{
    "type": "bundle",
    "id": "bundle--f95ab281-6caa-48e9-9815-19ea3898123e",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.433207Z",
            "modified": "2026-09-29T01:05:42.433207Z",
            "name": "Dispensight / SecureLeaf",
            "description": "Defensive CTI \u2014 secureleaf.dispensight.com",
            "identity_class": "organization"
        },
        {
            "type": "malware",
            "spec_version": "2.1",
            "id": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.433628Z",
            "modified": "2026-09-29T01:05:42.433628Z",
            "name": "Remus Stealer / WP-002 (ClickFix Variant C)",
            "description": "WP-002 ClickFix, variant C. EtherHiding migrated from BSC-testnet to Polygon; final clipboard command retrieved on-chain. C2 moved from Cloudflare-fronted stagers (asseload/cfsubs/helauth, burned in v15/v16) to a self-hosted api.php endpoint on the operator's own AS202412 (Spamhaus DROP-listed). In the captured session the Polygon retrieval failed and only a non-command numeric string reached the clipboard \u2014 degraded delivery consistent with sustained takedown pressure.",
            "malware_types": [
                "spyware",
                "stealer"
            ],
            "is_family": true,
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v17 \u2014 WP-002 ClickFix Variant C (Polygon EtherHiding, self-hosted C2 on AS202412)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--3ed57db8-5aff-5570-994e-e8119412e6e0",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.434851Z",
            "modified": "2026-09-29T01:05:42.434851Z",
            "name": "EtherHiding on Polygon",
            "description": "Injector/command hosted in a Polygon smart contract, retrieved via polygon-bor-rpc.publicnode.com (eth_call selector 0xe2179b8e). Retrieval failed in the captured session.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1102"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--abce81b6-a4ec-52e9-8073-20fce1d60855",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.435139Z",
            "modified": "2026-09-29T01:05:42.435139Z",
            "name": "Self-hosted C2 on operator ASN",
            "description": "api.php C2 on entry-verifed-cdn.codes resolving directly to 178.16.52.101 (AS202412 Omegatech, Spamhaus DROP) \u2014 no Cloudflare fronting.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1583.004"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--8e795a7b-a0cf-5629-9e29-df20c14751d9",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.435401Z",
            "modified": "2026-09-29T01:05:42.435401Z",
            "name": "Encoded JSON beacon",
            "description": "GET/POST /api.php with base64-JSON {action:dl,k,os,vid,ref,ray}; ?s=<k>&_v config, ?k=<k>&d=<b64> tasking.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1071.001"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--def9347e-4e89-530d-b16e-90db04b57351",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.43556Z",
            "modified": "2026-09-29T01:05:42.43556Z",
            "name": "Clipboard poisoning (ClickFix)",
            "description": "obfuscator.io-style arming stage writes the on-chain-sourced command to the clipboard; elevated Win+X PowerShell(Admin) social engineering.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1059.001"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--4ee5584d-24c1-5b81-bebe-c8965953b23b",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.435742Z",
            "modified": "2026-09-29T01:05:42.435742Z",
            "name": "ClickFix elevated shell",
            "description": "Fake verification instructs Win+X -> PowerShell(Admin) -> Ctrl+V -> Enter.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1204.004"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--d5d4a818-ef34-5b95-b588-532b5b55a187",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.436031Z",
            "modified": "2026-09-29T01:05:42.436031Z",
            "name": "Degraded delivery under pressure",
            "description": "On-chain command source failed; fallback numeric string copied instead of a runnable command.",
            "external_references": [
                {
                    "source_name": "mitre-attack",
                    "external_id": "T1102"
                }
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "infrastructure",
            "spec_version": "2.1",
            "id": "infrastructure--8afbaf36-1588-5d95-af71-f09b34905d5a",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.436198Z",
            "modified": "2026-09-29T01:05:42.436198Z",
            "name": "gogreenlightloans.com (compromised lure #3)",
            "description": "Compromised GoDaddy WordPress (bankio-core theme + Elementor). Cloudflare-fronted 104.21.1.64 / origin 160.153.0.8. VICTIM \u2014 splitcam: do not blocklist.",
            "infrastructure_types": [
                "hosting-malware"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "infrastructure",
            "spec_version": "2.1",
            "id": "infrastructure--4fca59be-ee4f-5d00-9b8b-b2be93d2c461",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.43633Z",
            "modified": "2026-09-29T01:05:42.43633Z",
            "name": "entry-verifed-cdn.codes api.php C2 (self-hosted)",
            "description": "178.16.52.101 \u2014 Omegatech AS202412 (Spamhaus DROP). /api.php base64-JSON beacon + arming-stage delivery. Deliberate typo domain ('verifed').",
            "infrastructure_types": [
                "command-and-control"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "infrastructure",
            "spec_version": "2.1",
            "id": "infrastructure--b91cf883-f030-5ef5-9fc7-dd562d9a4d58",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.436441Z",
