{
    "type": "bundle",
    "id": "bundle--4da4bd73-9779-40bb-acb2-8d413dbedc21",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--018ab958-b94d-441e-991f-a101a5144848",
            "created": "2023-03-08T12:51:42.869471Z",
            "modified": "2024-11-07T23:01:18.079469Z",
            "name": "SentinelOne",
            "identity_class": "organization"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--8b556e06-b4eb-47ee-8b43-c208b7f6dd0f",
            "value": "104.168.214.151"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--aee07b4a-10db-4491-b614-baca2f050ac8",
            "value": "23.254.226.90"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--fc08c8af-f138-4aaa-99f4-256282877f34",
            "value": "on-global.xyz"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--581a4904-2a6d-4041-ab53-06d9e5b35325",
            "hashes": {
                "SHA-1": "62267b88fa6393bc1f1eeb778e4da6b564b7011e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--dbbc63b5-76b2-4f1a-8990-525f1a3e7086",
            "hashes": {
                "SHA-1": "e275deb68cdff336cb4175819a09dbaf0e1b68f6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8ffb93ae-69b4-4676-bddb-062d02fa00f8",
            "hashes": {
                "SHA-1": "26ec4630b4d1116e131c8e2002e9a3ec7494a5cf"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--cf0359f9-108e-4fbe-b89c-30b9b417b03e",
            "hashes": {
                "SHA-1": "060a5d189ccf3fc32a758f1e218f814f6ce81744"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ddaf3c4b-5437-40d9-9b7b-67cfa001c9ef",
            "hashes": {
                "SHA-1": "a1a8a855f64a6b530f5116a3785a693d78ec09c0"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d73d26ff-a00d-487a-8ba0-6d8617b19bd3",
            "hashes": {
                "SHA-1": "5c93052713f317431bf232a2894658a3a4ebfad9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--97d39533-bc58-4512-bc16-7fbb727273df",
            "hashes": {
                "SHA-1": "c806c7006950dea6c20d3d2800fe46d9350266b6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--99e5f867-ac57-4a2c-b534-3d819ce94347",
            "hashes": {
                "SHA-1": "d28830d87fc71091f003818ef08ff0b723b3f358"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--23e253b2-a99e-4d58-9973-e55c77fb9cb2",
            "hashes": {
                "SHA-1": "9f97edbc1454ef66d6095f979502d17067215a9d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7c975b49-6954-4f61-a0f3-e264c6ff68ba",
            "hashes": {
                "SHA-1": "ac336c5082c2606ab8c3fb023949dfc0db2064d5"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--bc51a4bb-2c49-48e9-801e-8221505ba4ec",
            "hashes": {
                "SHA-1": "ce3705baf097cd95f8f696f330372dd00996d29a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b22cca02-9cb4-441c-af54-2fb344ba4273",
            "hashes": {
                "SHA-1": "e68bfa72a4b4289a4cc688e81f9282b1f78ebc1f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f3a61e3a-001f-49ac-bc5d-7c4329ffbff8",
            "hashes": {
                "SHA-1": "e77270ac0ea05496dd5a2fbccba3e24eb9b863d9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f4991239-cdd5-4f61-b148-198b494810df",
            "hashes": {
                "SHA-1": "884cebf1ad0e65f4da60c04bc31f62f796f90d79"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--bbbab1b2-cd8a-46df-8073-57897d7ce520",
            "hashes": {
                "SHA-1": "09ade0cb777f4a4e0682309a4bc1d0f7d4d7a036"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--25d0cc0c-e84b-4d04-91b6-bd3580deb76b",
            "hashes": {
                "SHA-1": "8f6c52d7e82fbfdead3d66ad8c52b372cc9e8b18"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--bd8babdc-f2b4-45e5-b750-067d46580d13",
            "hashes": {
                "SHA-1": "be903ded39cbc8332cefd9ebbe7a66d95e9d6522"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--eeed8ddb-7119-46d4-928f-d31c2b718611",
            "hashes": {
                "SHA-1": "3c887ece654ea46b1778d3c7a8a6a7c7c7cfa61c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--42c04370-eedc-4ef6-af21-b69ca3bb9754",
            "hashes": {
                "SHA-1": "46ac6dc34fc164525e6f7886c8ed5a79654f3fd3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--aa2cd22a-8146-48b1-8cef-0479bd4e3d3a",
            "hashes": {
                "SHA-1": "43f987c15ae67b1183c4c442dc3b784faf2df090"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--30267f09-6f99-45f2-a4d9-7bd1f6532623",
            "hashes": {
                "SHA-1": "e244ff1d8e66558a443610200476f98f653b8519"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3bee0e1a-60b9-4b1d-83fc-7d856ec2fb98",
            "hashes": {
                "SHA-1": "8d5d214c490eae8f61325839fcc17277e514301e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6c7d7fb2-3de1-4f59-8183-b527151a19c8",
            "hashes": {
                "SHA-1": "c45f514a252632cb3851fe45bed34b175370d594"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--f123f178-9bc3-4989-9f20-47bbf6f132fd",
