{
    "type": "bundle",
    "id": "bundle--a772203a-b3fc-492f-90c2-d2eb2249c01d",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.483538Z",
            "modified": "2026-09-25T02:56:28.483538Z",
            "name": "Dispensight / SecureLeaf",
            "description": "Defensive CTI \u2014 secureleaf.dispensight.com",
            "identity_class": "organization"
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.483808Z",
            "modified": "2026-09-25T02:56:28.483808Z",
            "name": "Remus Stealer / WP-002 (ClickFix Variant B)",
            "description": "WP-002 ClickFix chain, variant B. EtherHiding-delivered failover loader -> XOR/base64 clipboard-arming stage (elevated Win+X PowerShell(Admin) social-engineering, RU/EN) plus an independent html2canvas screenshot-exfil recon stage. Clipboard delivery is TDS-gated/intermittent; screenshot+fingerprint recon is consistently live.",
            "malware_types": [
                "spyware",
                "stealer"
            ],
            "is_family": true,
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v16 \u2014 WP-002 ClickFix Variant B (elevated shell, new C2, screenshot exfil)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--f853a6c0-c528-5885-92bb-3c3b65c6b671",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.484498Z",
            "modified": "2026-09-25T02:56:28.484498Z",
            "name": "ClickFix elevated shell (Win+X -> PowerShell Admin)",
            "description": "Fake Cloudflare Turnstile instructs victim Win+X -> I (PowerShell/Terminal as Admin) -> Ctrl+V -> Enter, running a clipboard-poisoned command with Administrator rights from the first instruction.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1204.004"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--8aa7ed1b-a02f-5a78-9ff5-9aeac9cf53e8",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.484731Z",
            "modified": "2026-09-25T02:56:28.484731Z",
            "name": "EtherHiding (BSC-testnet contract)",
            "description": "BSC-testnet contract 0x5bc946cd5121431c7a43549aee7f567e15176f9c (selector 0xe2179b8e) returns base64 JS that injects the asseload cdn.js failover loader.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1102"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--322ed22d-d83c-5de5-a18b-206907dcd1aa",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.484894Z",
            "modified": "2026-09-25T02:56:28.484894Z",
            "name": "Multi-domain failover staging",
            "description": "cdn.js loads the arming stage a4045c662b80.js from asseload.com -> cfsubs.com -> helauth.com in order; primary (asseload, burned in v15) degraded, forcing failover.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1568"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--def9347e-4e89-530d-b16e-90db04b57351",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.485045Z",
            "modified": "2026-09-25T02:56:28.485045Z",
            "name": "Clipboard poisoning",
            "description": "XOR/base64 arming stage (key qEXvNnc5bx0U) writes a PowerShell command to the clipboard via execCommand/clipboard API for the victim to paste into the elevated shell.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1059.001"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--3f9fd1bc-9ffe-54ce-b3af-405e1ff19f5c",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.485193Z",
            "modified": "2026-09-25T02:56:28.485193Z",
            "name": "Screen capture exfiltration",
            "description": "helauth.com snap.js (html2canvas) captures the visitor screen; base64 JPEG POSTed to /cdn/widget/shot.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1113"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--197213ad-deb5-514c-af1b-45044c5fd786",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.485381Z",
            "modified": "2026-09-25T02:56:28.485381Z",
            "name": "C2 beacon / fingerprint",
            "description": "GET/POST /cdn/widget/hit?s=cdn:X&h=<lure>&o=<os>&k=<clip>; /cdn/widget/a/done polled repeatedly.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1071.001"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--a4177f74-bc93-5f2d-be81-329ac610a134",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.485527Z",
            "modified": "2026-09-25T02:56:28.485527Z",
            "name": "Victim gating (TDS)",
            "description": "Conditional delivery of the clipboard-arming stage by visitor fingerprint; some sessions receive only the inert DOM shell while recon still fires.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1497.001"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "infrastructure",
            "spec_version": "2.1",
            "id": "infrastructure--5ca8785a-4b79-5e95-ac01-2833685070f5",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.485634Z",
            "modified": "2026-09-25T02:56:28.485634Z",
            "name": "freightbook365.com (compromised lure)",
            "description": "Compromised WordPress (RevSlider 6.7.16 + js_composer 7.8, transcargo theme; 160.153.0.61 GoDaddy). VICTIM \u2014 splitcam: do not blocklist.",
            "infrastructure_types": [
                "hosting-malware"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "infrastructure",
