{
    "type": "bundle",
    "id": "bundle--61b49413-5246-49ec-9e4f-9db53d828667",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--8a0b93da-a9d1-41b5-8d1b-7e8a105945fc",
            "created": "2023-03-08T14:44:38.241293Z",
            "modified": "2023-03-08T14:44:38.241418Z",
            "name": "S2W",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d8a1157c-61d9-4311-a2b8-123ccadba0fe",
            "hashes": {
                "SHA-256": "2e0ffaab995f22b7684052e53b8c64b9283b5e81503b88664785fe6d6569a55e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--47fcd9a6-b235-45e5-94b9-5c6d7e908773",
            "hashes": {
                "MD5": "7457dc037c4a5f3713d9243a0dfb1a2c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9af1c554-d7c1-4334-a56e-90bf90faf2a2",
            "hashes": {
                "MD5": "88f183304b99c897aacfa321d58e1840"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5b9bae94-6491-48e1-97bd-b5bc0d06c018",
            "hashes": {
                "MD5": "27ef6917fe32685fdf9b755eb8e97565"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f1427f19-cd4c-4a93-bc73-214ecf7018a1",
            "hashes": {
                "MD5": "7b6d02a459fdaa4caa1a5bf741c4bd42"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ab025434-4079-4d14-a797-9f97c1d9c813",
            "hashes": {
                "MD5": "c8e7b0d3b6afa22e801cacaf16b37355"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--8bebe6a1-1beb-45a1-80d3-74a7ad87ba2b",
            "value": "http://qi.limsjo.p-e.kr/index.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--63a4722d-8ddc-457f-a6b6-6e5f1a3cd43c",
            "value": "http://ol.negapa.p-e.kr/index.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--888e6bd4-f278-400c-a374-bb62c934120f",
            "value": "http://ai.negapa.p-e.kr/index.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--8cfb1781-c7f1-4b76-92e2-721d5ff352e4",
            "value": "http://ar.kostin.p-e.kr/index.php"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--59bf25ac-0dd6-44d1-a941-55b10f0b55a6",
            "value": "ai.negapa.p-e.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--4021851c-cd46-4620-88ee-d6ade3210b99",
            "value": "ar.kostin.p-e.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--32cc4c56-b274-4ee9-92c2-4922895e6738",
            "value": "ol.negapa.p-e.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--b087534e-3965-4a3f-8a8e-e473cb91a00e",
            "value": "qi.limsjo.p-e.kr"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--866e7e77-da63-498f-b4e2-3be4027e7205",
            "hashes": {
                "SHA-256": "bc4c1c869a03045e0b594a258ec3801369b0dcabac193e90f0a684900e9a582d"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--bd63b025-d6dd-4a66-adbf-a4f2cb46a831",
            "value": "216.189.159.197"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2f65ca45-d3ce-4460-9aa4-c395f4567d31",
            "hashes": {
                "MD5": "19c2decfa7271fa30e48d4750c1d18c1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c7f8db1b-a142-412b-839f-126b5541feb3",
            "hashes": {
                "MD5": "87429e9223d45e0359cd1c41c0301836"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--f4e1a568-05f6-4a59-ae79-6c12e1a480df",
            "value": "ai.kostin.p-e.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--0818be3e-64d4-4603-89cf-acfb7b402b3f",
            "value": "coolsystem.co.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--392d7bf9-54eb-4d26-9545-4bd8c023a4ac",
            "value": "ai.limsjo.p-e.kr"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--8d5704e2-ac06-434f-bf6b-61a2f26e3ea8",
            "value": "http://ai.limsjo.p-e.kr/index.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--6ed263da-c1f3-45e7-8210-d8217f4a3799",
            "value": "http://ai.kostin.p-e.kr/index.php"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--7a77a8ef-cd40-4c9a-b669-31c47c99f41e",
            "value": "http://coolsystem.co.kr/admin/mail/index.php"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ecedcc33-080a-47b7-a379-77c7678b4920",
