{"uuid": "75fa82c2-873f-4385-8bec-a1cab4dfe447", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2025-30406", "type": "seen", "source": "https://gist.github.com/m-q-t/6ab5b9f4cc22d934d8246fcf0b65812f", "content": "{\n  \"type\": \"bundle\",\n  \"id\": \"bundle--524cfcac-f8e3-4625-98f7-2f0913165d10\",\n  \"objects\": [\n    {\n      \"id\": \"domain-name--685142e9-f5e7-5953-9dd9-de81cc4e5669\",\n      \"type\": \"domain-name\",\n      \"value\": \"rtb.mftadsrvr.com\",\n      \"spec_version\": \"2.1\"\n    },\n    {\n      \"id\": \"domain-name--6fb7606f-c719-597d-8bcf-9c1f4e09ec62\",\n      \"type\": \"domain-name\",\n      \"value\": \"solpru.com\",\n      \"spec_version\": \"2.1\"\n    },\n    {\n      \"id\": \"file--553fdc5e-6ed0-5a68-9979-1882f8fdaeb6\",\n      \"type\": \"file\",\n      \"hashes\": {\n        \"SHA-256\": \"c3d4361939d3f6cf2fe798fef68d4713141c48dce7dd29d3838a5d0c66aa29c7\"\n      },\n      \"spec_version\": \"2.1\"\n    },\n    {\n      \"id\": \"file--a6e7344f-4f56-5fb8-9bc5-6a3dd5e795d2\",\n      \"type\": \"file\",\n      \"hashes\": {\n        \"SHA-256\": \"48b006cb17e75ecdb707dc40dd654f449b94abe49f97a808b35cabca1c5fabbf\"\n      },\n      \"spec_version\": \"2.1\"\n    },\n    {\n      \"id\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"name\": \"Mallory\",\n      \"type\": \"identity\",\n      \"created\": \"2026-09-17T17:53:45.136704Z\",\n      \"modified\": \"2026-09-17T17:53:45.136704Z\",\n      \"description\": \"Persistent sandbox producer identity; not a production identity.\",\n      \"spec_version\": \"2.1\",\n      \"identity_class\": \"organization\"\n    },\n    {\n      \"id\": \"indicator--046f0048-f112-4f17-981f-da2404a9cf84\",\n      \"name\": \"elastic_security_labs: solpru.com\",\n      \"type\": \"indicator\",\n      \"created\": \"2026-09-17T17:53:45.162265Z\",\n      \"pattern\": \"[domain-name:value = 'solpru.com']\",\n      \"modified\": \"2026-09-17T17:53:45.162265Z\",\n      \"valid_from\": \"2026-03-19T00:00:00.000000Z\",\n      \"description\": \"Compromised legitimate website hosting a fake DocuSign portal that delivers a preconfigured ScreenConnect MSI.\",\n      \"pattern_type\": \"stix\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"indicator_types\": [\n        \"malicious-activity\"\n      ],\n      \"pattern_version\": \"2.1\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.elastic.co/security-labs/threat-command/silentconnect-delivers-screenconnect\",\n          \"source_name\": \"elastic_security_labs\"\n        }\n      ]\n    },\n    {\n      \"id\": \"indicator--0d0e2908-cbbf-42f6-b263-7516177edd5b\",\n      \"name\": \"huntress_blog: 165.227.7.206\",\n      \"type\": \"indicator\",\n      \"created\": \"2026-09-17T17:53:45.153006Z\",\n      \"pattern\": \"[ipv4-addr:value = '165.227.7.206']\",\n      \"modified\": \"2026-09-17T17:53:45.153006Z\",\n      \"valid_from\": \"2025-04-11T00:00:00.000000Z\",\n      \"description\": \"Attacker IP address listed in the article's IOC table for exploitation of CVE-2025-30406 against Gladinet CentreStack/Triofox.\",\n      \"pattern_type\": \"stix\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"indicator_types\": [\n        \"malicious-activity\"\n      ],\n      \"pattern_version\": \"2.1\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild\",\n          \"source_name\": \"huntress_blog\"\n        }\n      ]\n    },\n    {\n      \"id\": \"indicator--2c3c072a-ab47-4cb8-bcc2-f343dac535d4\",\n      \"name\": \"huntress_blog: 48b006cb17e75ecdb707dc40dd654f449b94abe49f97a808b35cabca1c5fabbf\",\n      \"type\": \"indicator\",\n      \"created\": \"2026-09-17T17:53:45.156615Z\",\n      \"pattern\": \"[file:hashes.'SHA-256' = '48b006cb17e75ecdb707dc40dd654f449b94abe49f97a808b35cabca1c5fabbf']\",\n      \"modified\": \"2026-09-17T17:53:45.156615Z\",\n      \"valid_from\": \"2025-04-11T00:00:00.000000Z\",\n      \"description\": \"SHA-256 hash of d3d11.dll, listed in the IOC table and described as a Cobalt Strike-related payload used during post-exploitation.