{
    "type": "bundle",
    "id": "bundle--326760dc-49e8-42c5-ae82-43204e8727de",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--48edf75c-7cd8-480a-8950-deb15067ea29",
            "created": "2026-04-13T05:27:30.708162Z",
            "modified": "2026-04-22T01:03:40.519059Z",
            "name": "BreakGlassIntelligence",
            "identity_class": "organization"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--3fd157cc-4a2c-4f08-8153-7de2a5609ba3",
            "value": "nts-nid.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--f30f950c-25f8-4d70-8138-5b6f3cb520f7",
            "value": "n-cloud.nid-tax.kro.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--c0587bdb-41eb-4fd7-ade7-b9b402a9325c",
            "value": "tax-login.n-corp.kro.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--3120cc52-1cc4-40ed-bd3c-c37a4660f836",
            "value": "nts-user.mydns.jp"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--ccc71bc0-59ff-454e-ba05-a7065a087b2b",
            "value": "htax-auth.mydns.jp"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--9306f6e7-36e2-4984-bdf0-f3e87e94ec3f",
            "value": "nts-nid.n-login.kro.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--2df00875-2382-4cae-bce5-b075ce5170c0",
            "value": "govkr-tax.nid-auth.kro.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--e2ce4b16-ac61-49c5-846c-0c17ee60aab8",
            "value": "n-store.nskrm.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--9fcc53cb-66e4-494d-8c56-327fa3dce283",
            "value": "nid-nts.n-store.kro.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--0a4683b3-ef5c-4113-9bdc-7c02aad689f4",
            "value": "n-store.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--74a2e8cb-e705-481a-8ed9-10cf31406b9b",
            "value": "nid-gov.tax-store.kro.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--1954b085-c9e4-44b0-8bb9-5ee1cdf1ccc2",
            "value": "nts-login.n-auth.kro.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--82066558-23f5-4b2e-bf99-01f965d41711",
            "value": "n-store.nts-user.kro.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--e8965ce9-f62d-459a-9d6e-9b1987b765cd",
            "value": "anddynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--5c455165-17e7-4156-95ca-5aaaf45cac84",
            "value": "govkr-login.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--9a7a21b1-61fa-4f42-b884-0e26fe63aa72",
            "value": "n-login.mydns.jp"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--9a0bf51b-32bd-4f17-8238-e43900a76654",
            "value": "htax-login.n-cloud.kro.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--fd2c69a3-4398-4af3-a4c4-5dabe101bae9",
            "value": "htax-store.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--260b70d8-9ed4-423b-90b9-7cfbccaa94f7",
            "value": "nversg.mydns.jp"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--cd7c24cf-80c7-4f0e-94f9-f0c7fd9142cb",
            "value": "n-user.dynv6.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--c9f1ff87-ec99-4c12-9903-4576451d0cef",
            "value": "htax-user.govkr.kro.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--40bd5070-e55b-483c-872f-027eaa3b5d4b",
            "value": "mydns.jp"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--22de6e10-7b2c-400c-bb74-5f74dfdf6fd5",
            "value": "nid-tax.mydns.jp"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d87ac577-8189-4427-90d6-c00c1e4f2401",
            "value": "ntdersg.mydns.jp"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--8622ecd6-aec4-48e5-b6e5-01b183253db0",
            "value": "n-user.htax-auth.kro.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--5011227f-ad34-49c1-8f0a-8e7e7b16c000",
            "value": "johnnytogdstudio.xyz"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--b7b2a488-8342-4a38-af78-4ef9faec9f2a",
            "value": "158.247.210.58"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--3a4c0a8a-e483-43e2-b462-faa34e861739",
            "value": "158.247.219.150"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--b1e16cfa-e2a3-4043-a957-1e44ddcac69a",
            "value": "158.247.250.37"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1",
            "created": "2026-06-24T18:44:47.028031Z",
            "modified": "2026-06-24T18:44:47.028031Z",
            "name": "Kimsuky"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--d877c513-a9fe-4205-af8e-b2b684a06a99",
            "created_by_ref": "identity--48edf75c-7cd8-480a-8950-deb15067ea29",
            "created": "2026-06-24T18:44:47.029129Z",
            "modified": "2026-06-24T18:44:47.029129Z",
            "name": "A Third Vultr Seoul Box: 60+ Kimsuky Domains, 18 Months of DDNS Rotation, and a 5-Year Infrastructure Trail",
            "published": "2026-04-21T00:00:00Z",
            "object_refs": [
                "identity--48edf75c-7cd8-480a-8950-deb15067ea29",
                "domain-name--3fd157cc-4a2c-4f08-8153-7de2a5609ba3",
                "domain-name--f30f950c-25f8-4d70-8138-5b6f3cb520f7",
                "domain-name--c0587bdb-41eb-4fd7-ade7-b9b402a9325c",
                "domain-name--3120cc52-1cc4-40ed-bd3c-c37a4660f836",
                "domain-name--ccc71bc0-59ff-454e-ba05-a7065a087b2b",
                "domain-name--9306f6e7-36e2-4984-bdf0-f3e87e94ec3f",
                "domain-name--2df00875-2382-4cae-bce5-b075ce5170c0",
                "domain-name--e2ce4b16-ac61-49c5-846c-0c17ee60aab8",
                "domain-name--9fcc53cb-66e4-494d-8c56-327fa3dce283",
                "domain-name--0a4683b3-ef5c-4113-9bdc-7c02aad689f4",
                "domain-name--74a2e8cb-e705-481a-8ed9-10cf31406b9b",
                "domain-name--1954b085-c9e4-44b0-8bb9-5ee1cdf1ccc2",
                "domain-name--82066558-23f5-4b2e-bf99-01f965d41711",
                "domain-name--e8965ce9-f62d-459a-9d6e-9b1987b765cd",
                "domain-name--5c455165-17e7-4156-95ca-5aaaf45cac84",
                "domain-name--9a7a21b1-61fa-4f42-b884-0e26fe63aa72",
                "domain-name--9a0bf51b-32bd-4f17-8238-e43900a76654",
                "domain-name--fd2c69a3-4398-4af3-a4c4-5dabe101bae9",
                "domain-name--260b70d8-9ed4-423b-90b9-7cfbccaa94f7",
                "domain-name--cd7c24cf-80c7-4f0e-94f9-f0c7fd9142cb",
                "domain-name--c9f1ff87-ec99-4c12-9903-4576451d0cef",
                "domain-name--40bd5070-e55b-483c-872f-027eaa3b5d4b",
                "domain-name--22de6e10-7b2c-400c-bb74-5f74dfdf6fd5",
                "domain-name--d87ac577-8189-4427-90d6-c00c1e4f2401",
                "domain-name--8622ecd6-aec4-48e5-b6e5-01b183253db0",
                "domain-name--5011227f-ad34-49c1-8f0a-8e7e7b16c000",
                "ipv4-addr--b7b2a488-8342-4a38-af78-4ef9faec9f2a",
                "ipv4-addr--3a4c0a8a-e483-43e2-b462-faa34e861739",
                "ipv4-addr--b1e16cfa-e2a3-4043-a957-1e44ddcac69a",
                "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://intel.breakglass.tech/post/kimsuky-third-vultr-seoul-60-domains-ddns-rotation-naver-nts"
                }
            ]
        }
    ]
}