            "modified": "2026-09-29T01:05:42.436441Z",
            "name": "AS202412 Omegatech (Spamhaus DROP)",
            "description": "Operator ASN, full Spamhaus DROP listing. Now hosting live campaign C2 directly (178.16.52.0/24), not merely staging.",
            "infrastructure_types": [
                "hosting-malware"
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--d61e033f-9a5f-5451-bab4-91c2e77bb803",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.436607Z",
            "modified": "2026-09-29T01:05:42.436607Z",
            "name": "C2 entry-verifed-cdn.codes",
            "description": "Self-hosted api.php C2",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[domain-name:value = 'entry-verifed-cdn.codes']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v17 \u2014 WP-002 ClickFix Variant C (Polygon EtherHiding, self-hosted C2 on AS202412)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-29T01:05:42.436607Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--be3758b2-7209-5273-bf1c-15c5e9d182bd",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.44297Z",
            "modified": "2026-09-29T01:05:42.44297Z",
            "name": "C2 IP 178.16.52.101 (AS202412)",
            "description": "Omegatech-hosted C2 (Spamhaus DROP)",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[ipv4-addr:value = '178.16.52.101']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v17 \u2014 WP-002 ClickFix Variant C (Polygon EtherHiding, self-hosted C2 on AS202412)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-29T01:05:42.44297Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--5ac177b6-128a-5bb1-ab64-389ee25aa4c9",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.444229Z",
            "modified": "2026-09-29T01:05:42.444229Z",
            "name": "AS202412 prefix 178.16.52.0/24",
            "description": "Omegatech block now serving live C2",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[ipv4-addr:value ISSUBSET '178.16.52.0/24']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v17 \u2014 WP-002 ClickFix Variant C (Polygon EtherHiding, self-hosted C2 on AS202412)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-29T01:05:42.444229Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--3453ebee-9dae-5dd0-8ec9-44550901d19f",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.445577Z",
            "modified": "2026-09-29T01:05:42.445577Z",
            "name": "Campaign key",
            "description": "api.php campaign/victim key",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[url:value = 'https://entry-verifed-cdn.codes/api.php?s=a3946e3ded820e3d2f02885bf63c8a3a176d58bb9403b402']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v17 \u2014 WP-002 ClickFix Variant C (Polygon EtherHiding, self-hosted C2 on AS202412)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-29T01:05:42.445577Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--bcac4e93-ec79-5cb2-8066-5527f0804aa7",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.446859Z",
            "modified": "2026-09-29T01:05:42.446859Z",
            "name": "Lure gogreenlightloans.com",
            "description": "Compromised lure #3 \u2014 victim; do not block",
            "indicator_types": [
                "benign",
                "compromised"
            ],
            "pattern": "[domain-name:value = 'gogreenlightloans.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v17 \u2014 WP-002 ClickFix Variant C (Polygon EtherHiding, self-hosted C2 on AS202412)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-29T01:05:42.446859Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--147a483c-1178-5c18-945d-0bc4badb8e85",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.447688Z",
            "modified": "2026-09-29T01:05:42.447688Z",
            "name": "Polygon EtherHiding RPC",
            "description": "On-chain command retrieval (abused-legit)",
            "indicator_types": [
                "anomalous-activity"
            ],
            "pattern": "[domain-name:value = 'polygon-bor-rpc.publicnode.com']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v17 \u2014 WP-002 ClickFix Variant C (Polygon EtherHiding, self-hosted C2 on AS202412)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-29T01:05:42.447688Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--8d1552ea-5e2f-5525-9244-9ab29b405c38",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.448471Z",
            "modified": "2026-09-29T01:05:42.448471Z",
            "name": "Arming stage JS",
            "description": "obfuscator.io arming stage (658KB)",
            "indicator_types": [
                "malicious-activity"
            ],
            "pattern": "[file:hashes.'SHA-256' = '51d4def852645a4f7a436abe7aa4498d08f57395e2f40e3c17cdb3f95d03f2d2']",
            "pattern_type": "stix",
            "pattern_version": "2.1",
            "external_references": [
                {
                    "source_name": "SecureLeaf",
                    "description": "v17 \u2014 WP-002 ClickFix Variant C (Polygon EtherHiding, self-hosted C2 on AS202412)",
                    "external_id": "SL-ADV-2026-WP-001"
                }
            ],
            "valid_from": "2026-09-29T01:05:42.448471Z",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--1c7ee531-9555-5a10-818b-ba0de913cc9b",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.450585Z",
            "modified": "2026-09-29T01:05:42.450585Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--d61e033f-9a5f-5451-bab4-91c2e77bb803",
            "target_ref": "infrastructure--4fca59be-ee4f-5d00-9b8b-b2be93d2c461",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a37ef585-0d75-5c2e-af83-dbffce539063",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.450784Z",
