{
    "type": "bundle",
    "id": "bundle--8ac7aacf-6ae7-4969-8157-44951d9263d4",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--6b1d3dfe-e4c1-47eb-9e38-bb509a96d883",
            "created": "2024-11-06T00:58:43.491961Z",
            "modified": "2024-11-06T01:01:17.692995Z",
            "name": "Rewterz",
            "identity_class": "organization"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--f1b99616-9160-4cfd-acb7-2e59d0c98b4e",
            "value": "bk.ru"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--48e8c148-35bc-46c5-a48d-02ed372051e0",
            "value": "internet.ru"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d917f629-53d4-421c-83fb-b743e1c5d6bc",
            "value": "inbox.ru"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7ca1bf93-cc33-4bd9-8bd4-9b43d2c24d82",
            "hashes": {
                "SHA-1": "598b8a9b7bb134bdbf34503e109ec66a18dbbfa9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7350f728-32c0-4b85-8bd0-2b45477992dd",
            "hashes": {
                "SHA-256": "d1b5d606c866c304c3eb28fc52ed700c6b292e6e4387e0dac1a895e231bfe5b3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4a4e0ad7-ddfc-43e8-a011-3da06eb3d034",
            "hashes": {
                "SHA-256": "82286cf6369eddd2e79d005a435623abe2db642c216d38550411865acf84210e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--34e300e5-29c7-4b39-8043-77d694d3c5db",
            "hashes": {
                "SHA-256": "3b2701a7d49a8d6002a2a202bac9b18b4bc917009da01591ab5b66f183f9c8e9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d2fb460a-c73c-4a42-a2df-1ab5fa9df844",
            "hashes": {
                "SHA-1": "7bb3e2671b8ad6e2e1ffb9e8b022dfd677fdd31a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e21f69b0-6fd8-4f02-9fd7-b4c07184ac8b",
            "hashes": {
                "SHA-256": "23c18fe6675b4dad5e1354718fa9bbb096ded4293948d318d0057b51642c4cbb"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--dc942393-831b-40ef-af4c-16a12492fcf2",
            "hashes": {
                "SHA-1": "41bff8875d1f83b3af52b65cb7ce8ebca0e30bfd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--03346003-0217-4e2a-8e94-5f4a24ae5f5d",
            "hashes": {
                "SHA-256": "63c45dd760256bb2bee1eeb9e7d61601c90a752ff46832df39ca1a8d2376b281"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d29d61e3-cc95-46c4-ad4b-a0fd890cf961",
            "hashes": {
                "SHA-1": "44b072d3948f06cdc0be573aa62ce3ca0b80da1e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d886facc-9741-4bc9-be00-86baa2eb422c",
            "hashes": {
                "SHA-1": "aabaea027236e8605f4b89e3d9e2206993398af2"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3cf3abc8-b4e4-4822-a8fb-ab8609f6d439",
            "hashes": {
                "SHA-256": "0dc17133b9d54b8d38f5a4f4c49eb0cee7ff2c80b1ea614fb59ca49c3721440b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--22c30ee0-0c5c-45b9-ac99-e04125a8d249",
            "hashes": {
                "SHA-256": "9255280904f85d01545d295a31038678d697325385be6c7c01435d541f16b043"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2a238329-536a-4b75-999a-2a3aa41a2e4b",
            "hashes": {
                "SHA-256": "f408dee7fa76179d826885c5c6f38acbcc11f3e3abba1f1f58068cdf833b4317"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3c742e0e-a4f7-42ea-ba98-afdae9553f72",
            "hashes": {
                "SHA-1": "08620755dabc0983eaf1320ac4c71d90b56ff1bb"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8b2a12be-67a9-4157-a7a8-de6ad9787087",
            "hashes": {
                "SHA-1": "dd6bbd76378fce03e2b72c904832e576d4576354"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e0000909-1389-4329-ac8b-34bbff25711b",
            "hashes": {
                "SHA-1": "9837e850f9800cff7d4fd26a2d9ccbaa1960d50b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--12897ba3-ac88-4836-8fc8-9f62525a03f6",
            "hashes": {
                "SHA-1": "9534d277d796890affadb3d3861d22a61bfdbbdd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6fc9e59e-fbea-49a1-af53-309ae52550a3",
            "hashes": {
                "SHA-256": "327426b389a87fb41c5150f18c8a3b1b5c671eb08107a3a6917baea3db686555"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fb7ac8f3-4015-4eef-bfa6-8fdf71c0f1b0",
