{
    "type": "bundle",
    "id": "bundle--d389ac2c-8d40-4cca-ab78-bb4d10a2399c",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--8a0b93da-a9d1-41b5-8d1b-7e8a105945fc",
            "created": "2023-03-08T14:44:38.241293Z",
            "modified": "2023-03-08T14:44:38.241418Z",
            "name": "S2W",
            "identity_class": "organization"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--057f4f46-e9e2-439c-832a-55bf9b58214d",
            "value": "delps.scienceontheweb.net"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--7b953301-0aa9-497f-82c3-477a8521d2fe",
            "value": "185.176.43.98"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6c62de6e-f290-4f48-ab0b-28dcbed8c50d",
            "hashes": {
                "MD5": "aa756b20170aa0869d6f5d5b5f1b7c37"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5f85509f-310f-4804-97b1-95f1cc276287",
            "hashes": {
                "MD5": "f2a0e92b80928830704a00c91df87644"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--c7e3a3fe-e0c2-4cde-b591-596177f6fc06",
            "value": "http://delps.scienceontheweb.net/ital/info/list.php?query=1"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--14a53d0b-6b57-48f8-9a40-11e96a1ad214",
            "value": "http://delps.scienceontheweb.net/ital/info/sample.hwp"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1",
            "created": "2026-06-24T21:01:41.442919Z",
            "modified": "2026-06-24T21:01:41.442919Z",
            "name": "Kimsuky"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--a9564cbc-5916-400d-8ae9-f665976835f9",
            "created_by_ref": "identity--8a0b93da-a9d1-41b5-8d1b-7e8a105945fc",
            "created": "2026-06-24T21:01:41.446883Z",
            "modified": "2026-06-24T21:01:41.446883Z",
            "name": "Kimsuky group appears to be exploiting OneNote like the cybercrime group",
            "published": "2023-03-17T00:00:00Z",
            "object_refs": [
                "identity--8a0b93da-a9d1-41b5-8d1b-7e8a105945fc",
                "domain-name--057f4f46-e9e2-439c-832a-55bf9b58214d",
                "ipv4-addr--7b953301-0aa9-497f-82c3-477a8521d2fe",
                "file--6c62de6e-f290-4f48-ab0b-28dcbed8c50d",
                "file--5f85509f-310f-4804-97b1-95f1cc276287",
                "url--c7e3a3fe-e0c2-4cde-b591-596177f6fc06",
                "url--14a53d0b-6b57-48f8-9a40-11e96a1ad214",
                "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://medium.com/s2wblog/kimsuky-group-appears-to-be-exploiting-onenote-like-the-cybercrime-group-3c96b0b85b9f"
                }
            ]
        }
    ]
}