            "spec_version": "2.1",
            "id": "infrastructure--01154441-797d-50aa-a4e1-b4e787c0fa17",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.485753Z",
            "modified": "2026-09-25T02:56:28.485753Z",
            "name": "helauth.com recon/exfil C2",
            "description": "104.21.29.209 (Cloudflare). snap.js html2canvas screenshotter; /hit beacon; /shot base64-JPEG screenshot exfil; /a/done poll.",
            "infrastructure_types": [
                "command-and-control"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "infrastructure",
            "spec_version": "2.1",
            "id": "infrastructure--fc85071c-39b9-5904-acb3-85fe74cc7a18",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.485868Z",
            "modified": "2026-09-25T02:56:28.485868Z",
            "name": "cfsubs.com failover stager",
            "description": "172.67.190.184 (Cloudflare). Serves arming stage a4045c662b80.js on failover from asseload.",
            "infrastructure_types": [
                "command-and-control"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "infrastructure",
            "spec_version": "2.1",
            "id": "infrastructure--d9d7e354-d7d8-5443-8a63-b1a55cea1d19",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.485982Z",
            "modified": "2026-09-25T02:56:28.485982Z",
            "name": "asseload.com primary stager (burned)",
            "description": "104.21.59.52 (Cloudflare). Serves cdn.js failover loader; burned in v15 advisory/OTX, now degraded.",
            "infrastructure_types": [
                "command-and-control"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--4ba6eb97-5d89-5486-b80a-791394dc7173",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.486097Z",
            "modified": "2026-09-25T02:56:28.486097Z",
            "name": "C2 helauth.com",
            "description": "Recon/exfil C2",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[domain-name:value = 'helauth.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v16 \u2014 WP-002 ClickFix Variant B (elevated shell, new C2, screenshot exfil)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-25T02:56:28.486097Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--0106d241-9285-559b-b8e8-62bee8eaec4b",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.490386Z",
            "modified": "2026-09-25T02:56:28.490386Z",
            "name": "Failover stager cfsubs.com",
            "description": "Arming-stage failover host",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[domain-name:value = 'cfsubs.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v16 \u2014 WP-002 ClickFix Variant B (elevated shell, new C2, screenshot exfil)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-25T02:56:28.490386Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--a13e7921-ce01-5158-b904-15ff5d917a47",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.49107Z",
            "modified": "2026-09-25T02:56:28.49107Z",
            "name": "Stager asseload.com",
            "description": "cdn.js loader host (burned)",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[domain-name:value = 'asseload.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v16 \u2014 WP-002 ClickFix Variant B (elevated shell, new C2, screenshot exfil)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-25T02:56:28.49107Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--2258b064-fc99-5de6-a093-cdc514ced444",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.491648Z",
            "modified": "2026-09-25T02:56:28.491648Z",
            "name": "helauth.com IP",
            "description": "C2 (Cloudflare-fronted)",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[ipv4-addr:value = '104.21.29.209']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v16 \u2014 WP-002 ClickFix Variant B (elevated shell, new C2, screenshot exfil)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-25T02:56:28.491648Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--e520526c-c035-58f2-afda-4f51bc1f2e64",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.492502Z",
            "modified": "2026-09-25T02:56:28.492502Z",
            "name": "cfsubs.com IP",
            "description": "Failover stager (Cloudflare)",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[ipv4-addr:value = '172.67.190.184']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v16 \u2014 WP-002 ClickFix Variant B (elevated shell, new C2, screenshot exfil)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-25T02:56:28.492502Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--bcac4e93-ec79-5cb2-8066-5527f0804aa7",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.493018Z",
            "modified": "2026-09-25T02:56:28.493018Z",
            "name": "Lure freightbook365.com",
            "description": "Compromised lure \u2014 victim; do not block",
            "indicator_types": [
                "benign",
                "compromised"
            ],
            "pattern": "[domain-name:value = 'freightbook365.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v16 \u2014 WP-002 ClickFix Variant B (elevated shell, new C2, screenshot exfil)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-25T02:56:28.493018Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--482a6f0a-45c0-57a8-ac77-f8b0beab378a",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.493654Z",
