{
    "type": "bundle",
    "id": "bundle--81cf941e-ae0b-4047-a1b4-ad0cb68cbee4",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--48edf75c-7cd8-480a-8950-deb15067ea29",
            "created": "2026-04-13T05:27:30.708162Z",
            "modified": "2026-04-22T01:03:40.519059Z",
            "name": "BreakGlassIntelligence",
            "identity_class": "organization"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--92f1ca14-ed68-49df-a859-913d251f4304",
            "value": "1cooldns.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--382a9fb0-ebc4-4c9f-aeb2-4759c14c8c57",
            "value": "dynuddns.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--8cf711fd-0501-44c1-b820-d13e4612e23d",
            "value": "giize.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--683203f8-f74d-4f1f-98b1-00c8bd5c2687",
            "value": "118.193.68.242"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--f3b3d0d8-ccae-4842-9a3d-230ff1ec1838",
            "value": "152.32.139.149"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--3a4c0a8a-e483-43e2-b462-faa34e861739",
            "value": "158.247.219.150"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--b1e16cfa-e2a3-4043-a957-1e44ddcac69a",
            "value": "158.247.250.37"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--b45031c3-a4e1-4d42-a219-ab520afd21a7",
            "created": "2026-06-24T18:42:59.684668Z",
            "modified": "2026-06-24T18:42:59.684668Z",
            "name": "YARA Rule",
            "pattern": "rule Kimsuky_NHIS_Phishing_Page {\r\nmeta:\r\nauthor = \"Breakglass Intelligence\"\r\ndescription = \"Detects Kimsuky NHIS/NTS/NPS phishing page content\"\r\ndate = \"2026-04-17\"\r\nreference = \"https://intel.breakglass.tech\"\r\ntlp = \"CLEAR\"\r\nstrings:\r\n$nhis1 = { EA B5 AD EB AF BC EA B1 B4 EA B0 95 EB B3 B4 ED 97 98 EA B3 B5 EB 8B A8 }\r\n$nts1 = { EA B5 AD EC 84 B8 EC B2 AD }\r\n$nps1 = { EA B5 AD EB AF BC EC 97 B0 EA B8 88 EA B3 B5 EB 8B A8 }\r\n$login1 = \"naver.com\" ascii\r\n$login2 = \"NID_JST\" ascii\r\n$login3 = \"wreply=\" ascii\r\n$suspicious1 = \"recon.htm\" ascii\r\n$suspicious2 = \"nsec.php\" ascii\r\ncondition:\r\nfilesize < 500KB and (\r\n(any of ($nhis*, $nts*, $nps*) and any of ($login*)) or\r\n(any of ($login*) and any of ($suspicious*))\r\n)\r\n}",
            "pattern_type": "yara",
            "valid_from": "2026-04-17T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--d3d7e1f0-f2aa-4976-838e-81c1cef2a3a3",
            "created": "2026-06-24T18:42:59.685347Z",
            "modified": "2026-06-24T18:42:59.685347Z",
            "name": "YARA Rule",
            "pattern": "rule Kimsuky_CHM_Dropper_Node5 {\r\nmeta:\r\nauthor = \"Breakglass Intelligence\"\r\ndescription = \"Detects Kimsuky CHM dropper campaign components (Node 5 - nid-log.com)\"\r\ndate = \"2026-04-17\"\r\nreference = \"https://intel.breakglass.tech\"\r\ntlp = \"CLEAR\"\r\nsource = \"@smica83\"\r\nstrings:\r\n$chm1 = \"Condor_API\" ascii wide\r\n$chm2 = \"api_reference\" ascii wide\r\n$chm3 = \".chm\" ascii\r\n$c2_1 = \"nid-log.com\" ascii\r\n$c2_2 = \"bootservice.php\" ascii\r\n$c2_3 = \"checkservice.php\" ascii\r\n$c2_4 = \"finalservice.php\" ascii\r\n$c2_5 = \"noreplymail.space\" ascii\r\n$stage1 = \"certutil\" ascii nocase\r\n$stage2 = \"Office_Config.xml\" ascii\r\n$stage3 = \"OfficeUpdater_\" ascii\r\n$stage4 = \"Links\\\\Link.ini\" ascii\r\n$fingerprint = \"Million OK\" ascii\r\ncondition:\r\nfilesize < 2MB and (\r\n(any of ($chm*) and any of ($c2*)) or\r\n(2 of ($c2*)) or\r\n(any of ($c2*) and any of ($stage*)) or\r\n($fingerprint and any of ($c2*))\r\n)\r\n}",
            "pattern_type": "yara",
            "valid_from": "2026-04-17T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--b9191d23-2d8d-4e3f-aa0c-170dc22ab5fe",
            "created": "2026-06-24T18:42:59.685933Z",
            "modified": "2026-06-24T18:42:59.685933Z",
            "name": "YARA Rule",
            "pattern": "rule Kimsuky_Blog_Harvest_DDNS_Config {\r\nmeta:\r\nauthor = \"Breakglass Intelligence\"\r\ndescription = \"Detects Kimsuky DDNS configuration patterns for blog/auth phishing\"\r\ndate = \"2026-04-17\"\r\nreference = \"https://intel.breakglass.tech\"\r\ntlp = \"CLEAR\"\r\nstrings:\r\n$ddns1 = \"dynv6.net\" ascii\r\n$ddns2 = \"mydns.bz\" ascii\r\n$ddns3 = \"dynuddns.com\" ascii\r\n$ddns4 = \"gleeze.com\" ascii\r\n$ddns5 = \"freeddns.org\" ascii\r\n$pattern1 = /auth-umblog\\d+s/ ascii\r\n$pattern2 = /chposting\\d+s/ ascii\r\n$pattern3 = /blogrighof\\d+id/ ascii\r\n$pattern4 = /mem-authcenter\\d+s/ ascii\r\n$pattern5 = /n[a-z]*verify\\.dynv6/ ascii\r\ncondition:\r\nfilesize < 1MB and (\r\n(2 of ($ddns*) and any of ($pattern*)) or\r\n(3 of ($pattern*))\r\n)\r\n}",
