{
    "type": "bundle",
    "id": "bundle--8b86ef9e-5608-4797-acca-a75f66c495f5",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--d6060d27-a078-4b68-808e-0f825436ce05",
            "created": "2025-02-20T01:00:01.713031Z",
            "modified": "2025-02-20T01:01:57.020342Z",
            "name": "ENKI",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1baaa52b-b182-4645-8f59-25f145e71784",
            "hashes": {
                "SHA-256": "603deb15153a715e2b73aef3857d758b1f552c573e6158d72d9811a33914defe"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--596b23a9-1404-4502-8326-9b4de878a9cd",
            "hashes": {
                "MD5": "efa3c987532cc0bdac533845ad8df5ea"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--18e6e84b-ec1c-46dc-a643-09591bec1950",
            "hashes": {
                "SHA-256": "d03deb92153a71458973aef3857d75b27e552cc63e6158a8339811873994de47"
            }
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--4a75ee63-b48b-49d0-b380-270b549eb5e2",
            "value": "hiaei84@gmail.com"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--14f9eb90-94c2-464a-bb19-2d5c08ef179d",
            "value": "cimoon185@daum.net"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--947e58d9-a613-48c4-9bee-1d96b0f08cd0",
            "value": "https://mail.yonsei.ac.kr/common/json/agent.do"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--b711289d-e830-47fb-99aa-7594545d3a1d",
            "value": "amiunique.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--aeffd40b-3bea-4d4a-84c2-df66533f1438",
            "value": "togoogle.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--1023a3c7-f515-45ee-a02a-bfda8ff24aa9",
            "value": "service.navers.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--09b2bcd6-2b9a-44cf-a660-90e101cd92ff",
            "value": "toftp.fu-berlin.de"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a1c8592a-9946-4451-b3d0-6cf0f479b927",
            "value": "ongoogle.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d8163811-d0a4-43e3-80e6-893ffa089aa0",
            "value": "acfun.cn"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--6bbb00bc-efbe-4dde-8bae-cfbc3958f783",
            "value": "payload.info"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0575410f-9e82-499d-8df0-2f2bdd48f5f1",
            "value": "45.133.194.126"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--90407d40-dd85-4a59-8f53-cdc8ba31eb4b",
            "value": "45.133.194.88"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--6caf9695-d536-4ca5-92eb-66deced99f98",
            "value": "nid.navermails.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--84c258c7-4e35-4880-9b3f-01f379a87588",
            "value": "nid-security.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--8a585f06-3c83-427f-be18-1c152a1bcf8a",
            "value": "203.234.192.200"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--d9029605-8dc3-4062-87ad-e78fbb47c16a",
            "value": "27.255.80.170"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1",
            "created": "2026-06-25T00:00:09.281939Z",
            "modified": "2026-06-25T00:00:09.281939Z",
            "name": "Kimsuky"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--c5033710-390c-4d8b-a413-ca687165a05b",
            "created_by_ref": "identity--d6060d27-a078-4b68-808e-0f825436ce05",
            "created": "2026-06-25T00:00:09.285488Z",
            "modified": "2026-06-25T00:00:09.285488Z",
            "name": "In-Depth Analysis of the APT Down - The North Korea Files leak",
            "published": "2025-09-22T00:00:00Z",
            "object_refs": [
                "identity--d6060d27-a078-4b68-808e-0f825436ce05",
                "file--1baaa52b-b182-4645-8f59-25f145e71784",
                "file--596b23a9-1404-4502-8326-9b4de878a9cd",
                "file--18e6e84b-ec1c-46dc-a643-09591bec1950",
                "email-addr--4a75ee63-b48b-49d0-b380-270b549eb5e2",
                "email-addr--14f9eb90-94c2-464a-bb19-2d5c08ef179d",
                "url--947e58d9-a613-48c4-9bee-1d96b0f08cd0",
                "domain-name--b711289d-e830-47fb-99aa-7594545d3a1d",
                "domain-name--aeffd40b-3bea-4d4a-84c2-df66533f1438",
                "domain-name--1023a3c7-f515-45ee-a02a-bfda8ff24aa9",
                "domain-name--09b2bcd6-2b9a-44cf-a660-90e101cd92ff",
                "domain-name--a1c8592a-9946-4451-b3d0-6cf0f479b927",
                "domain-name--d8163811-d0a4-43e3-80e6-893ffa089aa0",
                "domain-name--6bbb00bc-efbe-4dde-8bae-cfbc3958f783",
                "ipv4-addr--0575410f-9e82-499d-8df0-2f2bdd48f5f1",
                "ipv4-addr--90407d40-dd85-4a59-8f53-cdc8ba31eb4b",
                "domain-name--6caf9695-d536-4ca5-92eb-66deced99f98",
                "domain-name--84c258c7-4e35-4880-9b3f-01f379a87588",
                "ipv4-addr--8a585f06-3c83-427f-be18-1c152a1bcf8a",
                "ipv4-addr--d9029605-8dc3-4062-87ad-e78fbb47c16a",
                "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.enki.co.kr/en/media-center/blog/in-depth-analysis-of-the-apt-down-the-north-korea-files-leak"
                }
            ]
        }
    ]
}