            "hashes": {
                "SHA-256": "aead266f97c936799f4d5f526482d41f74daf86f8fcf49976eecbc6260b59274"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a739b1b0-bf8e-4e7b-8cb4-beecdf9e89f2",
            "hashes": {
                "SHA-1": "76ed57d6451f634255c664a89f7a64a062923c05"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3c7126d4-eb47-48ba-890a-2a0016de70b8",
            "hashes": {
                "SHA-1": "84c2e2d5d61ed9148a0057e951fdea641901874d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3cdef208-c57d-471b-8f25-0e57c3dd189b",
            "hashes": {
                "SHA-256": "bf838c2e46696f79964709e29880604d7172f2a3ab0f3f41d7ff8216f053c557"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a5a1e550-8fcc-404c-a614-2bf2b8707167",
            "hashes": {
                "SHA-1": "f8542e5567741c95a966cd1508c6d11ad0763440"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--75edc7d5-cea0-401f-ab33-cb44f51dd442",
            "hashes": {
                "SHA-256": "ac4f6bdd6d4ef009f1108c4c8a3d58e0a19d4f73b239202dd601b0aeba5ceb54"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--3e15e28f-30b9-4fb9-aba6-cf2baaf80c67",
            "value": "cookiemanager.ne.kr"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--0b9be804-25cc-45ab-addc-8166dd8140b9",
            "value": "nidiogln.ne.kr"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--85200603-f196-4b8f-8e13-5be315e6b85b",
            "hashes": {
                "MD5": "d8249f33e07479ce9c0e44be73d3deac"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--741f7a51-aa51-4724-9a7f-857c73864971",
            "hashes": {
                "MD5": "6ead104743be6575e767986a71cf4bd9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7ead8892-9107-4050-a5dc-e7f5a3ef8714",
            "hashes": {
                "MD5": "adb30d4dd9e1bbe82392b4c01f561e46"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ee139509-7eb3-47a3-9c2e-33599cac3923",
            "hashes": {
                "MD5": "ab75a54c3d6ed01ba9478d9fecd443af"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0caf6b34-784c-48fc-bacb-a5dc46cd2a65",
            "hashes": {
                "MD5": "658a8856d48aabc0ecfeb685d836621b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--18e35ec5-3852-4966-b2dc-ca3d9bf0bfaa",
            "hashes": {
                "MD5": "a75196b7629e3af03056c75af37f37cf"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ccb8d853-33d6-4638-9f5b-be81547e4640",
            "hashes": {
                "MD5": "aa41e4883a9c5c91cdab225a0e82d86a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0fb605fb-6583-4bb3-adf0-f001a890dddd",
            "hashes": {
                "MD5": "b591cbd3f585dbb1b55f243d5a5982bc"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e775d678-8bbe-4694-9135-e3d8f9541f56",
            "hashes": {
                "MD5": "3cd67d99bcc8f3b959c255c9e8702e9f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d937900c-4276-47a9-a054-7c3d80e92f0f",
            "hashes": {
                "MD5": "0def51118a28987a929ba26c7413da29"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a9216809-c777-40aa-9f01-0cecb515adc4",
            "hashes": {
                "MD5": "a6588c10d9c4c2b3837cd7ce6c43f72e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--53e1b4de-7b78-4440-9cfb-4d44d2290e40",
            "hashes": {
                "MD5": "2ff911b042e5d94dd78f744109851326"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--bdf10757-1772-4c1a-90cc-2383b8677a4f",
            "value": "ncloud.ru"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--ea366899-2622-4c26-ae70-790fb4eba9d3",
            "value": "mmbox.ru"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--2a8b622b-a771-4a88-b322-09a1169a0bcf",
            "value": "185.27.134.144"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0da43df7-263b-4f2b-81bc-836437b6387a",
            "value": "185.27.134.140"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--62b1e399-8504-40c1-99d0-ce0a350c21f2",
            "value": "185.27.134.201"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--6f2c42e7-7fdb-4687-b510-14fc012d25d1",
            "value": "185.27.134.93"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--b1c83147-4e7e-4d11-8648-b7a065e21d48",