            "pattern_type": "yara",
            "valid_from": "2026-04-17T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--825b1eb4-cd5b-43de-8c43-b02ef72163e3",
            "created": "2026-06-24T18:42:59.686892Z",
            "modified": "2026-06-24T18:42:59.686892Z",
            "name": "YARA Rule",
            "pattern": "rule Kimsuky_Phishing_Kit_Glype_PHProxy {\r\nmeta:\r\nauthor = \"Breakglass Intelligence\"\r\ndescription = \"Detects Kimsuky modified Glype/PHProxy phishing kit components\"\r\ndate = \"2026-04-17\"\r\nreference = \"https://intel.breakglass.tech\"\r\nhash = \"fbb36c3173a4b467fcc7fea566b3ddf7e72af8d5e45a8fd505ec21e61d160df9\"\r\ntlp = \"CLEAR\"\r\nstrings:\r\n$glype1 = \"PHProxy\" ascii\r\n$glype2 = \"Glype\" ascii\r\n$glype3 = \"0.5b2\" ascii\r\n$nsec1 = \"Security Guard Code\" ascii\r\n$nsec2 = \"nsec.php\" ascii\r\n$nsec3 = \"Access Denied\" ascii\r\n$naver1 = \"naver.com\" ascii\r\n$naver2 = \"NID_JST\" ascii\r\n$naver3 = \"nid.naver\" ascii\r\n$recon1 = \"COMPUTERNAME\" ascii\r\n$recon2 = \"NUMBER_OF_PROCESSORS\" ascii\r\n$recon3 = \"confirm.php\" ascii\r\n$telegram = \"api.telegram.org\" ascii\r\n$korea1 = /nhis[a-z]*\\.(xyz|click|online|site)/ ascii\r\n$korea2 = \"hometax\" ascii nocase\r\n$korea3 = /nts[a-z]*\\.(site|com)/ ascii\r\ncondition:\r\nfilesize < 5MB and (\r\n(2 of ($glype*) and any of ($naver*)) or\r\n(any of ($nsec*) and any of ($naver*) and any of ($recon*)) or\r\n($telegram and any of ($naver*) and any of ($recon*)) or\r\n(2 of ($korea*) and any of ($nsec*))\r\n)\r\n}",
            "pattern_type": "yara",
            "valid_from": "2026-04-17T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f9f1ae55-d1bd-4d92-8a4b-3517845ed759",
            "hashes": {
                "SHA-1": "66af61e3e376284f691d449d0042e8b2c1174278"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--86d1ef63-388b-46d3-b97a-69eb6ddfd847",
            "hashes": {
                "MD5": "6f90f6b96fe3a5b79c1935211f557a08"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--16c1b1a8-9d4e-46e5-bb6c-7b356b00ee1e",
            "hashes": {
                "SHA-256": "7a3a72197574dcc653332f47bf4fb58606ecbc41deef33251ec5f4ec680be1d2"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--59907253-fd7b-4756-9229-216a79f5975c",
            "hashes": {
                "SHA-1": "6aa51c23f0319a6b940072274adf47a0c29f27b6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2b4603b6-67f8-472f-a3e2-f9266181a905",
            "hashes": {
                "MD5": "ac33ba08410f39cf13c9a08a01582bce"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--61e26c09-f002-4e0b-bd65-f9cf585eafad",
            "hashes": {
                "SHA-256": "86d278bf55d25df08ce3b1c46513c6e38da84bf143a059bdbb53c91c564ae211"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e7418458-6c9e-42c5-bd74-c9abaf698e17",
            "hashes": {
                "SHA-256": "261cfc8ccda28c89b225e442e094e572d5abe5ef2ef26d2269f8cfc0ece23b06"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--39f04ec3-0694-4303-aa64-f8137b6957a6",
            "hashes": {
                "SHA-256": "8d009fbbf5f634e1f715385fde3da14e54cce967eea18d1de5c5df08f9a8094d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0defbda4-60bf-4747-afac-40b12532d61a",
            "hashes": {
                "SHA-1": "f759ccb6886234c63a66abd6102c636a46d1eba8"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a10573da-d7cf-424d-a612-fe17e2d4a26a",
            "hashes": {
                "MD5": "08815400eb034d0c760d031e735bd392"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b8683b0f-b5cd-4ec9-a939-54e11cda7e73",
            "hashes": {
                "SHA-256": "419762fb355c722f749b689eae7c31084b82e7b8ea968bd970e423cbf56f89b5"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d3f8b92a-ccc4-4b69-b494-083c473d20ac",
            "hashes": {
                "SHA-1": "51ab17a51cc000bbae89980082c57281c4c0b462"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fbb46428-e38a-4f67-bb01-106e6f4afa62",
            "hashes": {
                "SHA-256": "fbb36c3173a4b467fcc7fea566b3ddf7e72af8d5e45a8fd505ec21e61d160df9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b8adf6bf-3b4e-49be-b853-c9fa0bf8bd58",
