{"type":"bundle","id":"bundle--96a06078-f795-5d7a-aaae-b36bb812fe7a","objects":[{"type":"identity","spec_version":"2.1","id":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-01-01T00:00:00.000Z","modified":"2026-01-01T00:00:00.000Z","name":"CTI-Hermes Autonomous Agent","identity_class":"organization"},{"type":"indicator","spec_version":"2.1","id":"indicator--ec10c9ab-6323-50b8-a494-bf6ea0ec90de","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:02.474980Z","modified":"2026-08-29T13:15:02.474980Z","name":"SIGMA: CaptiveCrunch Doppelganger Domain DNS Query","indicator_types":["malicious-activity"],"pattern":"[network-traffic:dst_ref.value = 'CaptiveCrunch Doppelganger Domain DNS Query']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:02.474980Z","confidence":95},{"type":"indicator","spec_version":"2.1","id":"indicator--c602008e-c871-55b4-9465-92c836c7f2cf","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:02.474980Z","modified":"2026-08-29T13:15:02.474980Z","name":"YARA: apt_midnight_blizzard_captivecrunch","indicator_types":["malicious-activity"],"pattern":"[network-traffic:dst_ref.value = 'apt_midnight_blizzard_captivecrunch']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:02.474980Z","confidence":95},{"type":"report","spec_version":"2.1","id":"report--19575619-7e04-5450-b7cc-33b5ca8e7955","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:02.474980Z","modified":"2026-10-30T14:11:14.694511Z","name":"Analysis of CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft","description":"Technical threat analysis derived from intelligence published at https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/.","published":"2026-08-29T13:15:02.474980Z","report_types":["threat-report"],"object_refs":["identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","indicator--ec10c9ab-6323-50b8-a494-bf6ea0ec90de","indicator--c602008e-c871-55b4-9465-92c836c7f2cf"],"confidence":95}]}