{
 "type": "bundle",
 "id": "bundle--ab9cf865-7076-5fd4-b928-45b747dbd4d3",
 "objects": [
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "name": "Threadlinqs Intelligence",
   "identity_class": "organization",
   "contact_information": "contact@threadlinqs.com",
   "description": "Independent cross-reference by the Threadlinqs Team; not affiliated with or endorsed by Anthropic. Indicator values and Anthropic descriptions come from Anthropic's published IoC CSV (2026-09-10) and are republished for defensive use with attribution."
  },
  {
   "type": "intrusion-set",
   "spec_version": "2.1",
   "id": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 (Anthropic designation)",
   "description": "Activity cluster designated GTG-20006 in Anthropic's report \"Detecting and countering misuse of AI: September 2026\". Cross-referenced by Threadlinqs.",
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "description": "Detecting and countering misuse of AI: September 2026"
    }
   ]
  },
  {
   "type": "intrusion-set",
   "spec_version": "2.1",
   "id": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 (Anthropic designation)",
   "description": "Activity cluster designated GTG-50014 in Anthropic's report \"Detecting and countering misuse of AI: September 2026\". Cross-referenced by Threadlinqs.",
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "description": "Detecting and countering misuse of AI: September 2026"
    }
   ]
  },
  {
   "type": "intrusion-set",
   "spec_version": "2.1",
   "id": "intrusion-set--3b9df88d-fa10-5774-8893-6452682d9974",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50020 (Anthropic designation)",
   "description": "Activity cluster designated GTG-50020 in Anthropic's report \"Detecting and countering misuse of AI: September 2026\". Cross-referenced by Threadlinqs.",
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50020-from-hotel-bookings-to-the-ai-supply-chain",
     "description": "Detecting and countering misuse of AI: September 2026"
    }
   ]
  },
  {
   "type": "intrusion-set",
   "spec_version": "2.1",
   "id": "intrusion-set--6fb072fb-5710-518f-ab93-f696d10f5eae",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50021 (Anthropic designation)",
   "description": "Activity cluster designated GTG-50021 in Anthropic's report \"Detecting and countering misuse of AI: September 2026\". Cross-referenced by Threadlinqs.",
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50021-indicators-of-compromise",
     "description": "Detecting and countering misuse of AI: September 2026"
    }
   ]
  },
  {
   "type": "intrusion-set",
   "spec_version": "2.1",
   "id": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 (Anthropic designation)",
   "description": "Activity cluster designated GTG-50029 in Anthropic's report \"Detecting and countering misuse of AI: September 2026\". Cross-referenced by Threadlinqs.",
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "description": "Detecting and countering misuse of AI: September 2026"
    }
   ]
  },
  {
   "type": "intrusion-set",
   "spec_version": "2.1",
   "id": "intrusion-set--e47526e5-6e4e-5763-b1d1-ccda9177effc",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-24015 (Anthropic designation)",
   "description": "Activity cluster designated GTG-24015 in Anthropic's report \"Detecting and countering misuse of AI: September 2026\". Cross-referenced by Threadlinqs.",
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-24015-disrupting-russian-state-media-editorial-pipelines-built-on-claude",
     "description": "Detecting and countering misuse of AI: September 2026"
    }
   ]
  },
  {
   "type": "intrusion-set",
   "spec_version": "2.1",
   "id": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 (Anthropic designation)",
   "description": "Activity cluster designated GTG-54002 in Anthropic's report \"Detecting and countering misuse of AI: September 2026\". Cross-referenced by Threadlinqs.",
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "description": "Detecting and countering misuse of AI: September 2026"