            "hashes": {
                "MD5": "6d03fd0b89fe997408b9e9e3d5ead602"
            }
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--f31ad28e-64ef-481e-a65b-8c6c9482a2ff",
            "value": "mailconnector@inbox.ru"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--18f04065-a296-41f7-ac4f-f16578caacf0",
            "value": "mail-linker@list.ru"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--8bca17a9-1b42-4d83-8817-114d82541252",
            "value": "notice-mail@list.ru"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--38fe8b0c-a059-4f00-943e-b92fe0a7a503",
            "value": "ain8494@naver.com"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--06234cd6-9b17-40db-8817-120841993c9f",
            "value": "linksend5@zohomail.com"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--3d620482-4391-40b2-8a2a-2e439d72bdc2",
            "value": "businessking1@zohomail.com"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--ab8bda24-9153-4dee-8f40-65f42abe6b92",
            "value": "logansmith1@zohomail.com"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--ffecda95-7042-4daf-8d3b-b0ae3bcc8f57",
            "value": "charleschoi1202@naver.com"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--165cf3d1-3ea6-4258-a013-e845c6e87135",
            "value": "linkzepto5@zohomail.com"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--54808e93-3706-496a-b658-c64604bfba21",
            "value": "mail-con@mail.ru"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--f6d55d6a-1971-4556-9e14-b9fa72a7b398",
            "value": "zeptolink3@zohomail.com"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--81ccfa2b-abd1-4306-8a15-d0e7723d18b4",
            "value": "mail-linker@mail.ru"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--4f7157cb-b4ad-4b40-9778-7ae9b75dd3e5",
            "value": "maildeliver@bk.ru"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--a139f031-06f9-4e66-8eb0-c1ed6c3cdca0",
            "value": "mailbox-service@list.ru"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--234083f6-6c70-4a73-96a1-f1869508c616",
            "value": "mail-linker@rambler.ru"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--573c217b-7aa1-4629-a7bf-420217be29c5",
            "value": "http://chk.uncork.biz/nportal/?wreply=ain8494@naver.com&m=qhfsmnav&nhn=1"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--8a6a505a-02e3-4254-9b7b-f6cbcabc326f",
            "value": "http://noreplymail.space/BitJoker/bootservice.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--ae76661c-7c66-4395-8306-f1ad072c13a4",
            "value": "http://check.nid-log.com/api/bootservice.php?tag=719&query=1"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--706eaba5-fc06-41cb-9ef5-3af3dc29cc72",
            "value": "reg.ru"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--b787247b-bd11-49ea-a83f-a12bcfa8b0c3",
            "value": "ncodbsverify.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--920f659e-b88a-47b3-88ff-4bb892b8337f",
            "value": "nid.ncodbvverify.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--aa6b8f45-e4fd-47d8-b8cc-4f89d2499a2f",
            "value": "ncodbvverify.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--c8b08484-82d0-4f34-b960-29403edc42eb",
            "value": "nhis-kr.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--fe396fa7-7522-4ee7-a061-5f925a097ac6",
            "value": "one1232.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--429758ca-1a43-401f-ba78-0028960e3e3d",
            "value": "ndocavverify.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--2678b92a-2c5d-44ab-9db6-146e49631074",
            "value": "ndocadverify.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--f268a0b6-61ad-4d54-8ca7-2365ce11b59f",
            "value": "belluster.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--9cdca8e2-e7c7-49fb-a6d7-81d3a6256c73",
            "value": "nhisnews.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--f91aa897-aec2-4d7b-b330-0e0d160a8fdc",
            "value": "nhispost.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--2c4d925e-109c-4f66-93ae-57fa11dd0bcd",
            "value": "backendapi.rootive.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--20a12f86-ed20-47f1-a4ed-99ce946e8d54",
            "value": "homestax.info"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d15ac0b3-65b0-4e80-becb-170a3e80e39d",
