072a-900a-4b94-9c44-2d43517e0e24",
                "file--6442b66e-a785-43cd-96a5-16ec82050b7d",
                "file--06a38216-1bd5-42f0-8318-05191d4e4fe9",
                "file--1c0fe38b-e21e-4359-be28-29959795ea74",
                "file--8e85cef3-f068-4349-a3af-4bfd88546956",
                "file--ff69c2b6-c08b-4456-9a47-65770a1ceb22",
                "file--2fafc3bf-b35c-42c8-803e-fec032b25fb8",
                "file--a2559b50-8139-4837-9a85-ddaa63d5a466",
                "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.enki.co.kr/en/media-center/blog/analysis-of-kimsuky-s-attack-on-a-south-korean-groupware-vendor-using-a-new-gomir-family-variant"
                }
            ]
        }
    ]
}