\",\n      \"pattern_type\": \"stix\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"indicator_types\": [\n        \"malicious-activity\"\n      ],\n      \"pattern_version\": \"2.1\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild\",\n          \"source_name\": \"huntress_blog\"\n        }\n      ]\n    },\n    {\n      \"id\": \"indicator--38fda90c-8cbc-4946-8988-3b4d7706b181\",\n      \"name\": \"elastic_security_labs: 86.38.225.59\",\n      \"type\": \"indicator\",\n      \"created\": \"2026-09-17T17:53:45.167579Z\",\n      \"pattern\": \"[ipv4-addr:value = '86.38.225.59']\",\n      \"modified\": \"2026-09-17T17:53:45.167579Z\",\n      \"valid_from\": \"2026-03-19T00:00:00.000000Z\",\n      \"description\": \"Adversary-controlled ScreenConnect command-and-control server used in the SILENTCONNECT campaign.\",\n      \"pattern_type\": \"stix\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"indicator_types\": [\n        \"malicious-activity\"\n      ],\n      \"pattern_version\": \"2.1\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.elastic.co/security-labs/threat-command/silentconnect-delivers-screenconnect\",\n          \"source_name\": \"elastic_security_labs\"\n        }\n      ]\n    },\n    {\n      \"id\": \"indicator--5baac882-c81d-473e-a461-d42bb3d19782\",\n      \"name\": \"huntress_blog: rtb.mftadsrvr.com\",\n      \"type\": \"indicator\",\n      \"created\": \"2026-09-17T17:53:45.159442Z\",\n      \"pattern\": \"[domain-name:value = 'rtb.mftadsrvr.com']\",\n      \"modified\": \"2026-09-17T17:53:45.159442Z\",\n      \"valid_from\": \"2025-04-11T00:00:00.000000Z\",\n      \"description\": \"Domain used by the MeshCentral agent installed during post-exploitation; the article ties it to the same infrastructure as Centre.exe.\",\n      \"pattern_type\": \"stix\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"indicator_types\": [\n        \"malicious-activity\"\n      ],\n      \"pattern_version\": \"2.1\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild\",\n          \"source_name\": \"huntress_blog\"\n        }\n      ]\n    },\n    {\n      \"id\": \"indicator--de10d7ff-31fa-406e-bf5b-93967af6c17f\",\n      \"name\": \"elastic_security_labs: c3d4361939d3f6cf2fe798fef68d4713141c48dce7dd29d3838a5d0c66aa29c7\",\n      \"type\": \"indicator\",\n      \"created\": \"2026-09-17T17:53:45.164982Z\",\n      \"pattern\": \"[file:hashes.'SHA-256' = 'c3d4361939d3f6cf2fe798fef68d4713141c48dce7dd29d3838a5d0c66aa29c7']\",\n      \"modified\": \"2026-09-17T17:53:45.164982Z\",\n      \"valid_from\": \"2026-03-19T00:00:00.000000Z\",\n      \"description\": \"SHA-256 of the malicious ScreenConnect.ClientSetup.msi installer deployed by the campaign.\",\n      \"pattern_type\": \"stix\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"indicator_types\": [\n        \"malicious-activity\"\n      ],\n      \"pattern_version\": \"2.1\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.elastic.co/security-labs/threat-command/silentconnect-delivers-screenconnect\",\n          \"source_name\": \"elastic_security_labs\"\n        }\n      ]\n    },\n    {\n      \"id\": \"ipv4-addr--872cf221-6429-5424-a644-711ca013c260\",\n      \"type\": \"ipv4-addr\",\n      \"value\": \"86.38.225.59\",\n      \"spec_version\": \"2.1\"\n    },\n    {\n      \"id\": \"ipv4-addr--a6cbba3c-d2ec-5833-b87d-8b64727216a5\",\n      \"type\": \"ipv4-addr\",\n      \"value\": \"165.227.7.206\",\n      \"spec_version\": \"2.1\"\n    },\n    {\n      \"id\": \"malware--a4558ada-8da1-428b-bb17-16c1851c841b\",\n      \"name\": \"SILENTCONNECT\",\n      \"type\": \"malware\",\n      \"created\": \"2026-09-17T17:53:45.148995Z\",\n      \"modified\": \"2026-09-17T17:53:45.148995Z\",\n      \"is_family\": true,\n      \"spec_version\": \"2.1\",\n      \"malware_types\": [\n        \"downloader\"\n      ],\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\"\n    },\n    {\n      \"id\": \"relationship--05ac3c7f-64c8-44bc-9cd7-c1af7d2570f3\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.176005Z\",\n      \"modified\": \"2026-09-17T17:53:45.176005Z\",\n      \"source_ref\": \"indicator--046f0048-f112-4f17-981f-da2404a9cf84\",\n      \"target_ref\": \"tool--1cddfda9-41b2-45d6-9b22-b849a7d91a44\",\n      \"description\": \"Reviewed tool association from the selected source verdict.