{
    "type": "bundle",
    "id": "bundle--6682c5ca-86f8-4045-879a-cb8f02db86cf",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--26f043d6-2bd6-459a-b07f-6d4d79229bfc",
            "created": "2026-01-13T04:01:05.551348Z",
            "modified": "2026-01-13T04:03:03.479042Z",
            "name": "RedAsgard",
            "identity_class": "organization"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
            "created": "2026-06-24T17:29:30.988603Z",
            "modified": "2026-06-24T17:29:30.988603Z",
            "name": "Lazarus"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--274bdc58-7b9c-42b3-9e85-d2b6ecd27286",
            "created_by_ref": "identity--26f043d6-2bd6-459a-b07f-6d4d79229bfc",
            "created": "2026-06-24T17:29:30.989681Z",
            "modified": "2026-06-24T17:29:30.989681Z",
            "name": "The Factory: How a Lazarus-Attributed Credential Pipeline Collected Its Own Operators",
            "published": "2026-05-14T00:00:00Z",
            "object_refs": [
                "identity--26f043d6-2bd6-459a-b07f-6d4d79229bfc",
                "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://open.spotify.com/episode/4fCxS9Q4n82tf8fRgsMRCZ"
                }
            ]
        }
    ]
}