    }
   ]
  },
  {
   "type": "intrusion-set",
   "spec_version": "2.1",
   "id": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 (Anthropic designation)",
   "description": "Activity cluster designated GTG-84005 in Anthropic's report \"Detecting and countering misuse of AI: September 2026\". Cross-referenced by Threadlinqs.",
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "description": "Detecting and countering misuse of AI: September 2026"
    }
   ]
  },
  {
   "type": "intrusion-set",
   "spec_version": "2.1",
   "id": "intrusion-set--c199537e-06a4-5c7e-b514-53fc1928125d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84006 (Anthropic designation)",
   "description": "Activity cluster designated GTG-84006 in Anthropic's report \"Detecting and countering misuse of AI: September 2026\". Cross-referenced by Threadlinqs.",
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84006-disrupting-a-distributed-mekncri-aligned-influence-operation-that-used-a-shared-ai-agent-to-impersonate-real-people-and-recruit-inside-iran",
     "description": "Detecting and countering misuse of AI: September 2026"
    }
   ]
  },
  {
   "type": "intrusion-set",
   "spec_version": "2.1",
   "id": "intrusion-set--e40f642d-0fd5-5290-a2cb-e5c4c04aa0bd",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-30006 (Anthropic designation)",
   "description": "Activity cluster designated GTG-30006 in Anthropic's report \"Detecting and countering misuse of AI: September 2026\". Cross-referenced by Threadlinqs.",
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-30006-building-the-tools-for-domestic-surveillance",
     "description": "Detecting and countering misuse of AI: September 2026"
    }
   ]
  },
  {
   "type": "intrusion-set",
   "spec_version": "2.1",
   "id": "intrusion-set--377acd3e-8e07-5354-80a0-1035f887e856",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-15001 (Anthropic designation)",
   "description": "Activity cluster designated GTG-15001 in Anthropic's report \"Detecting and countering misuse of AI: September 2026\". Cross-referenced by Threadlinqs.",
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-15001-deceptive-dating-app-network",
     "description": "Detecting and countering misuse of AI: September 2026"
    }
   ]
  },
  {
   "type": "intrusion-set",
   "spec_version": "2.1",
   "id": "intrusion-set--d576c25e-27c4-5b1e-8775-52b966d99620",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "Storm-2945 (Microsoft) designation",
   "description": "Vendor-designated cluster Storm-2945 (Microsoft); indicators from Threadlinqs records built on that vendor's reporting.",
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026",
     "description": "Detecting and countering misuse of AI: September 2026"
    }
   ]
  },
  {
   "type": "intrusion-set",
   "spec_version": "2.1",
   "id": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) designation",
   "description": "Vendor-designated cluster UNC7005 (Google); indicators from Threadlinqs records built on that vendor's reporting.",
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026",
     "description": "Detecting and countering misuse of AI: September 2026"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--674d00d2-8d38-537e-9fa1-25a76f164ea0",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "related-to",
   "source_ref": "intrusion-set--d576c25e-27c4-5b1e-8775-52b966d99620",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee",
   "description": "Infrastructure overlap found by Threadlinqs in records created before 2026-09-10; attribution of the vendor cluster stays with its publisher."
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--2599d6f7-2c61-5c0f-b95a-84b855fc3c92",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "related-to",
   "source_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee",
   "description": "Infrastructure overlap found by Threadlinqs in records created before 2026-09-10; attribution of the vendor cluster stays with its publisher."