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"indicates\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.elastic.co/security-labs/threat-command/silentconnect-delivers-screenconnect\",\n          \"source_name\": \"elastic_security_labs\"\n        }\n      ]\n    },\n    {\n      \"id\": \"relationship--208c41e1-fe2e-40b9-9b58-2e2321f6e326\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.178343Z\",\n      \"modified\": \"2026-09-17T17:53:45.178343Z\",\n      \"source_ref\": \"tool--1c09172f-2254-46c2-a5eb-f985b182d6b0\",\n      \"target_ref\": \"vulnerability--c3efd23a-65e5-4f7e-87fc-34e32cb7fe5f\",\n      \"description\": \"Threat actors have also been observed performing lateral movement and performing installation of remote access tooling, namely MeshCentral.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild\",\n          \"source_name\": \"huntress_blog\"\n        }\n      ]\n    },\n    {\n      \"id\": \"relationship--34c5a11a-9c97-4d48-b99b-8c64d16158a3\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.158016Z\",\n      \"modified\": \"2026-09-17T17:53:45.158016Z\",\n      \"source_ref\": \"indicator--2c3c072a-ab47-4cb8-bcc2-f343dac535d4\",\n      \"target_ref\": \"file--a6e7344f-4f56-5fb8-9bc5-6a3dd5e795d2\",\n      \"description\": \"This atomic indicator pattern matches this cyber observable.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"relationship--3e61c55d-3f1d-48d8-84b2-d822a4460d4d\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.160797Z\",\n      \"modified\": \"2026-09-17T17:53:45.160797Z\",\n      \"source_ref\": \"indicator--5baac882-c81d-473e-a461-d42bb3d19782\",\n      \"target_ref\": \"domain-name--685142e9-f5e7-5953-9dd9-de81cc4e5669\",\n      \"description\": \"This atomic indicator pattern matches this cyber observable.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"relationship--4aaf66d8-1f25-45de-90ed-6753bbe9cef5\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.172005Z\",\n      \"modified\": \"2026-09-17T17:53:45.172005Z\",\n      \"source_ref\": \"indicator--38fda90c-8cbc-4946-8988-3b4d7706b181\",\n      \"target_ref\": \"malware--a4558ada-8da1-428b-bb17-16c1851c841b\",\n      \"description\": \"Aggregate Mallory association; no stronger predicate inferred.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"relationship--54149a90-14b5-44c0-b28e-46397d5b2b93\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.175047Z\",\n      \"modified\": \"2026-09-17T17:53:45.175047Z\",\n      \"source_ref\": \"indicator--de10d7ff-31fa-406e-bf5b-93967af6c17f\",\n      \"target_ref\": \"malware--a4558ada-8da1-428b-bb17-16c1851c841b\",\n      \"description\": \"Aggregate Mallory association; no stronger predicate inferred.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"relationship--5bb05c53-95c3-406d-892a-e0e3fbdecbb1\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.174075Z\",\n      \"modified\": \"2026-09-17T17:53:45.174075Z\",\n      \"source_ref\": \"indicator--2c3c072a-ab47-4cb8-bcc2-f343dac535d4\",\n      \"target_ref\": \"tool--9ac8dc3e-e11f-48b4-add3-0be14b9c26b1\",\n      \"description\": \"Reviewed tool association from the selected source verdict.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"indicates\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild\",\n          \"source_name\": \"huntress_blog\"\n        }\n      ]\n    },\n    {\n      \"id\": \"relationship--7171d538-2980-4e6e-ae9a-1a5c6e577249\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.170924Z\",\n      \"modified\": \"2026-09-17T17:53:45.170924Z\",\n      \"source_ref\": \"indicator--de10d7ff-31fa-406e-bf5b-93967af6c17f\",\n      \"target_ref\": \"tool--1cddfda9-41b2-45d6-9b22-b849a7d91a44\",\n      \"description\": \"Reviewed tool association from the selected source verdict.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"indicates\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.elastic.co/security-labs/threat-command/silentconnect-delivers-screenconnect\",\n          \"source_name\": \"elastic_security_labs\"\n        }\n      ]\n    },\n    {\n      \"id\": \"relationship--9fbde642-362a-4b18-ade9-0e31be730828\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.154592Z\",\n      \"modified\": \"2026-09-17T17:53:45.154592Z\",\n      \"source_ref\": \"indicator--0d0e2908-cbbf-42f6-b263-7516177edd5b\",\n      \"target_ref\": \"ipv4-addr--a6cbba3c-d2ec-5833-b87d-8b64727216a5\",\n      \"description\": \"This atomic indicator pattern matches this cyber observable.