            "value": "gleeze.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--af3de233-bce8-476c-ac6c-93d35eb5824d",
            "value": "cafe.naver.one1232.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--b8d1363c-7c2d-484a-87b1-fd9da58116ae",
            "value": "dedyn.io"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--34fe3ae9-c983-4b02-a7bf-7d9d4ae7642b",
            "value": "dynuddns.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--051302aa-3da7-4ba1-bc1f-24c07973af6c",
            "value": "verify.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--82ed8fc9-67e5-4461-9aa0-3e73b1148888",
            "value": "id.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--07738540-2add-48ce-b83a-916d8a8b7759",
            "value": "s.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--05075d01-b982-43e1-b709-a370bd0c2e8e",
            "value": "ndocazverify.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--4cf5d86d-aa5e-4e3e-bcc5-99000d5576b7",
            "value": "ndocawverify.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--80d0de34-2195-41df-bebd-82bb9a6d0f9b",
            "value": "nhisposting.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--dc15c1c6-d3b9-4cfd-b127-a2658ab678c1",
            "value": "rootive.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--51816167-b85c-4635-a7dd-b648c44b56e1",
            "value": "freeddns.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--11fe3edb-7478-487f-aedb-bb933d28c330",
            "value": "api.rootive.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--f23876b7-b48d-4a3e-aed6-41dd48bc94af",
            "value": "ndocayverify.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--e2011954-a70a-4705-a4ef-044214e9144d",
            "value": "nid.ndocazverify.dynv6.net"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--6e4958c3-2df2-4cf7-bbe2-88763ee4e2eb",
            "value": "152.32.138.158"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--aa8e7157-8689-487c-a4e7-44a9f5a1dce8",
            "value": "175.115.14.22"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0a1efdc4-6db5-4101-8dc1-bdc38417ddce",
            "value": "158.247.197.123"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--b5a48f56-18dc-4adc-9ea9-47998d8b193a",
            "value": "101.36.114.168"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--aa741dd5-6d03-4fbb-ba2a-4da9478bccea",
            "value": "165.154.52.8"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--42a70f02-1a4e-4988-b96f-d735192d73a2",
            "value": "38.54.40.15"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--3d108e1d-24bc-4db2-9182-7a4d8f7bcd88",
            "value": "152.32.138.225"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a2b80ac-d4c2-466d-8a76-440175edf6c3",
            "value": "38.54.40.154"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--4e2caa9b-463c-4024-9348-d7288f939d58",
            "value": "150.241.80.3"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--d015ed1c-b0f9-49df-9a62-f85ace0cb0f7",
            "value": "158.247.227.83"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--3fef0d2c-754d-4f6a-aef8-7c5a51a97b72",
            "value": "38.60.220.64"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--d43536c9-1481-496b-a8f9-84d762f2d6f3",
            "value": "69.197.148.159"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--8a7e3b80-31b8-41ea-a60c-8ede0b56d487",
            "value": "141.164.61.168"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--de38d3bd-3aa9-4745-9928-6863d6fa9776",
            "value": "38.54.40.51"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--ccfedce0-f515-4a9d-bc6e-f6c8b0749d9c",
            "value": "158.247.239.225"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a353e8a-4a05-4eeb-b334-6e9824bed915",
            "value": "118.193.68.25"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--863b468e-03b8-4ac7-85ca-a552f53ba07b",
            "value": "38.60.220.102"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fda9e16e-39d7-413f-a92c-48d0adeac45d",
            "hashes": {
                "SHA-256": "d7c09e7bf79aa9b786dcd9f870427f4a1110f702646fba9d3835215ad3649d0b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--71d4a92b-2fbe-4c7a-80d9-fa81b129ab1a",
            "hashes": {
                "SHA-256": "af50f35701916d3909f2727cdcbde1a7af47f46eb8db3996905b1c0725aa133f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2b8b1db8-a5c4-47e7-aafa-7f4f3f6d610c",
