{
    "type": "bundle",
    "id": "bundle--73b10826-d04d-4a9e-b0e8-64924917c125",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--018ab958-b94d-441e-991f-a101a5144848",
            "created": "2023-03-08T12:51:42.869471Z",
            "modified": "2024-11-07T23:01:18.079469Z",
            "name": "SentinelOne",
            "identity_class": "organization"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--aeaad8ee-db98-4860-a37f-54618d79d2e7",
            "value": "142.11.209.144"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--8b556e06-b4eb-47ee-8b43-c208b7f6dd0f",
            "value": "104.168.214.151"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--aee07b4a-10db-4491-b614-baca2f050ac8",
            "value": "23.254.226.90"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--81e15b0d-8d0f-49bd-84e0-54434be33453",
            "hashes": {
                "MD5": "470275eaf344be97f9950c4c42a783ef",
                "SHA-1": "43f987c15ae67b1183c4c442dc3b784faf2df090",
                "SHA-256": "2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--225559fa-2bf4-4f7e-93a1-5cf3e6103601",
            "hashes": {
                "MD5": "d8011dcca570689d72064b156647fa82",
                "SHA-1": "060a5d189ccf3fc32a758f1e218f814f6ce81744",
                "SHA-256": "c7f4aa77be7f7afe9d0665d3e705dbf7794bc479bb9c44488c7bf4169f8d14fe"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--70aa8f0e-4e0d-4df6-bd24-deb9c0ef0423",
            "hashes": {
                "MD5": "9ca5df575e5bd60035202dabd67b7af2",
                "SHA-1": "d28830d87fc71091f003818ef08ff0b723b3f358",
                "SHA-256": "3ea2ead8f3cec030906dcbffe3efd5c5d77d5d375d4a54cca03bfe8a6cb59940"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--18bc8e30-6c58-4ba6-bcae-de596e157ed5",
            "hashes": {
                "MD5": "1fddf14984c6b57358401a4587e7b950",
                "SHA-1": "be903ded39cbc8332cefd9ebbe7a66d95e9d6522",
                "SHA-256": "c9a7b42c7b29ca948160f95f017e9e9ae781f3b981ecf6edbac943e52c63ffc8"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--32190ea7-8d08-452e-bb88-95c364042c1f",
            "hashes": {
                "MD5": "973225dc83f568ef6208d49fe2648fc0",
                "SHA-1": "e68bfa72a4b4289a4cc688e81f9282b1f78ebc1f",
                "SHA-256": "927b3564c1cf884d2a05e1d7bd24362ce8563a1e9b85be776190ab7f8af192f6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--49ed03bb-d838-4b41-b827-652e13c9b8da",
            "hashes": {
                "MD5": "9294648d744703cfa0456ec74d014fe4",
                "SHA-1": "79337ccda23c67f8cfd9f43a6d3cf05fd01d1588",
                "SHA-256": "8bfa4fe0534c0062393b6a2597c3491f7df3bf2eabfe06544c53bdf1f38db6d4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8b24ae9a-ff4a-4071-875b-b69b81afa434",
            "hashes": {
                "MD5": "b58dce1b81357a78b49546468f3adbe1",
                "SHA-1": "8f6c52d7e82fbfdead3d66ad8c52b372cc9e8b18",
                "SHA-256": "f91801b458d875cfe61f927d16202b3a853d07e89a66ca4663989878e94242ad"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d1411d2c-7c48-436c-ad70-0ed695a36798",
            "hashes": {
                "MD5": "2df15cbc4367b5806e8a3c6abf88abdf",
                "SHA-1": "8d5d214c490eae8f61325839fcc17277e514301e",
                "SHA-256": "1d6cf7159c8dd98299798b0985f62dd15cb2e64550cd57a9e747dc3bee5f46d8"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--aef73c4a-92f3-4c9f-8f06-714ebd8369be",
