{
    "type": "bundle",
    "id": "bundle--5bd3e514-76fc-48b7-8b30-68ea4eb028a0",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--0b1cac3e-021d-41d0-89d9-5dc4905fa75a",
            "created": "2023-03-08T12:51:54.415344Z",
            "modified": "2023-03-08T12:51:54.415422Z",
            "name": "Threatconnect",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fafd1449-4747-4e4a-ac68-a7cd38993880",
            "hashes": {
                "SHA-256": "252d1b7a379f97fddd691880c1cf93eaeb2a5e5572e92a25240b75953c88736c"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--b47885d5-2e54-487f-b944-adc5eb2fce94",
            "value": "http://wave.posadadesantiago.com/home/dwn.php?van=101"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--0090e932-c023-4c84-8792-c0fb3b78f181",
            "value": "wave.posadadesantiago.com"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--9d495a21-e0d2-43e6-9349-fbae67de04b3",
            "value": "http://onedrive.sslport.work/share/file/interview%20with%20a%20north%20korean%20defector.doc"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--17b96c16-a07d-435d-ab2a-ebdf1a1f26ea",
            "value": "offerhubs.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--7c290477-2fd1-471e-946e-52b8cbf09bce",
            "value": "doc-view.docomo.ne.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--922138b7-5a0f-4d64-8e9d-c5f8c70b5fc4",
            "value": "preview.manage.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--4dadddf0-b500-4d26-9460-6e05b84afc6c",
            "value": "login.yahoo.co.jp.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--7865b37c-e381-4177-845b-0dfe25a68356",
            "value": "login.un-phish.bad.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--50140ef4-1ffb-47a8-ad1e-85a55423c9ae",
            "value": "login.aei.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--b85ee222-816d-4723-9966-0432b9adfcbe",
            "value": "amaniafrica-et.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d4219c30-87aa-48a3-b426-2b5e04369222",
            "value": "login.gordonchang.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--52d27143-67b8-4181-8171-a7cdcaeb2a1c",
            "value": "webmail.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--337ac608-9bf9-40e8-b6ec-4f3ce7b73777",
            "value": "login.microsoftonline.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--126d8096-b11b-42a9-8f98-cb847cf55681",
            "value": "login.yahoo.com-service.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--127fecd9-1da7-4991-803e-3971890ca4fe",
            "value": "login-yahoo.org"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0470a059-2fae-4e70-b62f-fc8ee4998fdf",
            "value": "108.62.141.33"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1",
            "created": "2026-06-24T21:01:37.337701Z",
            "modified": "2026-06-24T21:01:37.337701Z",
            "name": "Kimsuky"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--b220073f-1f1a-44b4-9019-433992485a52",
            "created_by_ref": "identity--0b1cac3e-021d-41d0-89d9-5dc4905fa75a",
            "created": "2026-06-24T21:01:37.340286Z",
            "modified": "2026-06-24T21:01:37.340286Z",
            "name": "Kimsuky Phishing Operations Putting In Work",
            "published": "2020-09-28T00:00:00Z",
            "object_refs": [
                "identity--0b1cac3e-021d-41d0-89d9-5dc4905fa75a",
                "file--fafd1449-4747-4e4a-ac68-a7cd38993880",
                "url--b47885d5-2e54-487f-b944-adc5eb2fce94",
                "domain-name--0090e932-c023-4c84-8792-c0fb3b78f181",
                "url--9d495a21-e0d2-43e6-9349-fbae67de04b3",
                "domain-name--17b96c16-a07d-435d-ab2a-ebdf1a1f26ea",
                "domain-name--7c290477-2fd1-471e-946e-52b8cbf09bce",
                "domain-name--922138b7-5a0f-4d64-8e9d-c5f8c70b5fc4",
                "domain-name--4dadddf0-b500-4d26-9460-6e05b84afc6c",
                "domain-name--7865b37c-e381-4177-845b-0dfe25a68356",
                "domain-name--50140ef4-1ffb-47a8-ad1e-85a55423c9ae",
                "domain-name--b85ee222-816d-4723-9966-0432b9adfcbe",
                "domain-name--d4219c30-87aa-48a3-b426-2b5e04369222",
                "domain-name--52d27143-67b8-4181-8171-a7cdcaeb2a1c",
                "domain-name--337ac608-9bf9-40e8-b6ec-4f3ce7b73777",
                "domain-name--126d8096-b11b-42a9-8f98-cb847cf55681",
                "domain-name--127fecd9-1da7-4991-803e-3971890ca4fe",
                "ipv4-addr--0470a059-2fae-4e70-b62f-fc8ee4998fdf",
                "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "http://web.archive.org/web/20201103192938/https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/"
                }
            ]
        }
    ]
}