            "value": "185.105.33.106"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--a6e118b3-6f0e-4840-a29b-11aa1f3912cb",
            "value": "185.27.134.120"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1",
            "created": "2026-06-24T19:53:37.462081Z",
            "modified": "2026-06-24T19:53:37.462081Z",
            "name": "Kimsuky"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--d69a2e51-7401-4074-a588-c82559cc5b88",
            "created_by_ref": "identity--6b1d3dfe-e4c1-47eb-9e38-bb509a96d883",
            "created": "2026-06-24T19:53:37.463124Z",
            "modified": "2026-06-24T19:53:37.463124Z",
            "name": "Russian Emails Used by North Korean Kimsuky to Commit Credential Theft Attacks \u2013 Active IOCs",
            "published": "2024-12-04T00:00:00Z",
            "object_refs": [
                "identity--6b1d3dfe-e4c1-47eb-9e38-bb509a96d883",
                "domain-name--f1b99616-9160-4cfd-acb7-2e59d0c98b4e",
                "domain-name--48e8c148-35bc-46c5-a48d-02ed372051e0",
                "domain-name--d917f629-53d4-421c-83fb-b743e1c5d6bc",
                "file--7ca1bf93-cc33-4bd9-8bd4-9b43d2c24d82",
                "file--7350f728-32c0-4b85-8bd0-2b45477992dd",
                "file--4a4e0ad7-ddfc-43e8-a011-3da06eb3d034",
                "file--34e300e5-29c7-4b39-8043-77d694d3c5db",
                "file--d2fb460a-c73c-4a42-a2df-1ab5fa9df844",
                "file--e21f69b0-6fd8-4f02-9fd7-b4c07184ac8b",
                "file--dc942393-831b-40ef-af4c-16a12492fcf2",
                "file--03346003-0217-4e2a-8e94-5f4a24ae5f5d",
                "file--d29d61e3-cc95-46c4-ad4b-a0fd890cf961",
                "file--d886facc-9741-4bc9-be00-86baa2eb422c",
                "file--3cf3abc8-b4e4-4822-a8fb-ab8609f6d439",
                "file--22c30ee0-0c5c-45b9-ac99-e04125a8d249",
                "file--2a238329-536a-4b75-999a-2a3aa41a2e4b",
                "file--3c742e0e-a4f7-42ea-ba98-afdae9553f72",
                "file--8b2a12be-67a9-4157-a7a8-de6ad9787087",
                "file--e0000909-1389-4329-ac8b-34bbff25711b",
                "file--12897ba3-ac88-4836-8fc8-9f62525a03f6",
                "file--6fc9e59e-fbea-49a1-af53-309ae52550a3",
                "file--fb7ac8f3-4015-4eef-bfa6-8fdf71c0f1b0",
                "file--a739b1b0-bf8e-4e7b-8cb4-beecdf9e89f2",
                "file--3c7126d4-eb47-48ba-890a-2a0016de70b8",
                "file--3cdef208-c57d-471b-8f25-0e57c3dd189b",
                "file--a5a1e550-8fcc-404c-a614-2bf2b8707167",
                "file--75edc7d5-cea0-401f-ab33-cb44f51dd442",
                "domain-name--3e15e28f-30b9-4fb9-aba6-cf2baaf80c67",
                "domain-name--0b9be804-25cc-45ab-addc-8166dd8140b9",
                "file--85200603-f196-4b8f-8e13-5be315e6b85b",
                "file--741f7a51-aa51-4724-9a7f-857c73864971",
                "file--7ead8892-9107-4050-a5dc-e7f5a3ef8714",
                "file--ee139509-7eb3-47a3-9c2e-33599cac3923",
                "file--0caf6b34-784c-48fc-bacb-a5dc46cd2a65",
                "file--18e35ec5-3852-4966-b2dc-ca3d9bf0bfaa",
                "file--ccb8d853-33d6-4638-9f5b-be81547e4640",
                "file--0fb605fb-6583-4bb3-adf0-f001a890dddd",
                "file--e775d678-8bbe-4694-9135-e3d8f9541f56",
                "file--d937900c-4276-47a9-a054-7c3d80e92f0f",
                "file--a9216809-c777-40aa-9f01-0cecb515adc4",
                "file--53e1b4de-7b78-4440-9cfb-4d44d2290e40",
                "domain-name--bdf10757-1772-4c1a-90cc-2383b8677a4f",
                "domain-name--ea366899-2622-4c26-ae70-790fb4eba9d3",
                "ipv4-addr--2a8b622b-a771-4a88-b322-09a1169a0bcf",
                "ipv4-addr--0da43df7-263b-4f2b-81bc-836437b6387a",
                "ipv4-addr--62b1e399-8504-40c1-99d0-ce0a350c21f2",
                "ipv4-addr--6f2c42e7-7fdb-4687-b510-14fc012d25d1",
                "ipv4-addr--b1c83147-4e7e-4d11-8648-b7a065e21d48",
                "ipv4-addr--a6e118b3-6f0e-4840-a29b-11aa1f3912cb",
                "threat-actor--3cad7692-b5b4-565b-88b1-63998b3f44a1"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.rewterz.com/threat-advisory/russian-emails-used-by-north-korean-kimsuky-to-commit-credential-theft-attacks-active-iocs"
                }
            ]
        }
    ]
}