            "hashes": {
                "MD5": "447fa7141877e0f01fa191b70791dfbf",
                "SHA-1": "62267b88fa6393bc1f1eeb778e4da6b564b7011e",
                "SHA-256": "d57a2e0c42c63659d6c09fc593fd5d272aec75b3629d9993b760142c731a191d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1d35a9b3-655f-44ef-8b8d-0ba6c42ce683",
            "hashes": {
                "MD5": "f8fdfb1d21eaebaeaa117b041d42447a",
                "SHA-1": "c45f514a252632cb3851fe45bed34b175370d594",
                "SHA-256": "c99729c39d197dd774e6febab5ec33abdf31f4404b4ffadad553efb3aa86192d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9bed8acb-691e-41c2-b005-bfa557608a73",
            "hashes": {
                "MD5": "749da6c3a50f60f3636443275118b20f",
                "SHA-1": "e77270ac0ea05496dd5a2fbccba3e24eb9b863d9",
                "SHA-256": "0753859738620c7394f04220e273974982203a6ea1c2a30247149a9c8ff07037"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3f27fb31-fb83-42c2-9112-00bf5806087a",
            "hashes": {
                "MD5": "056b1d9ce628efe6128e17cddab3811e",
                "SHA-1": "ac336c5082c2606ab8c3fb023949dfc0db2064d5",
                "SHA-256": "d2d60f678d0b881b3e079b46bdb813f9f7d8802a227aea46926e4bbd1838f9e5"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5f4a0461-a248-406e-9a1e-5a6065b7ee67",
            "hashes": {
                "MD5": "90385d612877e9d360196770d73d22d6",
                "SHA-1": "09ade0cb777f4a4e0682309a4bc1d0f7d4d7a036",
                "SHA-256": "47b8b4d55d75505d617e53afcb6c32dd817024be209116f98cbbc3d88e57b4d1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--dc9e6333-1762-4be0-b428-2209c628adda",
            "hashes": {
                "MD5": "b1e01ae0006f449781a05f4704546b34",
                "SHA-1": "884cebf1ad0e65f4da60c04bc31f62f796f90d79",
                "SHA-256": "36001b8b9e05935756fa7525dd49d91b59ea882efe5a2d23ccec35fef96138d4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--577cc759-b466-4602-9f26-b3a1c45fa9b5",
            "hashes": {
                "MD5": "3b3b3b9f7c71fcd7239abe90c97751c0",
                "SHA-1": "5c93052713f317431bf232a2894658a3a4ebfad9",
                "SHA-256": "c556baaac706191ce75c9263b349242caa3d8efca7b5639896fa3e6570d7c76e"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--fc08c8af-f138-4aaa-99f4-256282877f34",
            "value": "on-global.xyz"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--dbbc63b5-76b2-4f1a-8990-525f1a3e7086",
            "hashes": {
                "MD5": "1c817e846021bef433701a9815f906e8",
                "SHA-1": "e275deb68cdff336cb4175819a09dbaf0e1b68f6",
                "SHA-256": "2ade7f8def7eceba3e8f0e5d29d0a19626bfc595aeb1ed95b7404210569c6304"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8ffb93ae-69b4-4676-bddb-062d02fa00f8",
            "hashes": {
                "MD5": "e45394036e56637192bcc44d02bb00d9",
                "SHA-1": "26ec4630b4d1116e131c8e2002e9a3ec7494a5cf",
                "SHA-256": "015c4b621ae7161417b59c0ca24249a0680504107a9069128d2a8ba32ef21ada"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ddaf3c4b-5437-40d9-9b7b-67cfa001c9ef",
            "hashes": {
                "MD5": "21e936d8e48f4b634222258e4bf52c7c",
                "SHA-1": "a1a8a855f64a6b530f5116a3785a693d78ec09c0",
                "SHA-256": "8a8de435d71cb0b0ae6d4b15d58b7c85ce3ef8f06b24266c52b2bc49217be257"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--97d39533-bc58-4512-bc16-7fbb727273df",