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"relationship--b5a9f7a5-56a3-4282-9c29-358edfc45b4a\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.169819Z\",\n      \"modified\": \"2026-09-17T17:53:45.169819Z\",\n      \"source_ref\": \"indicator--38fda90c-8cbc-4946-8988-3b4d7706b181\",\n      \"target_ref\": \"tool--1cddfda9-41b2-45d6-9b22-b849a7d91a44\",\n      \"description\": \"Reviewed tool association from the selected source verdict.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"indicates\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.elastic.co/security-labs/threat-command/silentconnect-delivers-screenconnect\",\n          \"source_name\": \"elastic_security_labs\"\n        }\n      ]\n    },\n    {\n      \"id\": \"relationship--c601e955-d987-47e8-85e3-9136ee825946\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.177022Z\",\n      \"modified\": \"2026-09-17T17:53:45.177022Z\",\n      \"source_ref\": \"tool--9ac8dc3e-e11f-48b4-add3-0be14b9c26b1\",\n      \"target_ref\": \"vulnerability--c3efd23a-65e5-4f7e-87fc-34e32cb7fe5f\",\n      \"description\": \"CVE-2025-30406 is a 9.0 critical severity vulnerability pertaining to hardcoded keys set by default in the CentreStack and Triofox configuration files. This weakness can be leveraged to abuse the ASPX ViewState ... with ViewState deserialization ... Exploitation leads to remote code execution. | The Centre.exe process was removed by Windows Defender within minutes with the following Threat Name: Behavior:Win32/CobaltStrike.H!sms\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild\",\n          \"source_name\": \"huntress_blog\"\n        }\n      ]\n    },\n    {\n      \"id\": \"relationship--ce16e3f6-8fc9-48c8-b85b-5bcec7b35d5d\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.163617Z\",\n      \"modified\": \"2026-09-17T17:53:45.163617Z\",\n      \"source_ref\": \"indicator--046f0048-f112-4f17-981f-da2404a9cf84\",\n      \"target_ref\": \"domain-name--6fb7606f-c719-597d-8bcf-9c1f4e09ec62\",\n      \"description\": \"This atomic indicator pattern matches this cyber observable.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"relationship--e87c8f5a-b222-412a-a3da-76160c748ed7\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.166341Z\",\n      \"modified\": \"2026-09-17T17:53:45.166341Z\",\n      \"source_ref\": \"indicator--de10d7ff-31fa-406e-bf5b-93967af6c17f\",\n      \"target_ref\": \"file--553fdc5e-6ed0-5a68-9979-1882f8fdaeb6\",\n      \"description\": \"This atomic indicator pattern matches this cyber observable.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"relationship--f68ba0d7-a305-45aa-a1cb-cfe3c9d8418a\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.173055Z\",\n      \"modified\": \"2026-09-17T17:53:45.173055Z\",\n      \"source_ref\": \"indicator--5baac882-c81d-473e-a461-d42bb3d19782\",\n      \"target_ref\": \"tool--1c09172f-2254-46c2-a5eb-f985b182d6b0\",\n      \"description\": \"Reviewed tool association from the selected source verdict.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"indicates\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.huntress.com/blog/cve-2025-30406-critical-gladinet-centrestack-triofox-vulnerability-exploited-in-the-wild\",\n          \"source_name\": \"huntress_blog\"\n        }\n      ]\n    },\n    {\n      \"id\": \"relationship--fd01fc79-fbac-48cb-b73e-5e71eeccdc06\",\n      \"type\": \"relationship\",\n      \"created\": \"2026-09-17T17:53:45.168822Z\",\n      \"modified\": \"2026-09-17T17:53:45.168822Z\",\n      \"source_ref\": \"indicator--38fda90c-8cbc-4946-8988-3b4d7706b181\",\n      \"target_ref\": \"ipv4-addr--872cf221-6429-5424-a644-711ca013c260\",\n      \"description\": \"This atomic indicator pattern matches this cyber observable.