{
    "type": "bundle",
    "id": "bundle--5e1373b5-d929-45ba-8551-0a798f309876",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--0c5262d6-a544-4758-b214-c1a416d6028e",
            "created": "2023-03-30T22:51:38.926787Z",
            "modified": "2024-09-18T02:59:36.415321Z",
            "name": "Elastic",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--81e15b0d-8d0f-49bd-84e0-54434be33453",
            "hashes": {
                "SHA-256": "2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--aee07b4a-10db-4491-b614-baca2f050ac8",
            "value": "23.254.226.90"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--fbf5f072-88f5-4a66-8d09-6492e64e78d4",
            "value": "tp-globa.xyz"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--b03c3a07-d86c-40d7-a057-ca7eb7c5ced8",
            "value": "192.119.64.43"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--74a088ab-2f98-47c5-a323-336bec6a1a4e",
            "hashes": {
                "SHA-1": "5555494485b460f1e2343dffaef9b94d01136320"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--767dbcc5-5f69-4c1f-b8b0-dd33c571acc0",
            "value": "docsenddata.linkpc.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--692b18ec-73c4-46d6-8396-b8efd59e68e9",
            "value": "jobintro.linkpc.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a3b31937-c905-4437-a332-f6577cc269cc",
            "value": "bitscrunnch.linkpc.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--16c13ea7-a021-46ce-ae2c-701af6a01ce2",
            "value": "docsendinfo.linkpc.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--83932b44-635f-47e9-896e-be3ba43aead9",
            "value": "pesnam.publicvm.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--abf698a7-ec65-4d2a-8138-914a84d50db0",
            "value": "jobdescription.linkpc.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--317b3da1-edcb-4044-81e2-e0fb97624327",
            "value": "exodus.linkpc.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--61775fe4-6c01-41d8-b658-433424c07bbb",
            "value": "datasend.linkpc.net"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--7c89b3a8-1f62-5d97-9624-99b3cdd42afd",
            "created": "2026-06-24T19:53:01.652631Z",
            "modified": "2026-06-24T19:53:01.652631Z",
            "name": "REF7001"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--1ea4ca03-7b67-4d37-a014-8efb285ff7b2",
            "created_by_ref": "identity--0c5262d6-a544-4758-b214-c1a416d6028e",
            "created": "2026-06-24T19:53:01.653692Z",
            "modified": "2026-06-24T19:53:01.653692Z",
            "name": "Elastic catches DPRK passing out KANDYKORN",
            "published": "2023-11-01T00:00:00Z",
            "object_refs": [
                "identity--0c5262d6-a544-4758-b214-c1a416d6028e",
                "file--81e15b0d-8d0f-49bd-84e0-54434be33453",
                "ipv4-addr--aee07b4a-10db-4491-b614-baca2f050ac8",
                "domain-name--fbf5f072-88f5-4a66-8d09-6492e64e78d4",
                "ipv4-addr--b03c3a07-d86c-40d7-a057-ca7eb7c5ced8",
                "file--74a088ab-2f98-47c5-a323-336bec6a1a4e",
                "domain-name--767dbcc5-5f69-4c1f-b8b0-dd33c571acc0",
                "domain-name--692b18ec-73c4-46d6-8396-b8efd59e68e9",
                "domain-name--a3b31937-c905-4437-a332-f6577cc269cc",
                "domain-name--16c13ea7-a021-46ce-ae2c-701af6a01ce2",
                "domain-name--83932b44-635f-47e9-896e-be3ba43aead9",
                "domain-name--abf698a7-ec65-4d2a-8138-914a84d50db0",
                "domain-name--317b3da1-edcb-4044-81e2-e0fb97624327",
                "domain-name--61775fe4-6c01-41d8-b658-433424c07bbb",
                "threat-actor--7c89b3a8-1f62-5d97-9624-99b3cdd42afd"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn"
                }
            ]
        }
    ]
}