{
    "type": "bundle",
    "id": "bundle--1539618a-3422-4f4d-a935-e3a1ac95e3ad",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--6d992553-973c-4d7b-92f5-9cd102f7cd02",
            "created": "2026-01-28T05:26:55.962468Z",
            "modified": "2026-01-28T05:28:30.646254Z",
            "name": "SynapticSecurity",
            "identity_class": "organization"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--2c014286-ab5f-4216-bde7-a83df97a6996",
            "value": "175.45.178.55"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--ac99f340-2144-4af3-8d0f-b4f563b11a58",
            "value": "star-co.net"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--0b13823d-32d7-4372-a525-1d84c5c6f8f3",
            "value": "addressesryongnamsan@star-co.net.kp"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--c5638019-8f98-48fa-82bc-8d49ad14a075",
            "value": "andmab@silibank.net.kp"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--b78f614a-7300-40ef-a3bd-afa179419fc9",
            "value": "mail.star-co.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--75fdd5ac-1bb3-493b-aba5-65889ea444d0",
            "value": "smtp1.star-co.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--75958b68-92d7-4ec6-aaeb-92dcac676944",
            "value": "juming.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--ec093e08-7d43-49dc-bdf8-39df560f6548",
            "value": "175.45.178.57"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--baa55c34-d23b-4601-8d46-3186c8612435",
            "value": "175.45.178.56"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--432b44d6-ae20-4262-aa46-3f8bccd9a299",
            "value": "175.45.177.33"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--f3a518de-1314-4187-87c6-ebc6b352b394",
            "value": "ryongnamsan.edu"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--1f5cf1e3-9448-41cd-8644-7ab1774d2e44",
            "value": "silibank.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--ba33e965-e12d-4d58-bbf4-23bbe735744d",
            "value": "smtp.star-co.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a6b915a0-0209-4546-99fb-4cba425eeb6a",
            "value": "mail.silibank.net"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--d0d303e8-64a6-4bc0-9454-157099d0f982",
            "created_by_ref": "identity--6d992553-973c-4d7b-92f5-9cd102f7cd02",
            "created": "2026-06-24T21:01:44.424042Z",
            "modified": "2026-06-24T21:01:44.424042Z",
            "name": "Why Is a North Korean Mail Server Using a .cc Domain?",
            "published": "2026-01-27T00:00:00Z",
            "object_refs": [
                "identity--6d992553-973c-4d7b-92f5-9cd102f7cd02",
                "ipv4-addr--2c014286-ab5f-4216-bde7-a83df97a6996",
                "domain-name--ac99f340-2144-4af3-8d0f-b4f563b11a58",
                "email-addr--0b13823d-32d7-4372-a525-1d84c5c6f8f3",
                "email-addr--c5638019-8f98-48fa-82bc-8d49ad14a075",
                "domain-name--b78f614a-7300-40ef-a3bd-afa179419fc9",
                "domain-name--75fdd5ac-1bb3-493b-aba5-65889ea444d0",
                "domain-name--75958b68-92d7-4ec6-aaeb-92dcac676944",
                "ipv4-addr--ec093e08-7d43-49dc-bdf8-39df560f6548",
                "ipv4-addr--baa55c34-d23b-4601-8d46-3186c8612435",
                "ipv4-addr--432b44d6-ae20-4262-aa46-3f8bccd9a299",
                "domain-name--f3a518de-1314-4187-87c6-ebc6b352b394",
                "domain-name--1f5cf1e3-9448-41cd-8644-7ab1774d2e44",
                "domain-name--ba33e965-e12d-4d58-bbf4-23bbe735744d",
                "domain-name--a6b915a0-0209-4546-99fb-4cba425eeb6a"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://blog.synapticsystems.de/why-is-a-north-korean-mail-server-using-a-cc-domain-threat-intelligence-beyond-malware/"
                }
            ]
        }
    ]
}