            "hashes": {
                "MD5": "8c1a9b0855c4d026333988e323d22539",
                "SHA-1": "c806c7006950dea6c20d3d2800fe46d9350266b6",
                "SHA-256": "e9798b790d40d189586700482b8e2f55193a4c01d1ee9b54bd11a3f59bb67385"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--23e253b2-a99e-4d58-9973-e55c77fb9cb2",
            "hashes": {
                "MD5": "5d0df3f506138b4ba7c7bb1f22b3abd5",
                "SHA-1": "9f97edbc1454ef66d6095f979502d17067215a9d",
                "SHA-256": "55039ec59463982073cc129c06f1347738d06f8abf6dc86c631f8a83a5997eec"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--bc51a4bb-2c49-48e9-801e-8221505ba4ec",
            "hashes": {
                "MD5": "015c5d12273dde42fd0a17985ee9a1cd",
                "SHA-1": "ce3705baf097cd95f8f696f330372dd00996d29a",
                "SHA-256": "544891c71c30ab4d883f0548a17891aed1b33fcd6e423da8c20d1ce8a3161aff"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--eeed8ddb-7119-46d4-928f-d31c2b718611",
            "hashes": {
                "MD5": "d13989c3dafb32aaa59f6c12783733c9",
                "SHA-1": "3c887ece654ea46b1778d3c7a8a6a7c7c7cfa61c",
                "SHA-256": "ccdddfebb725c75668958401c296d060e3035a9dd9d304dada258d3515c010db"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--42c04370-eedc-4ef6-af21-b69ca3bb9754",
            "hashes": {
                "MD5": "541341fc477523fed26e8b7edec1c6bb",
                "SHA-1": "46ac6dc34fc164525e6f7886c8ed5a79654f3fd3",
                "SHA-256": "51dd4efcf714e64b4ad472ea556bf1a017f40a193a647b9e28bf356979651077"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--30267f09-6f99-45f2-a4d9-7bd1f6532623",
            "hashes": {
                "MD5": "a4963b1b9468027d78273e86a1793c1b",
                "SHA-1": "e244ff1d8e66558a443610200476f98f653b8519",
                "SHA-256": "6a1196f3ff2e331ae1e64ac38922ee078fdcc174ec05b71b6526ff501f19250a"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--f123f178-9bc3-4989-9f20-47bbf6f132fd",
            "value": "http://on-global.xyz/Of56cYsfVV8/OJITWH2WFx/Jy5S7hSx0K/fP7saoiPBc/A%3D%3D"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--eca1c2a6-7b34-43ba-a340-bba6ccf82c8f",
            "value": "https://swissborg.blog/tx/10299301992/hash"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--a21162a8-f9dc-4b86-a76d-cde28ca0cf51",
            "value": "http://docs-send.online/getBalance/usdt/ethereum"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--01b16d11-a50c-4abd-82a0-1ec4379c3e5c",
            "value": "http://tp-globa.xyz/OdhLca1mLUp/lZ5rZPxWsh/7yZKYQI43S/fP7savDX6c/bfC"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--9f6e7799-0656-4304-b0fb-a9fe7f1af63b",
            "value": "tp.globa.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--53ec4479-8287-4c4a-b89d-1f95bb01fa95",
            "value": "docs-send.online"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--65b26604-c9ea-4f80-a480-2c6fda6e6d84",
            "value": "http://swissborg.blog/zxcv/bnm"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d0bec29f-e067-45bb-b95d-f9ecc1f03673",
            "value": "swissborg.blog"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--fbf5f072-88f5-4a66-8d09-6492e64e78d4",
            "value": "tp-globa.xyz"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--b03c3a07-d86c-40d7-a057-ca7eb7c5ced8",