            "hashes": {
                "SHA-256": "85f8f8a3f28d2956776fbbd0365cdb78ac8dc1e6ed12818ef18caed0bb2f74c8"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5f3a998a-b12a-458a-b64b-71e228f6ac6e",
            "hashes": {
                "SHA-256": "a36576a096db24a1c91327eb547dedf52e5bd4b0d4593b88d9593d377585b922"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4ee135f9-30fb-4f11-b394-5d521d1633e9",
            "hashes": {
                "MD5": "0ac44ad9cfbc58ed76415f7bc79239f9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--cb0a79dc-07a2-47e1-b44a-7963fee27100",
            "hashes": {
                "SHA-256": "1eff237dee95172363bfc0342d0389f809f753a6ec5e6848e57b3fd5482e9793"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--efd3f77a-2cfd-4976-b7f7-7d56b4690634",
            "value": "http://check.nid-log.com/api/finalservice.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--3120d0ca-7813-44ed-b213-ab32775576b3",
            "value": "http://check.nid-log.com/api/bootservice.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--3a9b7c71-7304-4a8d-98f6-f48536a59eb1",
            "value": "http://check.nid-log.com/api/checkservice.php"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--676a1455-397b-433c-9313-0b7e34813c56",
            "value": "verify.efine-log.kro.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--c60215d6-55dc-44cc-8828-1cae3862b2bd",
            "value": "udalyonka.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--6e757a04-c1d4-4fb4-ab95-ed065ac945fe",
            "value": "nid-htl.duckdns.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a440ded0-b0fe-4f06-a21f-0ef13e7fea5f",
            "value": "nid-log.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--3d35e654-e604-4ee8-b02d-b027e25a5639",
            "value": "chk.uncork.biz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--45805335-4f66-42dc-bb85-f675a6b00ef7",
            "value": "nid-navertca.servehalflife.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a090db58-1c42-4213-b2c5-88eee79a7ae8",
            "value": "nid-naverpep.servequake.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--61bec915-044c-42aa-aa24-2d6074c8d935",
            "value": "nid-naverfxc.servecounterstrike.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--bd282170-9983-429c-ae88-554abd0bb6dd",
            "value": "uncork.biz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--895737f5-7398-44af-90f4-c812a3228fb5",
            "value": "nid-navercwu.servecounterstrike.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--bb6c2cbb-dba7-4635-9e0c-d5d51ca3fbc8",
            "value": "27.102.137.38"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--503b767c-4acf-47e9-91bc-112319f6471d",
            "value": "38.60.220.135"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--bec21ce9-bbca-44de-a61b-abb715fcc1dc",
            "value": "27.102.138.45"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--765df14f-7680-42c1-9cf1-60464e8dc26c",
            "value": "51.79.185.184"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--9d71e75b-d0b0-47b3-8f81-a82de69a6d96",
            "value": "130.94.29.111"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--f7114ad2-8010-4e56-bf4b-e8243c0596ab",
            "value": "27.102.137.150"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--cf97958b-28ca-4b9d-8f67-7c61175c2420",
            "value": "162.255.119.150"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--c6a79686-5a46-4d44-9d54-ecea59c4fee6",
            "value": "118.194.249.109"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--f7bed63d-6475-4bce-b9e4-b2e40be59938",
            "value": "158.247.240.40"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--50c3d08e-6fc8-46cb-a5c6-5ad067c1b531",
            "value": "158.247.230.196"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--ad3ac1f5-602e-46ac-bba1-aed1d3e0f944",
            "value": "158.247.202.109"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--60b73194-749a-4ffa-a6e8-32422c12e849",
            "value": "158.247.192.226"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--6fdf0c77-ee17-4091-adf0-1e37eabe834f",
            "value": "158.247.242.206"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--9d5b553c-acb1-479f-9f40-37e380a7d311",
            "value": "158.247.215.121"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--8471f81a-da6c-4f01-8d86-66f5f35acbac",