            "modified": "2026-09-25T02:56:28.493654Z",
            "name": "cdn.js failover loader",
            "description": "3-domain failover loader",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[file:hashes.'SHA-256' = 'ba70a75c4b0d81e083fff510d0d6cc0c622cca3660cfa576e34ee899be7f72bc']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v16 \u2014 WP-002 ClickFix Variant B (elevated shell, new C2, screenshot exfil)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-25T02:56:28.493654Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--2a25f3e3-c3bf-5362-a6ef-e5b6ff1b92cd",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.495546Z",
            "modified": "2026-09-25T02:56:28.495546Z",
            "name": "Arming stage a4045c662b80.js",
            "description": "Clipboard-arming XOR/b64 stage (key qEXvNnc5bx0U)",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[file:hashes.'SHA-256' = 'c5ef6b9f44e97d55d6a0deac0ef22118410c3114e7b5b97f4fc1b5b0c5b4a1e9']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v16 \u2014 WP-002 ClickFix Variant B (elevated shell, new C2, screenshot exfil)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-25T02:56:28.495546Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5f9f0940-506d-5fdc-9517-c82ecd48a003",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.496119Z",
            "modified": "2026-09-25T02:56:28.496119Z",
            "name": "snap.js screenshotter",
            "description": "html2canvas screenshot recon",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[file:hashes.'SHA-256' = 'e87e550794322e574a1fda0c1549a3c70dae5a93d9113417a429016838eab8cb']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v16 \u2014 WP-002 ClickFix Variant B (elevated shell, new C2, screenshot exfil)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-25T02:56:28.496119Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--62d91160-ec25-5e3f-a392-fdb9437fa8f9",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.496681Z",
            "modified": "2026-09-25T02:56:28.496681Z",
            "name": "Screenshot exfil endpoint",
            "description": "base64 JPEG screen capture exfil",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[url:value = 'https://helauth.com/cdn/widget/shot']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v16 \u2014 WP-002 ClickFix Variant B (elevated shell, new C2, screenshot exfil)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-25T02:56:28.496681Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f9b59a59-4534-5ce5-8948-6295437a0e97",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.497378Z",
            "modified": "2026-09-25T02:56:28.497378Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--4ba6eb97-5d89-5486-b80a-791394dc7173",
            "target_ref": "infrastructure--01154441-797d-50aa-a4e1-b4e787c0fa17",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8cab6a16-a790-560f-8f64-7e44cf4eb5b8",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.497543Z",
            "modified": "2026-09-25T02:56:28.497543Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--0106d241-9285-559b-b8e8-62bee8eaec4b",
            "target_ref": "infrastructure--fc85071c-39b9-5904-acb3-85fe74cc7a18",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--7620889d-4a49-52f7-becb-4c4229b70b32",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.497677Z",
            "modified": "2026-09-25T02:56:28.497677Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--a13e7921-ce01-5158-b904-15ff5d917a47",
            "target_ref": "infrastructure--d9d7e354-d7d8-5443-8a63-b1a55cea1d19",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--8a2fe755-ae2c-55b2-be8f-bd0601fefbfe",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.497803Z",
            "modified": "2026-09-25T02:56:28.497803Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--2258b064-fc99-5de6-a093-cdc514ced444",
            "target_ref": "infrastructure--01154441-797d-50aa-a4e1-b4e787c0fa17",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--43db1fb1-d1c5-5f3a-a439-40706c19fbc4",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.49792Z",
            "modified": "2026-09-25T02:56:28.49792Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--e520526c-c035-58f2-afda-4f51bc1f2e64",
            "target_ref": "infrastructure--fc85071c-39b9-5904-acb3-85fe74cc7a18",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--50bb85cc-cc1b-56b8-9eef-6fe2868288c3",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.498036Z",
            "modified": "2026-09-25T02:56:28.498036Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--bcac4e93-ec79-5cb2-8066-5527f0804aa7",
            "target_ref": "infrastructure--5ca8785a-4b79-5e95-ac01-2833685070f5",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--02fe195a-f677-5e9d-b4a2-58aba156cbed",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.498155Z",
            "modified": "2026-09-25T02:56:28.498155Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--482a6f0a-45c0-57a8-ac77-f8b0beab378a",
            "target_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--43c65d85-0614-5513-bd6a-2cf44f9134ad",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.498315Z",