            "value": "192.119.64.43"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--f7f0d913-f17b-5632-a48a-76b4eef8a1cb",
            "created": "2026-10-10T15:04:40.76285Z",
            "modified": "2026-10-10T15:04:40.76285Z",
            "name": "Bluenoroff"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--961f61a1-e9b8-46ac-9c81-618cfcd0d68b",
            "created_by_ref": "identity--018ab958-b94d-441e-991f-a101a5144848",
            "created": "2026-10-10T15:04:40.764514Z",
            "modified": "2026-10-10T15:04:40.764514Z",
            "name": "DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads",
            "published": "2023-11-27T00:00:00Z",
            "object_refs": [
                "identity--018ab958-b94d-441e-991f-a101a5144848",
                "ipv4-addr--aeaad8ee-db98-4860-a37f-54618d79d2e7",
                "ipv4-addr--8b556e06-b4eb-47ee-8b43-c208b7f6dd0f",
                "ipv4-addr--aee07b4a-10db-4491-b614-baca2f050ac8",
                "file--81e15b0d-8d0f-49bd-84e0-54434be33453",
                "file--225559fa-2bf4-4f7e-93a1-5cf3e6103601",
                "file--70aa8f0e-4e0d-4df6-bd24-deb9c0ef0423",
                "file--18bc8e30-6c58-4ba6-bcae-de596e157ed5",
                "file--32190ea7-8d08-452e-bb88-95c364042c1f",
                "file--49ed03bb-d838-4b41-b827-652e13c9b8da",
                "file--8b24ae9a-ff4a-4071-875b-b69b81afa434",
                "file--d1411d2c-7c48-436c-ad70-0ed695a36798",
                "file--aef73c4a-92f3-4c9f-8f06-714ebd8369be",
                "file--1d35a9b3-655f-44ef-8b8d-0ba6c42ce683",
                "file--9bed8acb-691e-41c2-b005-bfa557608a73",
                "file--3f27fb31-fb83-42c2-9112-00bf5806087a",
                "file--5f4a0461-a248-406e-9a1e-5a6065b7ee67",
                "file--dc9e6333-1762-4be0-b428-2209c628adda",
                "file--577cc759-b466-4602-9f26-b3a1c45fa9b5",
                "domain-name--fc08c8af-f138-4aaa-99f4-256282877f34",
                "file--dbbc63b5-76b2-4f1a-8990-525f1a3e7086",
                "file--8ffb93ae-69b4-4676-bddb-062d02fa00f8",
                "file--ddaf3c4b-5437-40d9-9b7b-67cfa001c9ef",
                "file--97d39533-bc58-4512-bc16-7fbb727273df",
                "file--23e253b2-a99e-4d58-9973-e55c77fb9cb2",
                "file--bc51a4bb-2c49-48e9-801e-8221505ba4ec",
                "file--eeed8ddb-7119-46d4-928f-d31c2b718611",
                "file--42c04370-eedc-4ef6-af21-b69ca3bb9754",
                "file--30267f09-6f99-45f2-a4d9-7bd1f6532623",
                "url--f123f178-9bc3-4989-9f20-47bbf6f132fd",
                "url--eca1c2a6-7b34-43ba-a340-bba6ccf82c8f",
                "url--a21162a8-f9dc-4b86-a76d-cde28ca0cf51",
                "url--01b16d11-a50c-4abd-82a0-1ec4379c3e5c",
                "domain-name--9f6e7799-0656-4304-b0fb-a9fe7f1af63b",
                "domain-name--53ec4479-8287-4c4a-b89d-1f95bb01fa95",
                "url--65b26604-c9ea-4f80-a480-2c6fda6e6d84",
                "domain-name--d0bec29f-e067-45bb-b95d-f9ecc1f03673",
                "domain-name--fbf5f072-88f5-4a66-8d09-6492e64e78d4",
                "ipv4-addr--b03c3a07-d86c-40d7-a057-ca7eb7c5ced8",
                "threat-actor--f7f0d913-f17b-5632-a48a-76b4eef8a1cb"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.sentinelone.com/blog/dprk-crypto-theft-macos-rustbucket-droppers-pivot-to-deliver-kandykorn-payloads/"
                }
            ]
        }
    ]
}