{
    "type": "bundle",
    "id": "bundle--febee5e8-7280-4c7c-9bf5-7730e8ff8671",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--6e225534-1593-4ec4-af3d-37629f252642",
            "created": "2023-03-08T12:51:46.982899Z",
            "modified": "2024-11-05T00:46:39.080437Z",
            "name": "Zscaler",
            "identity_class": "organization"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--017fa299-6c80-47b9-aee0-2964427a8c43",
            "value": "o-r.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--cb709de6-361c-440f-b1ce-ab4d788f910e",
            "value": "r-e.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a73a3f63-5466-45e4-a6e4-aaf33f968e95",
            "value": "p-e.kr"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8d35d82e-ab02-4fdd-be8d-4ac10d32247a",
            "hashes": {
                "MD5": "38e27983c757374d9bae36a2e2520e8e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--843c1ec1-e5b2-45db-91cd-603c053d4441",
            "hashes": {
                "MD5": "bba3b15bad6b5a80ab9fa9a49b643658"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--d382d160-bd8c-49f7-9131-6363742f0705",
            "value": "https://webman.w3school.cloudns.nz/config.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--6d702024-b6d0-45d8-ab28-6dd5a5e44ea3",
            "value": "http://sdfa.liveblog365.com/ares/hades.txt"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--f29c0bad-acc1-428c-9afc-cf53f8eced21",
            "value": "http://viaweb.co.kr"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--93a43d33-dfdb-4a9f-affb-f0b9693baee7",
            "value": "https://webman.w3school.cloudns.nz"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--e74cdfbe-7bac-402c-a577-a32c9cc7cf93",
            "value": "http://ney.r-e.kr/mar/tys.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--570f36fc-6d3a-4207-a65a-1f913d68f8c2",
            "value": "http://sdfa.liveblog365.com/ares/babyhades.txt"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--f0e5465f-87d4-4df9-a6f8-f3c7cee248c0",
            "value": "http://ney.r-e.kr/mar/tys.txt"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--934b0741-adbd-4d2e-a083-16505ceecf43",
            "value": "ney.r-e.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--7cd2b3f5-11d5-4c79-9ba2-db2b2f621c33",
            "value": "webman.w3school.cloudns.nz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--52923b81-f807-42ba-aff4-601c422fb0fe",
            "value": "sdfa.liveblog365.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--60a2f58d-8e98-43d9-9743-1ff80de3d0cf",
            "value": "viaweb.co.kr"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1",
            "created": "2026-06-24T21:04:32.080256Z",
            "modified": "2026-06-24T21:04:32.080256Z",
            "name": "Kimsuky"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--0ba10d6a-3cac-41bf-a083-dd17b479ed20",
            "created_by_ref": "identity--6e225534-1593-4ec4-af3d-37629f252642",
            "created": "2026-06-24T21:04:32.09364Z",
            "modified": "2026-06-24T21:04:32.09364Z",
            "name": "Kimsuky deploys TRANSLATEXT to target South Korean academia",
            "published": "2024-06-27T00:00:00Z",
            "object_refs": [
                "identity--6e225534-1593-4ec4-af3d-37629f252642",
                "domain-name--017fa299-6c80-47b9-aee0-2964427a8c43",
                "domain-name--cb709de6-361c-440f-b1ce-ab4d788f910e",
                "domain-name--a73a3f63-5466-45e4-a6e4-aaf33f968e95",
                "file--8d35d82e-ab02-4fdd-be8d-4ac10d32247a",
                "file--843c1ec1-e5b2-45db-91cd-603c053d4441",
                "url--d382d160-bd8c-49f7-9131-6363742f0705",
                "url--6d702024-b6d0-45d8-ab28-6dd5a5e44ea3",
                "url--f29c0bad-acc1-428c-9afc-cf53f8eced21",
                "url--93a43d33-dfdb-4a9f-affb-f0b9693baee7",
                "url--e74cdfbe-7bac-402c-a577-a32c9cc7cf93",
                "url--570f36fc-6d3a-4207-a65a-1f913d68f8c2",
                "url--f0e5465f-87d4-4df9-a6f8-f3c7cee248c0",
                "domain-name--934b0741-adbd-4d2e-a083-16505ceecf43",
                "domain-name--7cd2b3f5-11d5-4c79-9ba2-db2b2f621c33",
                "domain-name--52923b81-f807-42ba-aff4-601c422fb0fe",
                "domain-name--60a2f58d-8e98-43d9-9743-1ff80de3d0cf",
                "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia"
                }
            ]
        }
    ]
}