            "value": "158.247.204.137"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3dde23a3-d376-4ff5-9658-03602846108e",
            "hashes": {
                "SHA-256": "7047878f4fbea323148f6554afe616991eb56cc327653972c4213a9017c5e66b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7f7efb0e-4d8f-4994-8d74-cf928f3c8355",
            "hashes": {
                "SHA-1": "a76af8176da28fdab47f9a77d50eb0e89f2b8557"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--db5d8d55-587f-447a-9416-ed1666719260",
            "hashes": {
                "MD5": "4599ac1bbe483c73064df1353feafd01"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d25e2cd8-1d92-482c-a4a3-998eac6701ec",
            "value": "noreplymail.space"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--304c209f-9d17-4f34-9c8c-fcffdc62f99a",
            "value": "notice-mail@inbox.ru"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--eab3ca67-d73f-4071-83ca-d5dfdc651da6",
            "value": "mailsender2024@mail.ru"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--b5530a4f-adfc-4f52-8b4e-48f912eccba9",
            "value": "cfa4a551515dc742s@gmail.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--b9587bdb-0f93-42a9-9b87-d18d91699121",
            "value": "123.58.200.13"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--e92490d4-25b0-46c6-b4f3-8edad5451341",
            "value": "118.193.69.248"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--39bf67ec-164b-4c90-8f1e-a3dd899c9ba5",
            "value": "123.58.200.50"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5e714a0e-fe36-460a-a5f6-254229af72bc",
            "value": "118.193.68.146"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--80546a0f-d2a4-4048-a4a7-21929a4ff688",
            "value": "101.36.114.153"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--52710bb0-3710-49d6-ad26-c6b940701855",
            "value": "152.32.243.184"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--154a4632-9151-47cd-8c02-eed5a1eb2158",
            "value": "152.32.138.191"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--143a090d-6973-43b6-bc04-fb0e061e1a50",
            "value": "118.194.248.148"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--1d3b366a-92e2-493d-849b-89b30b2b311a",
            "value": "152.32.138.63"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--e65e22db-f880-425b-990f-2226a52a9fb1",
            "value": "152.32.243.153"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--f1b99616-9160-4cfd-acb7-2e59d0c98b4e",
            "value": "bk.ru"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--48e8c148-35bc-46c5-a48d-02ed372051e0",
            "value": "internet.ru"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d917f629-53d4-421c-83fb-b743e1c5d6bc",
            "value": "inbox.ru"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--ed3b2eab-87d2-4119-b1d1-6b7daba11bea",
            "value": "rambler.ru"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1",
            "created": "2026-06-24T18:42:59.74123Z",
            "modified": "2026-06-24T18:42:59.74123Z",
            "name": "Kimsuky"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--d96b4a50-54cc-4d60-92dd-1f336fe36ed8",
            "created_by_ref": "identity--48edf75c-7cd8-480a-8950-deb15067ea29",
            "created": "2026-06-24T18:42:59.790427Z",
            "modified": "2026-06-24T18:42:59.790427Z",
            "name": "850 Hostnames, 6 Servers, 1 Kill Chain: Mapping Kimsuky's 2026 Korean Credential Harvesting Machine",
            "published": "2026-04-17T00:00:00Z",
            "object_refs": [
                "identity--48edf75c-7cd8-480a-8950-deb15067ea29",
                "domain-name--92f1ca14-ed68-49df-a859-913d251f4304",
                "domain-name--382a9fb0-ebc4-4c9f-aeb2-4759c14c8c57",
                "domain-name--8cf711fd-0501-44c1-b820-d13e4612e23d",
                "ipv4-addr--683203f8-f74d-4f1f-98b1-00c8bd5c2687",
                "ipv4-addr--f3b3d0d8-ccae-4842-9a3d-230ff1ec1838",
                "ipv4-addr--3a4c0a8a-e483-43e2-b462-faa34e861739",
                "ipv4-addr--b1e16cfa-e2a3-4043-a957-1e44ddcac69a",
                "indicator--b45031c3-a4e1-4d42-a219-ab520afd21a7",
                "indicator--d3d7e1f0-f2aa-4976-838e-81c1cef2a3a3",
                "indicator--b9191d23-2d8d-4e3f-aa0c-170dc22ab5fe",
                "indicator--825b1eb4-cd5b-43de-8c43-b02ef72163e3",
