{
    "type": "bundle",
    "id": "bundle--c7917a93-fc8b-452b-97d7-a5dadfd2eb1c",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--d77a1b51-7097-4165-9e36-215abb0d1d5f",
            "created": "2026-04-28T04:28:20.103998Z",
            "modified": "2026-04-28T04:29:25.463057Z",
            "name": "ArcticWolf",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f47ec552-f246-45e7-977a-e70dc82dfab2",
            "hashes": {
                "SHA-256": "17158cd6490a2b3c672d087f3d69107643d6a6f7c67345461b10ae18f27e28d1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d9e874a8-4265-4c5b-a1f9-9fca3169c338",
            "hashes": {
                "SHA-256": "6030338469819129924c6e01e110145a128ca3d944cd4b696abc7925a1840001"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d93f1503-26ae-4367-8553-c6051be87c50",
            "hashes": {
                "SHA-256": "db446f0e1d18b43805bfefe1af934ae4b0879e376904635cc7e14eae2d7fc682"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--291fee96-8d7b-41d2-802a-ab93fff98fae",
            "hashes": {
                "SHA-256": "dd1c72823f933952619cbb86aaeaea43057a259e9a0c9e3b11c82225ec3faaa1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6edc7286-0579-47b6-aed4-6b8573bc5d96",
            "hashes": {
                "SHA-256": "a37cb38b178833f15bf13fd5fa622b694c2244230ac0be33e75680c71dc08a08"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f1b4b70b-5a23-4b57-8312-2183b703e4a9",
            "hashes": {
                "SHA-256": "edd0301ffb793169b1314c59c0ef3a98d5793c0441dd43a7c484d61deb4f107f"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--5e001f4b-9725-4d77-bb90-ccd441767315",
            "value": "http://check02id.com:7365/hello"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--0d5ee9ec-6d5b-4c3f-96ba-e9d96be32874",
            "value": "https://uu03webzoom.us/developer/sdk/fix/2/version/Ivo55HpFm"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--a31ce14d-f8b2-49c6-ad6b-422b3ab7f026",
            "value": "https://uu03webzoom.us/j/8969791763?pwd="
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--39dedeb1-6d19-4878-b7d2-20291a7c04cb",
            "value": "thriddata.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d9cdd4a8-5b79-4429-9614-3f692b6d4466",
            "value": "teams-live.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--99097a0e-c83a-4929-ac63-ba940e3863e2",
            "value": "uu03webzoom.us"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--dd507784-2b55-4ceb-892b-dc909857f868",
            "value": "support.teams-live.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--247c4fb3-811d-4834-acd1-4e9c86ee3fdf",
            "value": "nubit.teams-live.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--4a2974a6-44ce-4160-8b42-4ba5b7990474",
            "value": "check02id.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0085aeac-5fe7-413f-81c0-e6d00e5a5622",
            "value": "83.136.209.22"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--cff26c12-ab46-45de-983a-273ba98c382d",
            "value": "83.136.208.246"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--9f09d49f-5595-4aee-9644-3249a16bf133",
            "value": "104.145.210.107"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--4a56ba15-5849-4f6b-a5b7-e87a0c85f5e5",
            "value": "188.227.197.32"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a028af73-b12e-47e6-b8f5-458cf6f2b4e0",
            "value": "ms-live.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--29d61b4d-d2c9-4922-aa2f-b8784acb9d97",
            "value": "web01zoom.com"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--f7f0d913-f17b-5632-a48a-76b4eef8a1cb",
            "created": "2026-06-24T16:06:12.935624Z",
            "modified": "2026-06-24T16:06:12.935624Z",
            "name": "Bluenoroff"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--fe3d594e-b935-418b-8048-b0a1be5a0031",
            "created_by_ref": "identity--d77a1b51-7097-4165-9e36-215abb0d1d5f",
            "created": "2026-06-24T16:06:12.939759Z",
            "modified": "2026-06-24T16:06:12.939759Z",
            "name": "BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector",
            "published": "2026-04-27T00:00:00Z",
            "object_refs": [
                "identity--d77a1b51-7097-4165-9e36-215abb0d1d5f",
                "file--f47ec552-f246-45e7-977a-e70dc82dfab2",
                "file--d9e874a8-4265-4c5b-a1f9-9fca3169c338",
                "file--d93f1503-26ae-4367-8553-c6051be87c50",
                "file--291fee96-8d7b-41d2-802a-ab93fff98fae",
                "file--6edc7286-0579-47b6-aed4-6b8573bc5d96",
                "file--f1b4b70b-5a23-4b57-8312-2183b703e4a9",
                "url--5e001f4b-9725-4d77-bb90-ccd441767315",
                "url--0d5ee9ec-6d5b-4c3f-96ba-e9d96be32874",
                "url--a31ce14d-f8b2-49c6-ad6b-422b3ab7f026",
                "domain-name--39dedeb1-6d19-4878-b7d2-20291a7c04cb",
                "domain-name--d9cdd4a8-5b79-4429-9614-3f692b6d4466",
                "domain-name--99097a0e-c83a-4929-ac63-ba940e3863e2",
                "domain-name--dd507784-2b55-4ceb-892b-dc909857f868",
                "domain-name--247c4fb3-811d-4834-acd1-4e9c86ee3fdf",
                "domain-name--4a2974a6-44ce-4160-8b42-4ba5b7990474",
                "ipv4-addr--0085aeac-5fe7-413f-81c0-e6d00e5a5622",
                "ipv4-addr--cff26c12-ab46-45de-983a-273ba98c382d",
                "ipv4-addr--9f09d49f-5595-4aee-9644-3249a16bf133",
                "ipv4-addr--4a56ba15-5849-4f6b-a5b7-e87a0c85f5e5",
                "domain-name--a028af73-b12e-47e6-b8f5-458cf6f2b4e0",
                "domain-name--29d61b4d-d2c9-4922-aa2f-b8784acb9d97",
                "threat-actor--f7f0d913-f17b-5632-a48a-76b4eef8a1cb"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://arcticwolf.com/resources/blog/bluenoroff-uses-clickfix-fileless-powershell-and-ai-generated-zoom-meetings-to-target-web3-sector/"
                }
            ]
        }
    ]
}