{
    "type": "bundle",
    "id": "bundle--b74cf8f3-1018-43c5-8578-4bd2880e1afb",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2023-03-08T12:51:42.067091Z",
            "modified": "2023-03-10T04:35:51.526813Z",
            "name": "USCISA",
            "identity_class": "organization"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--ec621d0e-70c6-4ffe-8831-a081d24bdfc1",
            "created": "2026-08-20T01:45:32.276219Z",
            "modified": "2026-08-20T01:45:32.276219Z",
            "name": "YARA Rule",
            "pattern": "rule CISA_3P_10135536_36_lfsrPolynomials_handshakeBytes { meta: Author = \"CISA Trusted Third Party\" Incident = \"10135536\" Date = \"2019-12-20\" Actor = \"Hidden Cobra\" Category = \"n/a\" Family = \"n/a\" Description = \"Detects LFSR polynomials used for FakeTLS comms and the bytes exchanged after the FakeTLS handshake\" MD5_1 = \"24906e88a757cb535eb17e6c190f371f\" SHA256_1 = \"106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438\" strings: $p1 = { 01 23 45 67 } $p2 = { 89 AB CD EF } $p3 = { FE DC BA 98 } $p4 = { 76 54 32 10 } $h1 = { 44 33 22 11 } $h2 = { 45 33 22 11 } condition: (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) and all of them }",
            "pattern_type": "yara",
            "valid_from": "2020-05-12T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--88ced49e-3b64-4260-a316-80bb795c9726",
            "hashes": {
                "SHA-256": "19f9a9f7a0c3e6ca72ea88c655b6500f7da203d46f38076e6e8de0d644a86e35"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5336ff28-6aab-42c9-9936-dbb7abab15b9",
            "hashes": {
                "SHA-1": "b24f6c60fa4ac76ffc11c2fcee961694aeb2141b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a368a588-c988-49fa-af7c-a927ebb3fc85",
            "hashes": {
                "MD5": "68fa29a40f64c9594cc3dbe8649f9ebc"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d514a604-65d2-4962-997d-efc057d1e100",
            "hashes": {
                "SHA-256": "2057c0cf4617eab7c91b99975dfb1e259609c4fa512e9e08a311a9a2eb65a6cf"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d1599e26-b48d-4041-9379-9732fc2f9b05",
            "hashes": {
                "SHA-1": "0cf64de7a635f5760c4684c18a6ad2983a2c0f73"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fac4e38c-af98-4cf0-b889-fb5e68f15d59",
            "hashes": {
                "MD5": "3005f1308e4519477ac25d7bbf054899"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3da7b06f-11ce-4b53-972a-a44f5b530fbd",
            "hashes": {
                "SHA-256": "106d915db61436b1a686b86980d4af16227776fc2048f2888995326db0541438"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ae7c2aa7-38d4-4aec-b1f7-88f4b344f20a",
            "hashes": {
                "SHA-1": "bda6c036fe34dda6aea7797551c7853a9891de96"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--167a5c2c-554a-4f3f-9bfc-176f8a39cd50",
            "hashes": {
                "MD5": "24906e88a757cb535eb17e6c190f371f"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--97558327-e602-4333-94fa-45778d244579",
            "value": "211.192.239.232"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28",
            "created": "2026-08-20T01:45:32.279096Z",
            "modified": "2026-08-20T01:45:32.279096Z",
            "name": "HiddenCobra"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--73774bb6-8670-46f4-9ec4-92fdd278bb4c",
            "created_by_ref": "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
            "created": "2026-08-20T01:45:32.279849Z",
            "modified": "2026-08-20T01:45:32.279849Z",
            "name": "MAR-10288834-2.v1 \u2013 North Korean Trojan: TAINTEDSCRIBE",
            "published": "2020-05-12T00:00:00Z",
            "object_refs": [
                "identity--ee1af7fe-c2db-446e-ab28-bdb4b4e29c1c",
                "indicator--ec621d0e-70c6-4ffe-8831-a081d24bdfc1",
                "file--88ced49e-3b64-4260-a316-80bb795c9726",
                "file--5336ff28-6aab-42c9-9936-dbb7abab15b9",
                "file--a368a588-c988-49fa-af7c-a927ebb3fc85",
                "file--d514a604-65d2-4962-997d-efc057d1e100",
                "file--d1599e26-b48d-4041-9379-9732fc2f9b05",
                "file--fac4e38c-af98-4cf0-b889-fb5e68f15d59",
                "file--3da7b06f-11ce-4b53-972a-a44f5b530fbd",
                "file--ae7c2aa7-38d4-4aec-b1f7-88f4b344f20a",
                "file--167a5c2c-554a-4f3f-9bfc-176f8a39cd50",
                "ipv4-addr--97558327-e602-4333-94fa-45778d244579",
                "threat-actor--144818da-aadb-576a-82f4-f05e15a3bb28"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.cisa.gov/news-events/analysis-reports/ar20-133b"
                }
            ]
        }
    ]
}