                "file--f9f1ae55-d1bd-4d92-8a4b-3517845ed759",
                "file--86d1ef63-388b-46d3-b97a-69eb6ddfd847",
                "file--16c1b1a8-9d4e-46e5-bb6c-7b356b00ee1e",
                "file--59907253-fd7b-4756-9229-216a79f5975c",
                "file--2b4603b6-67f8-472f-a3e2-f9266181a905",
                "file--61e26c09-f002-4e0b-bd65-f9cf585eafad",
                "file--e7418458-6c9e-42c5-bd74-c9abaf698e17",
                "file--39f04ec3-0694-4303-aa64-f8137b6957a6",
                "file--0defbda4-60bf-4747-afac-40b12532d61a",
                "file--a10573da-d7cf-424d-a612-fe17e2d4a26a",
                "file--b8683b0f-b5cd-4ec9-a939-54e11cda7e73",
                "file--d3f8b92a-ccc4-4b69-b494-083c473d20ac",
                "file--fbb46428-e38a-4f67-bb01-106e6f4afa62",
                "file--b8adf6bf-3b4e-49be-b853-c9fa0bf8bd58",
                "email-addr--f31ad28e-64ef-481e-a65b-8c6c9482a2ff",
                "email-addr--18f04065-a296-41f7-ac4f-f16578caacf0",
                "email-addr--8bca17a9-1b42-4d83-8817-114d82541252",
                "email-addr--38fe8b0c-a059-4f00-943e-b92fe0a7a503",
                "email-addr--06234cd6-9b17-40db-8817-120841993c9f",
                "email-addr--3d620482-4391-40b2-8a2a-2e439d72bdc2",
                "email-addr--ab8bda24-9153-4dee-8f40-65f42abe6b92",
                "email-addr--ffecda95-7042-4daf-8d3b-b0ae3bcc8f57",
                "email-addr--165cf3d1-3ea6-4258-a013-e845c6e87135",
                "email-addr--54808e93-3706-496a-b658-c64604bfba21",
                "email-addr--f6d55d6a-1971-4556-9e14-b9fa72a7b398",
                "email-addr--81ccfa2b-abd1-4306-8a15-d0e7723d18b4",
                "email-addr--4f7157cb-b4ad-4b40-9778-7ae9b75dd3e5",
                "email-addr--a139f031-06f9-4e66-8eb0-c1ed6c3cdca0",
                "email-addr--234083f6-6c70-4a73-96a1-f1869508c616",
                "url--573c217b-7aa1-4629-a7bf-420217be29c5",
                "url--8a6a505a-02e3-4254-9b7b-f6cbcabc326f",
                "url--ae76661c-7c66-4395-8306-f1ad072c13a4",
                "domain-name--706eaba5-fc06-41cb-9ef5-3af3dc29cc72",
                "domain-name--b787247b-bd11-49ea-a83f-a12bcfa8b0c3",
                "domain-name--920f659e-b88a-47b3-88ff-4bb892b8337f",
                "domain-name--aa6b8f45-e4fd-47d8-b8cc-4f89d2499a2f",
                "domain-name--c8b08484-82d0-4f34-b960-29403edc42eb",
                "domain-name--fe396fa7-7522-4ee7-a061-5f925a097ac6",
                "domain-name--429758ca-1a43-401f-ba78-0028960e3e3d",
                "domain-name--2678b92a-2c5d-44ab-9db6-146e49631074",
                "domain-name--f268a0b6-61ad-4d54-8ca7-2365ce11b59f",
                "domain-name--9cdca8e2-e7c7-49fb-a6d7-81d3a6256c73",
                "domain-name--f91aa897-aec2-4d7b-b330-0e0d160a8fdc",
                "domain-name--2c4d925e-109c-4f66-93ae-57fa11dd0bcd",
                "domain-name--20a12f86-ed20-47f1-a4ed-99ce946e8d54",
                "domain-name--d15ac0b3-65b0-4e80-becb-170a3e80e39d",
                "domain-name--af3de233-bce8-476c-ac6c-93d35eb5824d",
                "domain-name--b8d1363c-7c2d-484a-87b1-fd9da58116ae",
                "domain-name--34fe3ae9-c983-4b02-a7bf-7d9d4ae7642b",
                "domain-name--051302aa-3da7-4ba1-bc1f-24c07973af6c",
                "domain-name--82ed8fc9-67e5-4461-9aa0-3e73b1148888",
                "domain-name--07738540-2add-48ce-b83a-916d8a8b7759",
                "domain-name--05075d01-b982-43e1-b709-a370bd0c2e8e",
                "domain-name--4cf5d86d-aa5e-4e3e-bcc5-99000d5576b7",
                "domain-name--80d0de34-2195-41df-bebd-82bb9a6d0f9b",
                "domain-name--dc15c1c6-d3b9-4cfd-b127-a2658ab678c1",
                "domain-name--51816167-b85c-4635-a7dd-b648c44b56e1",
                "domain-name--11fe3edb-7478-487f-aedb-bb933d28c330",
                "domain-name--f23876b7-b48d-4a3e-aed6-41dd48bc94af",
                "domain-name--e2011954-a70a-4705-a4ef-044214e9144d",
                "ipv4-addr--6e4958c3-2df2-4cf7-bbe2-88763ee4e2eb",
                "ipv4-addr--aa8e7157-8689-487c-a4e7-44a9f5a1dce8",
                "ipv4-addr--0a1efdc4-6db5-4101-8dc1-bdc38417ddce",
                "ipv4-addr--b5a48f56-18dc-4adc-9ea9-47998d8b193a",
                "ipv4-addr--aa741dd5-6d03-4fbb-ba2a-4da9478bccea",
                "ipv4-addr--42a70f02-1a4e-4988-b96f-d735192d73a2",
                "ipv4-addr--3d108e1d-24bc-4db2-9182-7a4d8f7bcd88",
                "ipv4-addr--5a2b80ac-d4c2-466d-8a76-440175edf6c3",