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"relationship_type\": \"related-to\"\n    },\n    {\n      \"id\": \"tool--1c09172f-2254-46c2-a5eb-f985b182d6b0\",\n      \"name\": \"MeshCentral\",\n      \"type\": \"tool\",\n      \"created\": \"2026-09-17T17:53:45.148001Z\",\n      \"modified\": \"2026-09-17T17:53:45.148001Z\",\n      \"tool_types\": [\n        \"remote-access\"\n      ],\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\"\n    },\n    {\n      \"id\": \"tool--1cddfda9-41b2-45d6-9b22-b849a7d91a44\",\n      \"name\": \"ScreenConnect\",\n      \"type\": \"tool\",\n      \"created\": \"2026-09-17T17:53:45.146908Z\",\n      \"modified\": \"2026-09-17T17:53:45.146908Z\",\n      \"tool_types\": [\n        \"remote-access\"\n      ],\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\"\n    },\n    {\n      \"id\": \"tool--9ac8dc3e-e11f-48b4-add3-0be14b9c26b1\",\n      \"name\": \"Cobalt Strike\",\n      \"type\": \"tool\",\n      \"created\": \"2026-09-17T17:53:45.145740Z\",\n      \"modified\": \"2026-09-17T17:53:45.145740Z\",\n      \"tool_types\": [\n        \"remote-access\"\n      ],\n      \"description\": \"[Cobalt Strike](https://attack.mitre.org/software/S0154) is a commercial, full-featured, remote access tool that bills itself as \u201cadversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors\u201d. Cobalt Strike\u2019s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.(Citation: cobaltstrike manual)\\n\\nIn addition to its own capabilities, [Cobalt Strike](https://attack.mitre.org/software/S0154) leverages the capabilities of other well-known tools such as Metasploit and [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: cobaltstrike manual)\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\"\n    },\n    {\n      \"id\": \"vulnerability--c3efd23a-65e5-4f7e-87fc-34e32cb7fe5f\",\n      \"name\": \"CVE-2025-30406\",\n      \"type\": \"vulnerability\",\n      \"created\": \"2026-09-17T17:53:45.149994Z\",\n      \"modified\": \"2026-09-17T17:53:45.149994Z\",\n      \"description\": \"Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors (who know the machineKey) to serialize a payload for server-side deserialization to achieve remote code execution. NOTE: a CentreStack admin can manually delete the machineKey defined in portal\\\\web.config.\",\n      \"spec_version\": \"2.1\",\n      \"created_by_ref\": \"identity--17d3dc12-f291-41e5-a0a3-e8b3f450b92e\",\n      \"external_references\": [\n        {\n          \"url\": \"https://www.cve.org/CVERecord?id=CVE-2025-30406\",\n          \"external_id\": \"CVE-2025-30406\",\n          \"source_name\": \"cve\"\n        }\n      ]\n    }\n  ]\n}\n\n\n{\n    \"type\": \"bundle\",\n    \"id\": \"bundle--865c7574-60a0-4f3b-8f83-73879f641d69\",\n    \"objects\": [\n        {\n            \"type\": \"identity\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.505342Z\",\n            \"modified\": \"2026-09-17T14:55:51.505342Z\",\n            \"name\": \"ThreatCluster\",\n            \"description\": \"Automated threat intelligence aggregation and clustering platform\",\n            \"identity_class\": \"organization\",\n            \"sectors\": [\n                \"technology\"\n            ],\n            \"contact_information\": \"https://threatcluster.io\"\n        },\n        {\n            \"type\": \"attack-pattern\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"attack-pattern--06e64cc6-003a-5fb8-ac6a-bac4778c2f78\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.506427Z\",\n            \"modified\": \"2026-09-17T14:55:51.506427Z\",\n            \"name\": \"Sql Injection\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"vulnerability\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"vulnerability--d4dd3367-e862-54dd-928a-f388e5c85e40\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.507109Z\",\n            \"modified\": \"2026-09-17T14:55:51.507109Z\",\n            \"name\": \"CVE-2010-2075\",\n            \"external_references\": [\n                {\n                    \"source_name\": \"cve\",\n                    \"url\": \"https://nvd.nist.gov/vuln/detail/CVE-2010-2075\",\n                    \"external_id\": \"CVE-2010-2075\"\n                }\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"vulnerability\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"vulnerability--b676f0de-e8ad-5025-b266-9339712f1df7\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.507473Z\",\n            \"modified\": \"2026-09-17T14:55:51.507473Z\",\n            \"name\": \"CVE-2014-3704\",\n            \"external_references\": [\n                {\n                    \"source_name\": \"cve\",\n                    \"url\": \"https://nvd.nist.gov/vuln/detail/CVE-2014-3704\",\n                    \"external_id\": \"CVE-2014-3704\"\n                }\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"vulnerability\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"vulnerability--874a5ee4-6794-51a3-8cb5-d6300404abd1\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.507716Z\",\n            \"modified\": \"2026-09-17T14:55:51.507716Z\",\n            \"name\": \"Drupageddon\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--2a363e7c-c142-5444-9bcb-106836c86f5e\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.507988Z\",\n            \"modified\": \"2026-09-17T14:55:51.507988Z\",\n            \"name\": \"VMware\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--3c1d870f-0646-506e-9626-25461fe1d69d\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.508248Z\",\n            \"modified\": \"2026-09-17T14:55:51.508248Z\",\n            \"name\": \"Curl\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--99ac6ee6-6415-57f0-8743-583045c0bda7\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.508513Z\",\n            \"modified\": \"2026-09-17T14:55:51.508513Z\",\n            \"name\": \"Gobuster\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--13b952fe-ad59-5216-bcf5-7fda84a981c1\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.508762Z\",\n            \"modified\": \"2026-09-17T14:55:51.508762Z\",\n            \"name\": \"Metasploit\",\n            \"tool_types\": [\n                \"exploitation\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--39a89892-ed14-5808-9e97-a0d2a329d5f3\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.509002Z\",\n            \"modified\": \"2026-09-17T14:55:51.509002Z\",\n            \"name\": \"Msfconsole\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--6e0efbae-cfa1-59e2-85de-ff552d345e9f\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.509264Z\",\n            \"modified\": \"2026-09-17T14:55:51.509264Z\",\n            \"name\": \"Msfvenom\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--9f361cac-8efd-5267-9185-4e9b3973af4b\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.509489Z\",\n            \"modified\": \"2026-09-17T14:55:51.509489Z\",\n            \"name\": \"Nmap\",\n            \"tool_types\": [\n                \"information-gathering\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--2b73fcda-b127-5cf1-b0d6-6b9c4533c119\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.509867Z\",\n            \"modified\": \"2026-09-17T14:55:51.509867Z\",\n            \"name\": \"Openssl\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--249779c5-82b6-5a4b-8f23-c7d0a5f4467e\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.510218Z\",\n            \"modified\": \"2026-09-17T14:55:51.510218Z\",\n            \"name\": \"SCP\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--4d1f8a2f-f12d-5d8c-95c9-abd15ae81c99\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.510452Z\",\n            \"modified\": \"2026-09-17T14:55:51.510452Z\",\n            \"name\": \"Sed\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"tool\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"tool--83fade07-eaa2-5b09-8620-c78529c2a385\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.51073Z\",\n            \"modified\": \"2026-09-17T14:55:51.51073Z\",\n            \"name\": \"SSH\",\n            \"tool_types\": [\n                \"unknown\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"report\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.511222Z\",\n            \"modified\": \"2026-09-17T14:55:51.511222Z\",\n            \"name\": \"Critical SQL Injection Vulnerabilities in Drupal Exploited\",\n            \"description\": \"Recent penetration tests revealed multiple critical vulnerabilities in Drupal, specifically CVE-2014-3704, which allows remote code execution. The tests were conducted in a controlled lab environment, demonstrating exploitation methods including SQL injection and privilege escalation. The affected systems include Drupal 7.5, which was found to be vulnerable to 'Drupageddon', leading to a full database dump. Tools such as Metasploit and manual SQL injection techniques were employed during the tests. The exploitation resulted in unauthorized access to sensitive data, including plaintext passwords. Additionally, misconfigured SSH credentials were identified, further increasing the risk. The findings underscore the need for immediate remediation and security hardening for Drupal installations. Current status indicates that these vulnerabilities remain critical and require urgent attention from system administrators.