{
    "type": "bundle",
    "id": "bundle--3f5ba7db-7f0b-4295-9521-4a0a9d9ab2e5",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--591f8519-0199-4760-be34-ab145c5bb51f",
            "created": "2026-11-08T06:04:16.3574Z",
            "modified": "2026-11-08T23:48:14.383018Z",
            "name": "MichaelKoczwara",
            "identity_class": "organization"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--265bfbcb-d60a-46e4-9076-37c2990a4f52",
            "value": "diamonddtrailers.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--6e1cd88e-51e2-4da6-a78b-b129530a1220",
            "value": "commsouthindia.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--f89f7b6a-5dc3-46d0-8dd6-ddf58f72a4a1",
            "value": "computing.servehttp.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--c9cf71ea-b1be-4091-b4a9-1a12fba5e47a",
            "value": "itcy-sysvalidatorit.shop"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--dcd10733-52e9-4ab5-892c-8e72ca592c6c",
            "value": "213.111.148.202"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--de1efba9-c18c-4243-b541-efda17829543",
            "value": "45.11.59.184"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--38128bc4-b18d-460d-a81b-f379500287df",
            "value": "195.66.213.5"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--70ae093a-6496-4d2f-8b05-dbf6d8439b95",
            "value": "45.11.59.99"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--d6cd37cb-da60-40ce-980a-85bd32e3fe30",
            "value": "78.141.211.155"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--74c1ee32-2b8f-44c4-a734-6b0129afd735",
            "value": "185.254.198.90"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--3962ed4f-3920-4006-8eff-03b04a8779f9",
            "value": "213.111.148.242"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--6da8d19f-a938-4278-9ab3-992a2c0a7313",
            "value": "delay.servehttp.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--b6c2f5df-3095-44ca-9306-82ea694aa8d0",
            "value": "arusupport-region1-webhook.online"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--10425500-81f6-4a84-ad98-fbf1a9bb27d2",
            "value": "www.tinklify.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--c60032ae-7f9e-408e-ba65-9e8ff8b15741",
            "value": "freehealth.lat"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--dd771713-b453-4329-b186-2847a6e0949c",
            "value": "www.freehealth.lat"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--1f14f248-0c39-44a9-9740-86a65e4aa047",
            "value": "wss.sytes.net"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--3dda7630-65c4-4e8d-8e71-463d483fff53",
            "value": "85.137.56.161"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--fa8dab9c-348f-4caf-8f85-31bd2888c71a",
            "value": "vaimage.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--f88e4b15-9389-4c06-98f4-5cc3b4155d2c",
            "value": "92.242.187.214"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--0bb2d9b2-5b0f-4b9e-8f4c-ff96252c6161",
            "value": "tinklify.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--89a0e9ec-66a4-4288-a476-ae8c5684244b",
            "value": "213.111.146.132"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--e529eafc-1739-4b86-b244-874df411f5e8",
            "value": "185.66.91.112"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--070c1b3c-08f2-470e-9d14-ac9ddcdd1ad9",
            "value": "45.11.59.140"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--29671156-c149-4b7c-8bb9-25113b458881",
            "value": "85.137.56.245"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d9bbf2ec-92c5-420c-8657-5fc5c42eed81",
            "value": "grenight.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--ed47178f-2b1a-4e3c-b5de-d0be7a7f496c",
            "value": "storage.hubpage.cloud"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--8a41ce71-b2d4-5fc7-9a01-40a7672a1fc9",
            "created": "2026-11-09T02:49:11.453962Z",
            "modified": "2026-11-09T02:49:11.453962Z",
            "name": "TraderTraitor"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
            "created": "2026-11-09T02:49:11.454653Z",
            "modified": "2026-11-09T02:49:11.454653Z",
            "name": "Lazarus"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--ce1d33f8-7c69-448e-b2c5-0e2d7580987b",
            "created_by_ref": "identity--591f8519-0199-4760-be34-ab145c5bb51f",
            "created": "2026-11-09T02:49:11.455847Z",
            "modified": "2026-11-09T02:49:11.455847Z",
            "name": "Tracking Lazarus Group TraderTraitor Infrastructure Through Certificates and Historical Records",
            "published": "2026-11-07T00:00:00Z",
            "object_refs": [
                "identity--591f8519-0199-4760-be34-ab145c5bb51f",
                "domain-name--265bfbcb-d60a-46e4-9076-37c2990a4f52",
                "domain-name--6e1cd88e-51e2-4da6-a78b-b129530a1220",
                "domain-name--f89f7b6a-5dc3-46d0-8dd6-ddf58f72a4a1",
                "domain-name--c9cf71ea-b1be-4091-b4a9-1a12fba5e47a",
                "ipv4-addr--dcd10733-52e9-4ab5-892c-8e72ca592c6c",
                "ipv4-addr--de1efba9-c18c-4243-b541-efda17829543",
                "ipv4-addr--38128bc4-b18d-460d-a81b-f379500287df",
                "ipv4-addr--70ae093a-6496-4d2f-8b05-dbf6d8439b95",
                "ipv4-addr--d6cd37cb-da60-40ce-980a-85bd32e3fe30",
                "ipv4-addr--74c1ee32-2b8f-44c4-a734-6b0129afd735",
                "ipv4-addr--3962ed4f-3920-4006-8eff-03b04a8779f9",
                "domain-name--6da8d19f-a938-4278-9ab3-992a2c0a7313",
                "domain-name--b6c2f5df-3095-44ca-9306-82ea694aa8d0",
                "domain-name--10425500-81f6-4a84-ad98-fbf1a9bb27d2",
                "domain-name--c60032ae-7f9e-408e-ba65-9e8ff8b15741",
                "domain-name--dd771713-b453-4329-b186-2847a6e0949c",
                "domain-name--1f14f248-0c39-44a9-9740-86a65e4aa047",
                "ipv4-addr--3dda7630-65c4-4e8d-8e71-463d483fff53",
                "domain-name--fa8dab9c-348f-4caf-8f85-31bd2888c71a",
                "ipv4-addr--f88e4b15-9389-4c06-98f4-5cc3b4155d2c",
                "domain-name--0bb2d9b2-5b0f-4b9e-8f4c-ff96252c6161",
                "ipv4-addr--89a0e9ec-66a4-4288-a476-ae8c5684244b",
                "ipv4-addr--e529eafc-1739-4b86-b244-874df411f5e8",
                "ipv4-addr--070c1b3c-08f2-470e-9d14-ac9ddcdd1ad9",
                "ipv4-addr--29671156-c149-4b7c-8bb9-25113b458881",
                "domain-name--d9bbf2ec-92c5-420c-8657-5fc5c42eed81",
                "domain-name--ed47178f-2b1a-4e3c-b5de-d0be7a7f496c",
                "threat-actor--8a41ce71-b2d4-5fc7-9a01-40a7672a1fc9",
                "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://michalkoczwara.substack.com/p/tracking-lazarus-group-tradertraitor"
                }
            ]
        }
    ]
}