            "modified": "2026-09-25T02:56:28.498315Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--2a25f3e3-c3bf-5362-a6ef-e5b6ff1b92cd",
            "target_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c72cd30e-9903-5952-82ff-b0db9f9d97f9",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.498441Z",
            "modified": "2026-09-25T02:56:28.498441Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--5f9f0940-506d-5fdc-9517-c82ecd48a003",
            "target_ref": "infrastructure--01154441-797d-50aa-a4e1-b4e787c0fa17",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e30877c0-4e27-58b0-ae04-615b4875f785",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.498561Z",
            "modified": "2026-09-25T02:56:28.498561Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--62d91160-ec25-5e3f-a392-fdb9437fa8f9",
            "target_ref": "infrastructure--01154441-797d-50aa-a4e1-b4e787c0fa17",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--2add4c19-c1d4-5caf-8833-a0fdde032cbc",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.498683Z",
            "modified": "2026-09-25T02:56:28.498683Z",
            "relationship_type": "uses",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "attack-pattern--f853a6c0-c528-5885-92bb-3c3b65c6b671",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--c4ae40fc-912d-586c-ac67-9fd9c56a3e9d",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.498802Z",
            "modified": "2026-09-25T02:56:28.498802Z",
            "relationship_type": "uses",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "attack-pattern--8aa7ed1b-a02f-5a78-9ff5-9aeac9cf53e8",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d6e3640f-eeaa-5fd1-83c0-2066b1dd57aa",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.498919Z",
            "modified": "2026-09-25T02:56:28.498919Z",
            "relationship_type": "uses",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "attack-pattern--322ed22d-d83c-5de5-a18b-206907dcd1aa",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d2d3e537-5e31-5437-b07d-fa2793d797b8",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.499037Z",
            "modified": "2026-09-25T02:56:28.499037Z",
            "relationship_type": "uses",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "attack-pattern--def9347e-4e89-530d-b16e-90db04b57351",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6a8a84cc-f96f-5f2a-ac85-2d2a8efb8558",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.499154Z",
            "modified": "2026-09-25T02:56:28.499154Z",
            "relationship_type": "uses",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "attack-pattern--3f9fd1bc-9ffe-54ce-b3af-405e1ff19f5c",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--47a2bbea-483b-5309-9171-e55a01cbddfb",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.499327Z",
            "modified": "2026-09-25T02:56:28.499327Z",
            "relationship_type": "uses",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "attack-pattern--197213ad-deb5-514c-af1b-45044c5fd786",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--27604c2c-fc45-5b8a-9131-00951ed1eb94",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.499452Z",
            "modified": "2026-09-25T02:56:28.499452Z",
            "relationship_type": "uses",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "attack-pattern--a4177f74-bc93-5f2d-be81-329ac610a134",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--0a7f25a5-2e7b-5cdd-abe9-12e0ad9a2287",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.499571Z",
            "modified": "2026-09-25T02:56:28.499571Z",
            "relationship_type": "consists-of",
            "description": "EtherHiding on lure loads asseload cdn.js",
            "source_ref": "infrastructure--5ca8785a-4b79-5e95-ac01-2833685070f5",
            "target_ref": "infrastructure--d9d7e354-d7d8-5443-8a63-b1a55cea1d19",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a551badb-c9cc-549f-b1f6-f5de14686381",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.499689Z",
            "modified": "2026-09-25T02:56:28.499689Z",
            "relationship_type": "consists-of",
            "description": "cdn.js fails over asseload->cfsubs->helauth",
            "source_ref": "infrastructure--d9d7e354-d7d8-5443-8a63-b1a55cea1d19",
            "target_ref": "infrastructure--fc85071c-39b9-5904-acb3-85fe74cc7a18",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d004dbb0-91e2-5870-8684-84c9a832821b",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.499801Z",
            "modified": "2026-09-25T02:56:28.499801Z",
            "relationship_type": "communicates-with",
            "description": "Recon/screenshot exfil to helauth",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "infrastructure--01154441-797d-50aa-a4e1-b4e787c0fa17",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6bc27d6a-4f35-5040-8120-1b0a50a94687",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-25T02:56:28.499917Z",
            "modified": "2026-09-25T02:56:28.499917Z",
            "relationship_type": "targets",
            "description": "Delivered via compromised lure (victim)",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "infrastructure--5ca8785a-4b79-5e95-ac01-2833685070f5",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        }
    ]
}