                "ipv4-addr--4e2caa9b-463c-4024-9348-d7288f939d58",
                "ipv4-addr--d015ed1c-b0f9-49df-9a62-f85ace0cb0f7",
                "ipv4-addr--3fef0d2c-754d-4f6a-aef8-7c5a51a97b72",
                "ipv4-addr--d43536c9-1481-496b-a8f9-84d762f2d6f3",
                "ipv4-addr--8a7e3b80-31b8-41ea-a60c-8ede0b56d487",
                "ipv4-addr--de38d3bd-3aa9-4745-9928-6863d6fa9776",
                "ipv4-addr--ccfedce0-f515-4a9d-bc6e-f6c8b0749d9c",
                "ipv4-addr--5a353e8a-4a05-4eeb-b334-6e9824bed915",
                "ipv4-addr--863b468e-03b8-4ac7-85ca-a552f53ba07b",
                "file--fda9e16e-39d7-413f-a92c-48d0adeac45d",
                "file--71d4a92b-2fbe-4c7a-80d9-fa81b129ab1a",
                "file--2b8b1db8-a5c4-47e7-aafa-7f4f3f6d610c",
                "file--5f3a998a-b12a-458a-b64b-71e228f6ac6e",
                "file--4ee135f9-30fb-4f11-b394-5d521d1633e9",
                "file--cb0a79dc-07a2-47e1-b44a-7963fee27100",
                "url--efd3f77a-2cfd-4976-b7f7-7d56b4690634",
                "url--3120d0ca-7813-44ed-b213-ab32775576b3",
                "url--3a9b7c71-7304-4a8d-98f6-f48536a59eb1",
                "domain-name--676a1455-397b-433c-9313-0b7e34813c56",
                "domain-name--c60215d6-55dc-44cc-8828-1cae3862b2bd",
                "domain-name--6e757a04-c1d4-4fb4-ab95-ed065ac945fe",
                "domain-name--a440ded0-b0fe-4f06-a21f-0ef13e7fea5f",
                "domain-name--3d35e654-e604-4ee8-b02d-b027e25a5639",
                "domain-name--45805335-4f66-42dc-bb85-f675a6b00ef7",
                "domain-name--a090db58-1c42-4213-b2c5-88eee79a7ae8",
                "domain-name--61bec915-044c-42aa-aa24-2d6074c8d935",
                "domain-name--bd282170-9983-429c-ae88-554abd0bb6dd",
                "domain-name--895737f5-7398-44af-90f4-c812a3228fb5",
                "ipv4-addr--bb6c2cbb-dba7-4635-9e0c-d5d51ca3fbc8",
                "ipv4-addr--503b767c-4acf-47e9-91bc-112319f6471d",
                "ipv4-addr--bec21ce9-bbca-44de-a61b-abb715fcc1dc",
                "ipv4-addr--765df14f-7680-42c1-9cf1-60464e8dc26c",
                "ipv4-addr--9d71e75b-d0b0-47b3-8f81-a82de69a6d96",
                "ipv4-addr--f7114ad2-8010-4e56-bf4b-e8243c0596ab",
                "ipv4-addr--cf97958b-28ca-4b9d-8f67-7c61175c2420",
                "ipv4-addr--c6a79686-5a46-4d44-9d54-ecea59c4fee6",
                "ipv4-addr--f7bed63d-6475-4bce-b9e4-b2e40be59938",
                "ipv4-addr--50c3d08e-6fc8-46cb-a5c6-5ad067c1b531",
                "ipv4-addr--ad3ac1f5-602e-46ac-bba1-aed1d3e0f944",
                "ipv4-addr--60b73194-749a-4ffa-a6e8-32422c12e849",
                "ipv4-addr--6fdf0c77-ee17-4091-adf0-1e37eabe834f",
                "ipv4-addr--9d5b553c-acb1-479f-9f40-37e380a7d311",
                "ipv4-addr--8471f81a-da6c-4f01-8d86-66f5f35acbac",
                "file--3dde23a3-d376-4ff5-9658-03602846108e",
                "file--7f7efb0e-4d8f-4994-8d74-cf928f3c8355",
                "file--db5d8d55-587f-447a-9416-ed1666719260",
                "domain-name--d25e2cd8-1d92-482c-a4a3-998eac6701ec",
                "email-addr--304c209f-9d17-4f34-9c8c-fcffdc62f99a",
                "email-addr--eab3ca67-d73f-4071-83ca-d5dfdc651da6",
                "email-addr--b5530a4f-adfc-4f52-8b4e-48f912eccba9",
                "ipv4-addr--b9587bdb-0f93-42a9-9b87-d18d91699121",
                "ipv4-addr--e92490d4-25b0-46c6-b4f3-8edad5451341",
                "ipv4-addr--39bf67ec-164b-4c90-8f1e-a3dd899c9ba5",
                "ipv4-addr--5e714a0e-fe36-460a-a5f6-254229af72bc",
                "ipv4-addr--80546a0f-d2a4-4048-a4a7-21929a4ff688",
                "ipv4-addr--52710bb0-3710-49d6-ad26-c6b940701855",
                "ipv4-addr--154a4632-9151-47cd-8c02-eed5a1eb2158",
                "ipv4-addr--143a090d-6973-43b6-bc04-fb0e061e1a50",
                "ipv4-addr--1d3b366a-92e2-493d-849b-89b30b2b311a",
                "ipv4-addr--e65e22db-f880-425b-990f-2226a52a9fb1",
                "domain-name--f1b99616-9160-4cfd-acb7-2e59d0c98b4e",
                "domain-name--48e8c148-35bc-46c5-a48d-02ed372051e0",
                "domain-name--d917f629-53d4-421c-83fb-b743e1c5d6bc",
                "domain-name--ed3b2eab-87d2-4119-b1d1-6b7daba11bea",
                "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://intel.breakglass.tech/post/kimsuky-2026-korea-840-hostnames-5-nodes"
                }
            ]
        }
    ]
}