{
    "type": "bundle",
    "id": "bundle--0ef954e3-d66a-4c62-8022-2c70872abc16",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--26f043d6-2bd6-459a-b07f-6d4d79229bfc",
            "created": "2026-01-13T04:01:05.551348Z",
            "modified": "2026-01-13T04:03:03.479042Z",
            "name": "RedAsgard",
            "identity_class": "organization"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
            "created": "2026-06-30T23:01:13.213316Z",
            "modified": "2026-06-30T23:01:13.213316Z",
            "name": "Lazarus"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--274bdc58-7b9c-42b3-9e85-d2b6ecd27286",
            "created_by_ref": "identity--26f043d6-2bd6-459a-b07f-6d4d79229bfc",
            "created": "2026-06-30T23:01:13.214398Z",
            "modified": "2026-06-30T23:01:13.214398Z",
            "name": "The Factory: How a Lazarus-Attributed Credential Pipeline Collected Its Own Operators",
            "published": "2026-05-14T00:00:00Z",
            "object_refs": [
                "identity--26f043d6-2bd6-459a-b07f-6d4d79229bfc",
                "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://open.spotify.com/episode/4fCxS9Q4n82tf8fRgsMRCZ"
                }
            ]
        }
    ]
}