{
    "type": "bundle",
    "id": "bundle--6c86a9bb-a8a3-42d1-a421-2ad2f55b0f50",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--ce40c63e-51d4-4ec5-a85b-2d76cd5ec7d1",
            "created": "2023-03-08T12:52:07.036238Z",
            "modified": "2025-06-18T12:58:21.951363Z",
            "name": "CiscoTalos",
            "identity_class": "organization"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--02163e76-7d8b-42b0-99e7-263e7febc509",
            "value": "162.19.71.175"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5e06f10c-f279-4824-8de6-bd26434dc96d",
            "hashes": {
                "SHA-256": "47e017b40d418374c0889e4d22aa48633b1d41b16b61b1f2897a39112a435d30"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9caf15f6-bc19-4ce2-bea1-b8488c6ee7c1",
            "hashes": {
                "SHA-256": "0e416e3cc1673d8fc3e7b2469e491c005152b9328515ea9bbd7cf96f1d23a99f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9fa1f571-d340-456f-acc5-f65bdcc79ff2",
            "hashes": {
                "SHA-256": "f91188d23b14526676706a5c9ead05c1a91ea0b9d6ac902623bc565e1c200a59"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--081b8d12-c17c-4410-8cc4-d6aff43cb606",
            "hashes": {
                "SHA-256": "000752074544950ae9020a35ccd77de277f1cd5026b4b9559279dc3b86965eee"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4f7e21f9-907e-4c31-a222-df8d2f743d3f",
            "hashes": {
                "SHA-256": "9a48357c06758217b3a99cdf4ab83263c04bdea98c347dd14b254cab6c81b13a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--57e8e942-0e5c-4c02-a921-1e12526eaf55",
            "hashes": {
                "SHA-256": "5b02fc3cfb5d74c09cab724b5b54c53a7c07e5766bffe5b1adf782c9e86a8541"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7d49e955-3ff2-4e82-935c-68f9b7194849",
            "hashes": {
                "SHA-256": "ba8cd92cc059232203bcadee260ddbae273fc4c89b18424974955607476982c4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--90acadc4-5e28-43da-8177-e94155b09a41",
            "hashes": {
                "SHA-256": "534f5612954db99c86baa67ef51a3ad88bc21735bce7bb591afa8a4317c35433"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b687595a-2922-433d-a86f-cabb05f51acc",
            "hashes": {
                "SHA-256": "e615ea30dd37644526060689544c1a1d263b6bb77fe3084aa7883669c1fde12f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--74520b07-0485-4e53-a699-c3d3ad700858",
            "hashes": {
                "SHA-256": "82d4a0fef550af4f01a07041c16d851f262d859a3352475c62630e2c16a21def"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--77d30305-a762-42de-9d27-967efa609c22",
            "value": "tech.micrsofts.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--79addef2-5647-4a5f-bbe8-00dcea10e540",
            "value": "155.94.208.209"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--7473e61e-f6a5-4de2-9300-7580cbd067a6",
            "value": "185.29.8.53"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5a4acf20-27a4-4dd6-843c-49841df194d4",
            "value": "201.77.179.66"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--6dce937c-3393-42b4-8543-160010b990e8",
            "value": "27.102.113.93"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--779b8f52-56c4-5aee-b87a-0e7e139d8eff",
            "created": "2026-06-24T21:03:23.189611Z",
            "modified": "2026-06-24T21:03:23.189611Z",
            "name": "Andariel"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--32cbc8e2-e3ce-472f-a1f9-48e32b29f319",
            "created_by_ref": "identity--ce40c63e-51d4-4ec5-a85b-2d76cd5ec7d1",
            "created": "2026-06-24T21:03:23.196205Z",
            "modified": "2026-06-24T21:03:23.196205Z",
            "name": "Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang",
            "published": "2023-12-11T00:00:00Z",
            "object_refs": [
                "identity--ce40c63e-51d4-4ec5-a85b-2d76cd5ec7d1",
                "ipv4-addr--02163e76-7d8b-42b0-99e7-263e7febc509",
                "file--5e06f10c-f279-4824-8de6-bd26434dc96d",
                "file--9caf15f6-bc19-4ce2-bea1-b8488c6ee7c1",
                "file--9fa1f571-d340-456f-acc5-f65bdcc79ff2",
                "file--081b8d12-c17c-4410-8cc4-d6aff43cb606",
                "file--4f7e21f9-907e-4c31-a222-df8d2f743d3f",
                "file--57e8e942-0e5c-4c02-a921-1e12526eaf55",
                "file--7d49e955-3ff2-4e82-935c-68f9b7194849",
                "file--90acadc4-5e28-43da-8177-e94155b09a41",
                "file--b687595a-2922-433d-a86f-cabb05f51acc",
                "file--74520b07-0485-4e53-a699-c3d3ad700858",
                "domain-name--77d30305-a762-42de-9d27-967efa609c22",
                "ipv4-addr--79addef2-5647-4a5f-bbe8-00dcea10e540",
                "ipv4-addr--7473e61e-f6a5-4de2-9300-7580cbd067a6",
                "ipv4-addr--5a4acf20-27a4-4dd6-843c-49841df194d4",
                "ipv4-addr--6dce937c-3393-42b4-8543-160010b990e8",
                "threat-actor--779b8f52-56c4-5aee-b87a-0e7e139d8eff"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://blog.talosintelligence.com/lazarus_new_rats_dlang_and_telegram/"
                }
            ]
        }
    ]
}