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--aca4b689-c059-5690-b56f-9b85fe0afaa6",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain ad-g[.]org",
   "pattern": "[domain-name:value = 'ad-g.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "C2 domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--1112b12a-8cb7-540b-804a-7a488625e953",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--4ed6c5c5-0662-5a77-8602-c1767a77482c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--aca4b689-c059-5690-b56f-9b85fe0afaa6",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--0c5f31ca-b19c-58af-ab41-a0e46df53c4f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain cdncounter[.]net",
   "pattern": "[domain-name:value = 'cdncounter.net']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Actor infrastructure domain",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--992366f5-c964-509f-b217-27fab87c3316",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-0245",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-0245"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--bea3aafa-6c4f-5dc0-8de0-31103002a4c3",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--0c5f31ca-b19c-58af-ab41-a0e46df53c4f",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--5f6e6c50-f194-554f-8cf5-d3e0d43ade31",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain chamber-ua[.]org",
   "pattern": "[domain-name:value = 'chamber-ua.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Lookalike of a Ukrainian chamber organization",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--1133aa2f-0064-5127-8182-a74908b9fe9b",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2167",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2167"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--5b01d834-198e-5c53-80df-9523b900e4a4",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--5f6e6c50-f194-554f-8cf5-d3e0d43ade31",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--7e645ecd-88dc-54f7-bcad-929f2916f2b5",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain chathamhouse[.]eu",
   "pattern": "[domain-name:value = 'chathamhouse.eu']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Lookalike of Chatham House",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--0bef2cc2-743d-5321-81f1-e305fda0b369",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--8c017172-6543-5ca3-8e6a-267ec2bbef9e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--7e645ecd-88dc-54f7-bcad-929f2916f2b5",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--d61c8a86-b082-594e-926f-0880360d60b1",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain docs-viewer[.]org",
   "pattern": "[domain-name:value = 'docs-viewer.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "C2 nginx reverse proxy",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--55cc5602-2011-5e10-84cd-37a3d69007bd",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--bd109a62-9ac7-5d3b-84a9-767035790035",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--d61c8a86-b082-594e-926f-0880360d60b1",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--3e049ace-ea67-5361-a56d-e958e3956417",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain itechx[.]tel",
   "pattern": "[domain-name:value = 'itechx.tel']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Actor identity domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--a464777f-dc3f-5f40-9f25-701edf9e9622",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--c1dae459-7cee-5447-94a0-30a9bd0a238e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--3e049ace-ea67-5361-a56d-e958e3956417",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--dd034476-873f-5195-a554-2fd983fe3dd1",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain m365-owa[.]com",
   "pattern": "[domain-name:value = 'm365-owa.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Microsoft 365 Phishing",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--afe1a0ff-49ec-5994-be46-9ef04a19ad38",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1808",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1808"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1838",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1838"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1853",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1853"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1857",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1857"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2167",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2167"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2446",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2446"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--9d938e6e-b1c9-5cdf-889a-9b47159f7f7f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--dd034476-873f-5195-a554-2fd983fe3dd1",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--99517494-77dd-59ae-8cd6-6c18427039a6",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain meridian-protocol[.]org",
   "pattern": "[domain-name:value = 'meridian-protocol.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Operator/lure infrastructure",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--eef621a9-3d72-53d1-8459-5140ac8226ae",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--37713a10-a888-59fd-81e8-515db1d616fd",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--99517494-77dd-59ae-8cd6-6c18427039a6",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--682ba9ae-37ef-5eea-852d-1985ef1d8dd0",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain meridiangroup-corp[.]com",
   "pattern": "[domain-name:value = 'meridiangroup-corp.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Operator/lure infrastructure",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--c4274690-9cc6-5c2f-93e7-caa2e63b391d",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--55e7fa06-7a56-563b-8a39-cdb72546bc17",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--682ba9ae-37ef-5eea-852d-1985ef1d8dd0",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--0765de60-cb7a-536a-a695-75a127ff86c4",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain metricwave[.]org",
   "pattern": "[domain-name:value = 'metricwave.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Operator/lure infrastructure",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--7ec535e7-70d4-547a-8415-ce714eef245c",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--8e22fbe3-9cd5-5556-839c-48e401caff63",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--0765de60-cb7a-536a-a695-75a127ff86c4",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--8077303a-e8af-5105-8ef7-8338181725d4",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain mgsend[.]org",
   "pattern": "[domain-name:value = 'mgsend.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Operator/lure infrastructure",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--b90fc946-efb6-5c5d-9c45-a263be664dd2",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--210d37fd-0401-53ad-b8a5-b757afe19b68",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--8077303a-e8af-5105-8ef7-8338181725d4",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--2cb5839c-f75e-5408-ae87-c7d9a54206b5",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain ms365-device[.]com",
   "pattern": "[domain-name:value = 'ms365-device.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Microsoft 365 Phishing",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--a3c4f801-ca05-5c06-892f-b96f147ff0cc",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1808",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1808"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1838",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1838"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1853",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1853"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1857",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1857"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2167",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2167"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2446",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2446"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--24acac1c-a6f7-5fe4-abf8-6ecdba440e78",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--2cb5839c-f75e-5408-ae87-c7d9a54206b5",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--eb9d339b-5e58-5fc8-8ae4-c22cdc9fd316",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain ms365-live[.]com",