            "modified": "2026-09-29T01:05:42.450784Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--be3758b2-7209-5273-bf1c-15c5e9d182bd",
            "target_ref": "infrastructure--4fca59be-ee4f-5d00-9b8b-b2be93d2c461",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--6fe67ccc-f741-56f1-bf7d-9b3f071a91d5",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.450976Z",
            "modified": "2026-09-29T01:05:42.450976Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--5ac177b6-128a-5bb1-ab64-389ee25aa4c9",
            "target_ref": "infrastructure--b91cf883-f030-5ef5-9fc7-dd562d9a4d58",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--83d13507-2db9-58c3-a8b4-fd62b5bdac9a",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.451177Z",
            "modified": "2026-09-29T01:05:42.451177Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--3453ebee-9dae-5dd0-8ec9-44550901d19f",
            "target_ref": "infrastructure--4fca59be-ee4f-5d00-9b8b-b2be93d2c461",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--3ed1caf2-0d9e-58b4-b52c-99690d2572be",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.451307Z",
            "modified": "2026-09-29T01:05:42.451307Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--bcac4e93-ec79-5cb2-8066-5527f0804aa7",
            "target_ref": "infrastructure--8afbaf36-1588-5d95-af71-f09b34905d5a",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--e9ec6008-42f4-53c3-95b8-0bd2a35a1ab7",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.451425Z",
            "modified": "2026-09-29T01:05:42.451425Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--147a483c-1178-5c18-945d-0bc4badb8e85",
            "target_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--a3a5e4ec-f861-5ba5-a0f4-836887f5a70a",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.451541Z",
            "modified": "2026-09-29T01:05:42.451541Z",
            "relationship_type": "indicates",
            "source_ref": "indicator--8d1552ea-5e2f-5525-9244-9ab29b405c38",
            "target_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d78fc41a-c6f0-5fd7-8b31-80930c1a2928",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.451708Z",
            "modified": "2026-09-29T01:05:42.451708Z",
            "relationship_type": "uses",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "attack-pattern--3ed57db8-5aff-5570-994e-e8119412e6e0",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--ded5ebb2-0d5b-5d17-b4e1-3d7177e75714",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.454019Z",
            "modified": "2026-09-29T01:05:42.454019Z",
            "relationship_type": "uses",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "attack-pattern--abce81b6-a4ec-52e9-8073-20fce1d60855",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f43aa04c-0aad-5e65-bc06-fc2ae6c99953",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.454186Z",
            "modified": "2026-09-29T01:05:42.454186Z",
            "relationship_type": "uses",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "attack-pattern--8e795a7b-a0cf-5629-9e29-df20c14751d9",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--d2d3e537-5e31-5437-b07d-fa2793d797b8",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.454301Z",
            "modified": "2026-09-29T01:05:42.454301Z",
            "relationship_type": "uses",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "attack-pattern--def9347e-4e89-530d-b16e-90db04b57351",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--eb879c66-0cec-58a9-856f-55c2660ddb57",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.454423Z",
            "modified": "2026-09-29T01:05:42.454423Z",
            "relationship_type": "uses",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "attack-pattern--4ee5584d-24c1-5b81-bebe-c8965953b23b",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--fefe6bad-68dc-5aff-bb3f-760d0ca3813c",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.454553Z",
            "modified": "2026-09-29T01:05:42.454553Z",
            "relationship_type": "uses",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "attack-pattern--d5d4a818-ef34-5b95-b588-532b5b55a187",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--01d60f0c-5499-51a1-9cff-6a5d076cce3d",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.454672Z",
            "modified": "2026-09-29T01:05:42.454672Z",
            "relationship_type": "consists-of",
            "description": "C2 domain resolves into AS202412",
            "source_ref": "infrastructure--4fca59be-ee4f-5d00-9b8b-b2be93d2c461",
            "target_ref": "infrastructure--b91cf883-f030-5ef5-9fc7-dd562d9a4d58",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--78b8e147-9a46-524c-8666-9b0e3569dbc8",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.454884Z",
            "modified": "2026-09-29T01:05:42.454884Z",
            "relationship_type": "communicates-with",
            "description": "api.php beacon + arming delivery",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "infrastructure--4fca59be-ee4f-5d00-9b8b-b2be93d2c461",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--4a6952b5-9550-5d67-a338-28672f31a3b2",
            "created_by_ref": "identity--cd9f1601-6614-59bf-b144-4205ee415898",
            "created": "2026-09-29T01:05:42.45503Z",
            "modified": "2026-09-29T01:05:42.45503Z",
            "relationship_type": "targets",
            "description": "Delivered via compromised lure (victim)",
            "source_ref": "malware--a0aa8c7e-cd46-5331-9dbe-f9ad312dc823",
            "target_ref": "infrastructure--8afbaf36-1588-5d95-af71-f09b34905d5a",
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        }
    ]
}