{
    "type": "bundle",
    "id": "bundle--35c4ce94-267c-4e25-b3e5-2152357acd31",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--243c3ae6-45e8-41db-8bdd-4897aaae4670",
            "created": "2023-03-08T12:51:43.142167Z",
            "modified": "2023-05-13T00:24:09.959414Z",
            "name": "PolySwarm",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--abdad7ac-1cb1-49be-8035-ca1dabc15aa3",
            "hashes": {
                "MD5": "557551f8468b55e64af8969e71f9246f",
                "SHA-1": "2eaefd5a62a3a0d0181f1bee5a5aa0979fa51cf4",
                "SHA-256": "710f15302859c7af1c1e25219d704841b3fdbc48f16a5a574d5ab6cf4f4842e8"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--96ce9973-6a43-4aad-af68-c925cbf198a1",
            "hashes": {
                "MD5": "6f15a1f78380d204f7f2369749c72b4b",
                "SHA-1": "d32753d7dac47032f96542d6120f101a5cadbb39",
                "SHA-256": "62e040a32aac2d2faa8d2bffa2cf7ab662228cebf9bb78eaa0a633c0b729d119"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--59a024da-22d9-4891-9f7c-56bbf2e64169",
            "hashes": {
                "MD5": "ac468b5536a0b3f8c6b88968a7f3761f",
                "SHA-1": "111904fcc3e2f0fba7b24913a8f54d2b3fd9de06",
                "SHA-256": "6b33d20196267b0d64bca815ca863558d26b17cee77caf62a6cce8eae555ac8d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--22c923d5-44fe-4f5a-a6ee-9bd4e88f70e6",
            "hashes": {
                "MD5": "781e02b32ed5dff6e512d9850a5b5403",
                "SHA-1": "ea5cfdcab1e4894bebdb8f0a9652c4a4ae190933",
                "SHA-256": "37f5afb9ed3761e73feb95daceb7a1fdbb13c8b5fc1a2ba22e0ef7994c7920ef"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--76c75d43-6ec4-4976-b786-282a02f2601b",
            "hashes": {
                "MD5": "85766786fd00957737f1c88632ab9e0d",
                "SHA-1": "3142704d014ed89d1b4d538b6aa796bd371b6990",
                "SHA-256": "7a05188ab0129b0b4f38e2e7599c5c52149ce0131140db33feb251d926428d68"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6372bed2-cb11-44ab-a676-4399d5f82e3f",
            "hashes": {
                "MD5": "23c2569a65870a9e412d98d5b3bdc554",
                "SHA-1": "91def0a4dd9b35510d7f8897bc114f975a5d7e2b",
                "SHA-256": "159471e1abc9adf6733af9d24781fbf27a776b81d182901c2e04e28f3fe2e6f3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--dfbf3eb8-73d8-40fe-945f-08b29f4f46cb",
            "hashes": {
                "MD5": "75a46b23825ce7aa4ca297d93450f4e2",
                "SHA-1": "3b994549ab4fd9024b2f0155094d7aa43b70bb8f",
                "SHA-256": "aa4a2d1215f864481994234f13ab485b95150161b4566c180419d93dda7ac039"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a76512df-0293-4fe0-9b38-0b3c128950b7",
            "hashes": {
                "MD5": "40c45ad6fef563af8a73dd48a38dc8ba",
                "SHA-1": "81c744562d568a0e8a6938df0abc5fba7cfcb3b4",
                "SHA-256": "4f6ae0110cf652264293df571d66955f7109e3424a070423b5e50edc3eb43874"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--cff8908d-57a1-512f-bd0b-ed3caeeb6f2a",
            "created": "2026-07-21T08:56:47.068987Z",
            "modified": "2026-07-21T08:56:47.068987Z",
            "name": "UNC4736"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--07508793-2a33-5982-b040-9114591a8330",
            "created": "2026-07-21T08:56:47.07044Z",
            "modified": "2026-07-21T08:56:47.07044Z",
            "name": "CitrineSleet"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
            "created": "2026-07-21T08:56:47.071095Z",
            "modified": "2026-07-21T08:56:47.071095Z",
            "name": "Lazarus"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--f4dd489f-e0df-55ec-a8c4-fefc51964035",
            "created": "2026-07-21T08:56:47.07174Z",
            "modified": "2026-07-21T08:56:47.07174Z",
            "name": "GleamingPisces"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--3ed4d470-fd86-4839-bff6-1cc6ecf79a6d",
            "created_by_ref": "identity--243c3ae6-45e8-41db-8bdd-4897aaae4670",
            "created": "2026-07-21T08:56:47.075115Z",
            "modified": "2026-07-21T08:56:47.075115Z",
            "name": "Lazarus Expands Financial Espionage Operations With Memory-Resident RemotePE RAT",
            "published": "2026-05-29T00:00:00Z",
            "object_refs": [
                "identity--243c3ae6-45e8-41db-8bdd-4897aaae4670",
                "file--abdad7ac-1cb1-49be-8035-ca1dabc15aa3",
                "file--96ce9973-6a43-4aad-af68-c925cbf198a1",
                "file--59a024da-22d9-4891-9f7c-56bbf2e64169",
                "file--22c923d5-44fe-4f5a-a6ee-9bd4e88f70e6",
                "file--76c75d43-6ec4-4976-b786-282a02f2601b",
                "file--6372bed2-cb11-44ab-a676-4399d5f82e3f",
                "file--dfbf3eb8-73d8-40fe-945f-08b29f4f46cb",
                "file--a76512df-0293-4fe0-9b38-0b3c128950b7",
                "threat-actor--cff8908d-57a1-512f-bd0b-ed3caeeb6f2a",
                "threat-actor--07508793-2a33-5982-b040-9114591a8330",
                "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
                "threat-actor--f4dd489f-e0df-55ec-a8c4-fefc51964035"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://blog.polyswarm.io/lazarus-expands-financial-espionage-operations-with-memory-resident-remotepe-rat"
                }
            ]
        }
    ]
}