{
    "type": "bundle",
    "id": "bundle--5a3c7b24-6521-4e5c-9e2f-7029fae02426",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--5d199e7e-198c-47e8-ad62-397e3bd362e2",
            "created": "2023-03-08T12:51:51.400428Z",
            "modified": "2024-08-19T23:43:12.521753Z",
            "name": "Group-IB",
            "identity_class": "organization"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--44dd15ba-6ee0-4932-859d-cce03bb77f20",
            "value": "95.164.17.24"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--54fa35c4-d57e-43a6-8463-28213d33c572",
            "value": "185.235.241.208"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--331a5876-6eb1-4cc2-aed3-4310f44e3bcd",
            "hashes": {
                "MD5": "8ebca0b7ef7dbfc14da3ee39f478e880",
                "SHA-1": "5cce14436b3ae5315feec2e12ce6121186f597b3",
                "SHA-256": "36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2fb3b0a1-e883-490e-94bd-3b1d74d4e404",
            "hashes": {
                "MD5": "ed60b3913e6694f4a0ed2fe25551bd1f",
                "SHA-1": "18a2ee2fcd433f0fe27e0b6fc13bdfc890fc637b",
                "SHA-256": "0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4178bd2d-8966-4867-8c2c-08864d42a33b",
            "hashes": {
                "MD5": "b9693b6541a22d01b100b867375279e6",
                "SHA-1": "69a65e7a28be4f924f5fdf79ea08f050dac760ac",
                "SHA-256": "d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--17fca09a-e3cf-4735-923a-7144c2f56ee8",
            "hashes": {
                "MD5": "dc77044fe8d35882015eaa99ca31f826",
                "SHA-1": "29d360a46ad5e3ef65d8df81456f54af64e3463f",
                "SHA-256": "fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
            "created": "2026-09-19T09:45:49.911174Z",
            "modified": "2026-09-19T09:45:49.911174Z",
            "name": "Lazarus"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--5c270689-1dc1-469d-a34a-1b3602b30b5e",
            "created_by_ref": "identity--5d199e7e-198c-47e8-ad62-397e3bd362e2",
            "created": "2026-09-19T09:45:49.911461Z",
            "modified": "2026-09-19T09:45:49.911461Z",
            "name": "Group-IB researchers noticed a Windows version of BeaverTail, which was attributed to Lazarus",
            "published": "2024-08-13T00:00:00Z",
            "object_refs": [
                "identity--5d199e7e-198c-47e8-ad62-397e3bd362e2",
                "ipv4-addr--44dd15ba-6ee0-4932-859d-cce03bb77f20",
                "ipv4-addr--54fa35c4-d57e-43a6-8463-28213d33c572",
                "file--331a5876-6eb1-4cc2-aed3-4310f44e3bcd",
                "file--2fb3b0a1-e883-490e-94bd-3b1d74d4e404",
                "file--4178bd2d-8966-4867-8c2c-08864d42a33b",
                "file--17fca09a-e3cf-4735-923a-7144c2f56ee8",
                "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://archive.is/4xEa8"
                }
            ]
        }
    ]
}