{
    "type": "bundle",
    "id": "bundle--76933b50-40bf-4314-9f19-7ca860e66675",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--16fdc541-545e-40c4-9896-0b4354ada896",
            "created": "2023-03-08T12:51:41.953788Z",
            "modified": "2023-03-08T13:24:48.498141Z",
            "name": "ESTSecurity",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c07178cb-b02e-44bd-95c4-3e24b0525e8f",
            "hashes": {
                "MD5": "e904bf93403c0fb08b9683a9e858c73e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a3f87cca-8bfa-43e3-aebe-832bb2f3a0f0",
            "hashes": {
                "MD5": "7706d38718707a73dce032f79eea43ef"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--273ae2a4-34b5-4d45-a308-32196b5fdee5",
            "hashes": {
                "MD5": "5c35360d28082e6e32d3e8ee347843fb"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e386e6dc-1cb1-4ed9-bb1e-e0a88dc8245e",
            "hashes": {
                "MD5": "a7328fb36af985bcae0ed4ec7fa75659"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--71ab0469-fa3a-4397-a302-ee727da2d354",
            "value": "bizforms.co.kr"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--98cac380-b259-4e27-a2ce-67a0d4395795",
            "value": "104.221.134.28"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--21ce8143-db3e-42fc-b3ab-c97ccff02f2e",
            "value": "104.195.1.39"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--76ab0e07-0828-4643-841d-aad1c48a9adb",
            "value": "104.31.74.89"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5a526275-4903-4a91-88df-cbb024c0ec46",
            "hashes": {
                "MD5": "a7c804b62ae93d708478949f498342f9"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--70c3fbda-02b4-4a01-80c1-335ff130bd8f",
            "value": "https://tpddata.com/flash/gcoin2.swf"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--688023f8-3b6a-44f8-ad63-c2b00c7aa513",
            "value": "https://tpddata.com/flash/gcoin4.swf"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--afd6508d-7c62-4bac-911e-079363eb6ecb",
            "value": "tpddata.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fdda567d-8712-443e-bcdb-64b8b59d3afb",
            "hashes": {
                "MD5": "fa6ee9e969df5ca4524daa77c172a1a7"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e940af9e-c6f2-4a62-b39a-6c4aeb3ed62f",
            "hashes": {
                "MD5": "78e8c150481107d7a5ed99e7e420fd24"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
            "created": "2026-06-25T00:00:29.770796Z",
            "modified": "2026-06-25T00:00:29.770796Z",
            "name": "Lazarus"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--d940ecd1-de9b-40c0-a7f7-f1986f7f0cff",
            "created_by_ref": "identity--16fdc541-545e-40c4-9896-0b4354ada896",
            "created": "2026-06-25T00:00:29.771778Z",
            "modified": "2026-06-25T00:00:29.771778Z",
            "name": "\ucd5c\uc2e0 APT \ucea0\ud398\uc778, \uc791\uc804\uba85 \uc720\ub839 \uaf2d\ub450\uac01\uc2dc(Operation Ghost Puppet)",
            "published": "2018-09-24T00:00:00Z",
            "object_refs": [
                "identity--16fdc541-545e-40c4-9896-0b4354ada896",
                "file--c07178cb-b02e-44bd-95c4-3e24b0525e8f",
                "file--a3f87cca-8bfa-43e3-aebe-832bb2f3a0f0",
                "file--273ae2a4-34b5-4d45-a308-32196b5fdee5",
                "file--e386e6dc-1cb1-4ed9-bb1e-e0a88dc8245e",
                "domain-name--71ab0469-fa3a-4397-a302-ee727da2d354",
                "ipv4-addr--98cac380-b259-4e27-a2ce-67a0d4395795",
                "ipv4-addr--21ce8143-db3e-42fc-b3ab-c97ccff02f2e",
                "ipv4-addr--76ab0e07-0828-4643-841d-aad1c48a9adb",
                "file--5a526275-4903-4a91-88df-cbb024c0ec46",
                "url--70c3fbda-02b4-4a01-80c1-335ff130bd8f",
                "url--688023f8-3b6a-44f8-ad63-c2b00c7aa513",
                "domain-name--afd6508d-7c62-4bac-911e-079363eb6ecb",
                "file--fdda567d-8712-443e-bcdb-64b8b59d3afb",
                "file--e940af9e-c6f2-4a62-b39a-6c4aeb3ed62f",
                "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "http://blog.alyac.co.kr/1901"
                }
            ]
        }
    ]
}