            "value": "http://on-global.xyz/Of56cYsfVV8/OJITWH2WFx/Jy5S7hSx0K/fP7saoiPBc/A%3D%3D"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--eca1c2a6-7b34-43ba-a340-bba6ccf82c8f",
            "value": "https://swissborg.blog/tx/10299301992/hash"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--a21162a8-f9dc-4b86-a76d-cde28ca0cf51",
            "value": "http://docs-send.online/getBalance/usdt/ethereum"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--01b16d11-a50c-4abd-82a0-1ec4379c3e5c",
            "value": "http://tp-globa.xyz/OdhLca1mLUp/lZ5rZPxWsh/7yZKYQI43S/fP7savDX6c/bfC"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--9f6e7799-0656-4304-b0fb-a9fe7f1af63b",
            "value": "tp.globa.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--53ec4479-8287-4c4a-b89d-1f95bb01fa95",
            "value": "docs-send.online"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--aeaad8ee-db98-4860-a37f-54618d79d2e7",
            "value": "142.11.209.144"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3746f017-9e4e-47fe-a469-a9999da43a44",
            "hashes": {
                "SHA-1": "79337ccda23c67f8cfd9f43a6d3cf05fd01d1588"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--65b26604-c9ea-4f80-a480-2c6fda6e6d84",
            "value": "http://swissborg.blog/zxcv/bnm"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d0bec29f-e067-45bb-b95d-f9ecc1f03673",
            "value": "swissborg.blog"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--fbf5f072-88f5-4a66-8d09-6492e64e78d4",
            "value": "tp-globa.xyz"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--b03c3a07-d86c-40d7-a057-ca7eb7c5ced8",
            "value": "192.119.64.43"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--f7f0d913-f17b-5632-a48a-76b4eef8a1cb",
            "created": "2026-06-24T22:42:15.453541Z",
            "modified": "2026-06-24T22:42:15.453541Z",
            "name": "Bluenoroff"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--961f61a1-e9b8-46ac-9c81-618cfcd0d68b",
            "created_by_ref": "identity--018ab958-b94d-441e-991f-a101a5144848",
            "created": "2026-06-24T22:42:15.458769Z",
            "modified": "2026-06-24T22:42:15.458769Z",
            "name": "DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads",
            "published": "2023-11-27T00:00:00Z",
            "object_refs": [
                "identity--018ab958-b94d-441e-991f-a101a5144848",
                "ipv4-addr--8b556e06-b4eb-47ee-8b43-c208b7f6dd0f",
                "ipv4-addr--aee07b4a-10db-4491-b614-baca2f050ac8",
                "domain-name--fc08c8af-f138-4aaa-99f4-256282877f34",
                "file--581a4904-2a6d-4041-ab53-06d9e5b35325",
                "file--dbbc63b5-76b2-4f1a-8990-525f1a3e7086",
                "file--8ffb93ae-69b4-4676-bddb-062d02fa00f8",
                "file--cf0359f9-108e-4fbe-b89c-30b9b417b03e",
                "file--ddaf3c4b-5437-40d9-9b7b-67cfa001c9ef",
                "file--d73d26ff-a00d-487a-8ba0-6d8617b19bd3",
                "file--97d39533-bc58-4512-bc16-7fbb727273df",
                "file--99e5f867-ac57-4a2c-b534-3d819ce94347",
                "file--23e253b2-a99e-4d58-9973-e55c77fb9cb2",
                "file--7c975b49-6954-4f61-a0f3-e264c6ff68ba",
                "file--bc51a4bb-2c49-48e9-801e-8221505ba4ec",
                "file--b22cca02-9cb4-441c-af54-2fb344ba4273",
                "file--f3a61e3a-001f-49ac-bc5d-7c4329ffbff8",
                "file--f4991239-cdd5-4f61-b148-198b494810df",
                "file--bbbab1b2-cd8a-46df-8073-57897d7ce520",
                "file--25d0cc0c-e84b-4d04-91b6-bd3580deb76b",
                "file--bd8babdc-f2b4-45e5-b750-067d46580d13",
                "file--eeed8ddb-7119-46d4-928f-d31c2b718611",
                "file--42c04370-eedc-4ef6-af21-b69ca3bb9754",
                "file--aa2cd22a-8146-48b1-8cef-0479bd4e3d3a",
                "file--30267f09-6f99-45f2-a4d9-7bd1f6532623",
                "file--3bee0e1a-60b9-4b1d-83fc-7d856ec2fb98",
                "file--6c7d7fb2-3de1-4f59-8183-b527151a19c8",
                "url--f123f178-9bc3-4989-9f20-47bbf6f132fd",
                "url--eca1c2a6-7b34-43ba-a340-bba6ccf82c8f",
                "url--a21162a8-f9dc-4b86-a76d-cde28ca0cf51",
                "url--01b16d11-a50c-4abd-82a0-1ec4379c3e5c",
                "domain-name--9f6e7799-0656-4304-b0fb-a9fe7f1af63b",
                "domain-name--53ec4479-8287-4c4a-b89d-1f95bb01fa95",
                "ipv4-addr--aeaad8ee-db98-4860-a37f-54618d79d2e7",
                "file--3746f017-9e4e-47fe-a469-a9999da43a44",
                "url--65b26604-c9ea-4f80-a480-2c6fda6e6d84",
                "domain-name--d0bec29f-e067-45bb-b95d-f9ecc1f03673",
                "domain-name--fbf5f072-88f5-4a66-8d09-6492e64e78d4",
                "ipv4-addr--b03c3a07-d86c-40d7-a057-ca7eb7c5ced8",
                "threat-actor--f7f0d913-f17b-5632-a48a-76b4eef8a1cb"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.sentinelone.com/blog/dprk-crypto-theft-macos-rustbucket-droppers-pivot-to-deliver-kandykorn-payloads/"
                }
            ]
        }
    ]
}