            "hashes": {
                "MD5": "d6abeeb469e2417bbcd3c122c06ba099"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fefd3841-2eba-4adc-8c0f-87d1c39c7cd6",
            "hashes": {
                "SHA-256": "f8ab78e1db3a3cc3793f7680a90dc1d8ce087226ef59950b7acd6bb1beffd6e3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--110a5c4b-bbca-4519-8a3c-19d4105d2739",
            "hashes": {
                "SHA-256": "6eebb5ed0d0b5553e40a7b1ad739589709d077aab4cbea1c64713c48ce9c96f9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--12d4ac75-e8f1-4fa7-afd6-79d6b9d3ffdc",
            "hashes": {
                "SHA-256": "a8c24a3e54a4b323973f61630c92ecaad067598ef2547350c9d108bc175774b9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8c06ec12-7743-4661-8d6a-c280be57fbe7",
            "hashes": {
                "SHA-256": "955cb4f01eb18f0d259fcb962e36a339e8fe082963dfd9f72d3851210f7d2d3b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d67d6758-49a1-4de5-9c80-6ff226923d87",
            "hashes": {
                "SHA-256": "61b8fbea8c0dfa337eb7ff978124ddf496d0c5f29bcb5672f3bd3d6bf832ac92"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c3558857-d63c-4f6a-88cc-0ab02a4a65b4",
            "hashes": {
                "SHA-256": "ff3718ae6bd59ad479e375c602a81811718dfb2669c2d1de497f02baf7b4adca"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1",
            "created": "2026-06-24T21:19:18.507035Z",
            "modified": "2026-06-24T21:19:18.507035Z",
            "name": "Kimsuky"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--67648e55-ffc8-4f2a-9486-cdf8f41cef2b",
            "created_by_ref": "identity--8a0b93da-a9d1-41b5-8d1b-7e8a105945fc",
            "created": "2026-06-24T21:19:18.547988Z",
            "modified": "2026-06-24T21:19:18.547988Z",
            "name": "Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer\u2026",
            "published": "2024-02-08T00:00:00Z",
            "object_refs": [
                "identity--8a0b93da-a9d1-41b5-8d1b-7e8a105945fc",
                "file--d8a1157c-61d9-4311-a2b8-123ccadba0fe",
                "file--47fcd9a6-b235-45e5-94b9-5c6d7e908773",
                "file--9af1c554-d7c1-4334-a56e-90bf90faf2a2",
                "file--5b9bae94-6491-48e1-97bd-b5bc0d06c018",
                "file--f1427f19-cd4c-4a93-bc73-214ecf7018a1",
                "file--ab025434-4079-4d14-a797-9f97c1d9c813",
                "url--8bebe6a1-1beb-45a1-80d3-74a7ad87ba2b",
                "url--63a4722d-8ddc-457f-a6b6-6e5f1a3cd43c",
                "url--888e6bd4-f278-400c-a374-bb62c934120f",
                "url--8cfb1781-c7f1-4b76-92e2-721d5ff352e4",
                "domain-name--59bf25ac-0dd6-44d1-a941-55b10f0b55a6",
                "domain-name--4021851c-cd46-4620-88ee-d6ade3210b99",
                "domain-name--32cc4c56-b274-4ee9-92c2-4922895e6738",
                "domain-name--b087534e-3965-4a3f-8a8e-e473cb91a00e",
                "file--866e7e77-da63-498f-b4e2-3be4027e7205",
                "ipv4-addr--bd63b025-d6dd-4a66-adbf-a4f2cb46a831",
                "file--2f65ca45-d3ce-4460-9aa4-c395f4567d31",
                "file--c7f8db1b-a142-412b-839f-126b5541feb3",
                "domain-name--f4e1a568-05f6-4a59-ae79-6c12e1a480df",
                "domain-name--0818be3e-64d4-4603-89cf-acfb7b402b3f",
                "domain-name--392d7bf9-54eb-4d26-9545-4bd8c023a4ac",
                "url--8d5704e2-ac06-434f-bf6b-61a2f26e3ea8",
                "url--6ed263da-c1f3-45e7-8210-d8217f4a3799",
                "url--7a77a8ef-cd40-4c9a-b669-31c47c99f41e",
                "file--ecedcc33-080a-47b7-a379-77c7678b4920",
                "file--fefd3841-2eba-4adc-8c0f-87d1c39c7cd6",
                "file--110a5c4b-bbca-4519-8a3c-19d4105d2739",
                "file--12d4ac75-e8f1-4fa7-afd6-79d6b9d3ffdc",
                "file--8c06ec12-7743-4661-8d6a-c280be57fbe7",
                "file--d67d6758-49a1-4de5-9c80-6ff226923d87",
                "file--c3558857-d63c-4f6a-88cc-0ab02a4a65b4",
                "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"
                }
            ]
        }
    ]
}