{
    "type": "bundle",
    "id": "bundle--2242799d-3755-4c74-bfd2-6a8a63b638fe",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--3195090a-932c-46c0-ade9-81561ef5d865",
            "created": "2026-04-09T05:13:49.98005Z",
            "modified": "2026-04-09T08:02:56.258462Z",
            "name": "PhatomCandle",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--bf0d7f92-2a93-40be-b423-53ea517acd09",
            "hashes": {
                "MD5": "cff02735bd4df3dcd917dfc187f52df2",
                "SHA-1": "dc9e2990d4180825fb8b59dc0b0156bde9719cbf",
                "SHA-256": "21a55a482d99d56288fb2aa31711ebb41c9cf47211163766a346def99a7b63d2"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c3f9c8d8-692b-4666-bcca-c00446cef7f3",
            "hashes": {
                "MD5": "31c614f72d80e1422530b8b9c6edd67f",
                "SHA-1": "b2f423ff81f0f564e4801525b12e1e08845f7f4c",
                "SHA-256": "5d1f8a998829345e533a7cc79c90b6a60a05dbdde2fff2eeab3514e024f475dc"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--267cf388-8984-4a00-b35a-b13336cd44d9",
            "hashes": {
                "MD5": "4895d94d7e246ac6f4337aed761fdbce",
                "SHA-1": "d072328ae65d78eda69f2640c6feca7a03b61c2b",
                "SHA-256": "80b50c2406bdd5db5479e6e3da67b8d35b39626d1c55676dae390f6defb40c38"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4c6bc2e2-c8bc-4f87-a061-6ac72272ce5c",
            "hashes": {
                "MD5": "d45795d84bd31847f803251a8a125098",
                "SHA-1": "fa02eb136f8162ba6f5999d560a52d1f6e995284",
                "SHA-256": "3cdab9081a7a6019b80fb9f2a9d89001669565b81acd1ef701018fbee03a1ecc"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--f9787343-951a-4d9d-b946-54b251b288df",
            "value": "publisherresolution.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--c20db729-fe96-4593-aec6-76b3ab933f17",
            "value": "solidactivate.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--7d7cae6e-97b4-48ae-8771-bbc7510bb034",
            "value": "gateway001kir.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--c891296f-def6-4189-8dea-7e6b9e086f88",
            "value": "bermanlawrsk.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--22220bbd-a057-48b1-ab03-2ed5a991d173",
            "value": "footballoff.com"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--4fd1b17b-0534-4090-8e6d-f308b66b45ca",
            "created_by_ref": "identity--3195090a-932c-46c0-ade9-81561ef5d865",
            "created": "2026-09-19T08:57:45.667046Z",
            "modified": "2026-09-19T08:57:45.667046Z",
            "name": "Spoofed IT Tools Distribute EtherRAT in Highly Stealthy Campaign Suspected Linked to DPRK APT",
            "published": "2026-04-08T00:00:00Z",
            "object_refs": [
                "identity--3195090a-932c-46c0-ade9-81561ef5d865",
                "file--bf0d7f92-2a93-40be-b423-53ea517acd09",
                "file--c3f9c8d8-692b-4666-bcca-c00446cef7f3",
                "file--267cf388-8984-4a00-b35a-b13336cd44d9",
                "file--4c6bc2e2-c8bc-4f87-a061-6ac72272ce5c",
                "domain-name--f9787343-951a-4d9d-b946-54b251b288df",
                "domain-name--c20db729-fe96-4593-aec6-76b3ab933f17",
                "domain-name--7d7cae6e-97b4-48ae-8771-bbc7510bb034",
                "domain-name--c891296f-def6-4189-8dea-7e6b9e086f88",
                "domain-name--22220bbd-a057-48b1-ab03-2ed5a991d173"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://medium.com/@phatomcandle/spoofed-it-tools-distribute-etherrat-in-highly-stealthy-campaign-suspected-linked-to-dprk-apt-1aa6beab7dcb"
                }
            ]
        }
    ]
}