\\n\\nKey Points:\\n\\u2022 CVE-2014-3704 allows remote code execution in Drupal 7.5.\\n\\u2022 Penetration tests demonstrated successful exploitation via SQL injection.\\n\\u2022 Immediate remediation is necessary to secure affected Drupal installations.\",\n            \"report_types\": [\n                \"threat-report\",\n                \"vulnerability\",\n                \"attack-pattern\"\n            ],\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ],\n            \"published\": \"2026-09-16T16:14:51Z\",\n            \"object_refs\": [\n                \"attack-pattern--06e64cc6-003a-5fb8-ac6a-bac4778c2f78\",\n                \"vulnerability--d4dd3367-e862-54dd-928a-f388e5c85e40\",\n                \"vulnerability--b676f0de-e8ad-5025-b266-9339712f1df7\",\n                \"vulnerability--874a5ee4-6794-51a3-8cb5-d6300404abd1\",\n                \"tool--2a363e7c-c142-5444-9bcb-106836c86f5e\",\n                \"tool--3c1d870f-0646-506e-9626-25461fe1d69d\",\n                \"tool--99ac6ee6-6415-57f0-8743-583045c0bda7\",\n                \"tool--13b952fe-ad59-5216-bcf5-7fda84a981c1\",\n                \"tool--39a89892-ed14-5808-9e97-a0d2a329d5f3\",\n                \"tool--6e0efbae-cfa1-59e2-85de-ff552d345e9f\",\n                \"tool--9f361cac-8efd-5267-9185-4e9b3973af4b\",\n                \"tool--2b73fcda-b127-5cf1-b0d6-6b9c4533c119\",\n                \"tool--249779c5-82b6-5a4b-8f23-c7d0a5f4467e\",\n                \"tool--4d1f8a2f-f12d-5d8c-95c9-abd15ae81c99\",\n                \"tool--83fade07-eaa2-5b09-8620-c78529c2a385\"\n            ],\n            \"labels\": [\n                \"drupal\",\n                \"penetration\",\n                \"drupal-penetration-testing\",\n                \"exploit\",\n                \"injection\",\n                \"complete\",\n                \"testing\"\n            ],\n            \"confidence\": 70,\n            \"external_references\": [\n                {\n                    \"source_name\": \"ThreatCluster\",\n                    \"url\": \"https://threatcluster.io/cluster/critical-sql-injection-vulnerabilities-in-drupal-exploited-31e826cb\",\n                    \"external_id\": \"8568345c-c910-447b-890d-f6ae31e826cb\"\n                },\n                {\n                    \"source_name\": \"Sploitus\",\n                    \"url\": \"https://sploitus.com/exploit?id=AD4457C9-F24C-5AC0-9548-721DEFF4A69B&utm_source=rss&utm_medium=rss\"\n                },\n                {\n                    \"source_name\": \"Sploitus\",\n                    \"url\": \"https://sploitus.com/exploit?id=C6D824DB-20E7-5DED-8E2A-668235BF6B65&utm_source=rss&utm_medium=rss\"\n                }\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--9ab53ff3-a476-5410-b501-7915b5dece39\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.511655Z\",\n            \"modified\": \"2026-09-17T14:55:51.511655Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"attack-pattern--06e64cc6-003a-5fb8-ac6a-bac4778c2f78\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--15097aca-02e1-52bb-ad5c-7b51bc335f95\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.511954Z\",\n            \"modified\": \"2026-09-17T14:55:51.511954Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"vulnerability--d4dd3367-e862-54dd-928a-f388e5c85e40\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--0cadb32a-2b6f-50e0-9dd5-f4bf26337b09\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.51285Z\",\n            \"modified\": \"2026-09-17T14:55:51.51285Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"vulnerability--b676f0de-e8ad-5025-b266-9339712f1df7\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--df875b78-933a-5eb6-8839-ca7794af0198\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.513186Z\",\n            \"modified\": \"2026-09-17T14:55:51.513186Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"vulnerability--874a5ee4-6794-51a3-8cb5-d6300404abd1\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--2f22d159-7d7a-5d7a-85e1-615634583321\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.513524Z\",\n            \"modified\": \"2026-09-17T14:55:51.513524Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--2a363e7c-c142-5444-9bcb-106836c86f5e\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--a6f76931-818e-557b-bb05-d5d7e3af721c\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.513866Z\",\n            \"modified\": \"2026-09-17T14:55:51.513866Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--3c1d870f-0646-506e-9626-25461fe1d69d\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--e453bdb1-db68-5652-a9a3-34a8ba02c866\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.514325Z\",\n            \"modified\": \"2026-09-17T14:55:51.514325Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--99ac6ee6-6415-57f0-8743-583045c0bda7\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--e7a4703a-0df9-5733-bbd9-f406b2d036b1\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.514755Z\",\n            \"modified\": \"2026-09-17T14:55:51.514755Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--13b952fe-ad59-5216-bcf5-7fda84a981c1\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--8e5e6749-0b85-53a0-b25d-248fca2f8641\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.515046Z\",\n            \"modified\": \"2026-09-17T14:55:51.515046Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--39a89892-ed14-5808-9e97-a0d2a329d5f3\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--209b01e1-9f85-5939-ad30-fc87cd955b75\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.515418Z\",\n            \"modified\": \"2026-09-17T14:55:51.515418Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--6e0efbae-cfa1-59e2-85de-ff552d345e9f\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--a10b623d-9e68-537d-b4da-025ca69929e3\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.515767Z\",\n            \"modified\": \"2026-09-17T14:55:51.515767Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--9f361cac-8efd-5267-9185-4e9b3973af4b\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--359cb62e-bee1-5c4f-8810-a0a65cebbeeb\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.516082Z\",\n            \"modified\": \"2026-09-17T14:55:51.516082Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--2b73fcda-b127-5cf1-b0d6-6b9c4533c119\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--e9ad5928-96a2-5eae-a4f4-bcda99f54803\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.516432Z\",\n            \"modified\": \"2026-09-17T14:55:51.516432Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--249779c5-82b6-5a4b-8f23-c7d0a5f4467e\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--39acb819-cd62-51f6-affa-189fbf0b960f\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.516805Z\",\n            \"modified\": \"2026-09-17T14:55:51.516805Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--4d1f8a2f-f12d-5d8c-95c9-abd15ae81c99\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        },\n        {\n            \"type\": \"relationship\",\n            \"spec_version\": \"2.1\",\n            \"id\": \"relationship--7b08880e-a2e7-5fac-9d38-b95fabd41b32\",\n            \"created_by_ref\": \"identity--a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d\",\n            \"created\": \"2026-09-17T14:55:51.517148Z\",\n            \"modified\": \"2026-09-17T14:55:51.517148Z\",\n            \"relationship_type\": \"mentions\",\n            \"source_ref\": \"report--c2f033c4-3e56-5dd3-9326-2955160800e1\",\n            \"target_ref\": \"tool--83fade07-eaa2-5b09-8620-c78529c2a385\",\n            \"object_marking_refs\": [\n                \"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n            ]\n        }\n    ]\n}", "creation_timestamp": "2026-09-17T19:18:21.817209Z"}