{
    "type": "bundle",
    "id": "bundle--3432f9cf-7944-407f-9938-7f444ce8f35f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--a376a29c-d499-4d13-a9b0-c30b2b36c12d",
            "created": "2023-03-08T12:51:55.504513Z",
            "modified": "2024-09-12T13:07:45.993173Z",
            "name": "Cyfirma",
            "identity_class": "organization"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--27ff4ba1-0dc5-465a-86e0-8eb295226ea7",
            "created": "2026-07-13T01:34:35.537622Z",
            "modified": "2026-07-13T01:34:35.537622Z",
            "name": "YARA Rule",
            "pattern": "rule Lazarus_PolinRider_Generic_Hunt\n{\n    meta:\n        author = \"CYFIRMA\"\n        description = \"Generic hunting rule for Lazarus PolinRider campaign\"\n        date = \"2026-07-07\"\n        threat_actor = \"Lazarus Group\"\n        campaign = \"PolinRider\"\n        confidence = \"Low\"\n    strings:\n        $s1 = \"nwv3u.exe\" ascii nocase\n        $s2 = \"/scratch/zoo/2026/0522/\" ascii\n        $s3 = \"check02id.com\" ascii nocase\n        $s4 = \"uti98.com\" ascii nocase\n        $s5 = \"2no.co\" ascii nocase\n        $s6 = \"uw04webzoom.us\" ascii nocase\n        $s7 = \"tronracing.com\" ascii nocase\n        $ip1 = \"208.91.197.27\" ascii\n        $ip2 = \"94.191.24.214\" ascii\n        $ip3 = \"139.59.27.154\" ascii\n        $ip4 = \"104.223.98.2\" ascii\n        $ip5 = \"104.223.97.2\" ascii\n    condition:\n        uint16(0) == 0x5A4D and 3 of ($s*) and any of ($ip*)\n}",
            "pattern_type": "yara",
            "valid_from": "2026-07-10T00:00:00Z"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--4da215c1-96f5-4bdc-b2e7-ebf6786d9fab",
            "value": "139.59.27.154"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--a06a76d6-30e3-4d47-9f1b-54b8db8ae15e",
            "value": "94.191.24.214"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--6460bcbf-b5a3-42a0-843c-9afff2a8574f",
            "value": "uw04webzoom.us"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--4a2974a6-44ce-4160-8b42-4ba5b7990474",
            "value": "check02id.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a9fb3efa-709d-434d-bddc-36a9811569a4",
            "value": "tronracing.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--4378b138-c24c-4e35-bac3-11837fde46ef",
            "value": "208.91.197.27"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0c3d75f1-36b7-422e-b903-fe9f7018579f",
            "value": "104.223.98.2"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--bb82e83f-b84f-4596-a800-c441e4a10c33",
            "value": "104.223.97.2"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--1d227bee-f26c-5f74-a3f8-5bdb18774b64",
            "created": "2026-07-13T01:34:35.540378Z",
            "modified": "2026-07-13T01:34:35.540378Z",
            "name": "FamousChollima"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--21a5efde-6a09-5457-b095-3687a21fa8b8",
            "created": "2026-07-13T01:34:35.541083Z",
            "modified": "2026-07-13T01:34:35.541083Z",
            "name": "PolinRider"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--e5c1f27a-26dd-4ae0-ac5e-69b44350eadd",
            "created_by_ref": "identity--a376a29c-d499-4d13-a9b0-c30b2b36c12d",
            "created": "2026-07-13T01:34:35.541365Z",
            "modified": "2026-07-13T01:34:35.541365Z",
            "name": "Weekly Intelligence Report \u2013 10 Jul 2026",
            "published": "2026-07-10T00:00:00Z",
            "object_refs": [
                "identity--a376a29c-d499-4d13-a9b0-c30b2b36c12d",
                "indicator--27ff4ba1-0dc5-465a-86e0-8eb295226ea7",
                "ipv4-addr--4da215c1-96f5-4bdc-b2e7-ebf6786d9fab",
                "ipv4-addr--a06a76d6-30e3-4d47-9f1b-54b8db8ae15e",
                "domain-name--6460bcbf-b5a3-42a0-843c-9afff2a8574f",
                "domain-name--4a2974a6-44ce-4160-8b42-4ba5b7990474",
                "domain-name--a9fb3efa-709d-434d-bddc-36a9811569a4",
                "ipv4-addr--4378b138-c24c-4e35-bac3-11837fde46ef",
                "ipv4-addr--0c3d75f1-36b7-422e-b903-fe9f7018579f",
                "ipv4-addr--bb82e83f-b84f-4596-a800-c441e4a10c33",
                "threat-actor--1d227bee-f26c-5f74-a3f8-5bdb18774b64",
                "threat-actor--21a5efde-6a09-5457-b095-3687a21fa8b8"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.cyfirma.com/news/weekly-intelligence-report-10-jul-2026"
                }
            ]
        }
    ]
}