   "pattern": "[domain-name:value = 'ms365-live.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Microsoft 365 Phishing",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--00f9020f-7fed-5580-ab43-0a7284bd6017",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1808",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1808"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1838",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1838"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1853",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1853"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1857",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1857"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2446",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2446"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--253efb5c-764c-5b18-b625-d7428d90caee",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--eb9d339b-5e58-5fc8-8ae4-c22cdc9fd316",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--e8f649cb-b747-578a-96e7-09fac885135d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain my-invite[.]org",
   "pattern": "[domain-name:value = 'my-invite.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Actor phishing domain",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--8474cc76-eadc-5c6a-a45a-e41c1776d823",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2167",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2167"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--f56a2ee8-dd45-5d8c-9940-805e36530c2f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--e8f649cb-b747-578a-96e7-09fac885135d",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--6988ff90-017c-5015-9175-b12a53419784",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain mygreatmarket[.]com",
   "pattern": "[domain-name:value = 'mygreatmarket.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "ClickFix cookie-exfil C2",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--7f26a53e-c75f-56e2-b789-d33df31963ce",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--a5bd1d21-2dc6-5d6f-9509-b15f1f824c49",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--6988ff90-017c-5015-9175-b12a53419784",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--3f02ac18-0337-5f9e-bab1-c1606899a5b3",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain mygreatmarket[.]org",
   "pattern": "[domain-name:value = 'mygreatmarket.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "ClickFix cookie-exfil C2",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--6a6ed810-1fd5-5bd7-bdfa-e5a852441a0b",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--969d27c7-a86a-5f6c-b3bb-7c2dc1a13158",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--3f02ac18-0337-5f9e-bab1-c1606899a5b3",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--03d80873-d00d-59f7-afe0-b2724bf02687",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain owa-ms365[.]com",
   "pattern": "[domain-name:value = 'owa-ms365.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Microsoft 365 Phishing",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--ebf9389c-c5e2-5a40-807e-c2aa8eb11ad1",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1808",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1808"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1838",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1838"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1853",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1853"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1857",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1857"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2167",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2167"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2446",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2446"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--f3305d8d-1db1-5607-9e20-b4d57f3d00d4",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--03d80873-d00d-59f7-afe0-b2724bf02687",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--12bef5a7-039e-5b7a-8c12-a04efc2d5b9c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain projectnightcrawler[.]dev",
   "pattern": "[domain-name:value = 'projectnightcrawler.dev']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Operator/lure infrastructure",
   "labels": [
    "context-only"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--6165e7cd-3844-5913-b085-022f2aca1659",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-0835",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-0835"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1339",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1339"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1351",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1351"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1414",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1414"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1445",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1445"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1449",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1449"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1742",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1742"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1865",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1865"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2020",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2020"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2350",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2350"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2362",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2362"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--623efd65-a4fe-553d-bd5d-aa3db3bb7cb2",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--12bef5a7-039e-5b7a-8c12-a04efc2d5b9c",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--06470dff-63e8-5d4d-8a02-fa1e87de76b0",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain russianearabroad[.]com",
   "pattern": "[domain-name:value = 'russianearabroad.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "ClickFix lure",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--0f20e665-9916-5bda-bdfd-6ecad635a838",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--09228fea-d7f2-53e4-8599-c5beee47a361",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--06470dff-63e8-5d4d-8a02-fa1e87de76b0",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--1059da27-a7e7-5bd5-8b18-10a68e527138",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain russianearabroad[.]org",
   "pattern": "[domain-name:value = 'russianearabroad.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Actor persona domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--531bb7b2-fb9c-56e2-9425-b7714b2f2e56",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--994aa8b4-a0a4-5b71-b5ea-e4f58de3e57a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--1059da27-a7e7-5bd5-8b18-10a68e527138",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--d6ec6b74-6f15-57f3-a2f3-22edfcd1b7fe",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain static-ms[.]live",
   "pattern": "[domain-name:value = 'static-ms.live']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Operator/lure infrastructure",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--1aba9995-8c3d-5f4e-a369-c8e667f55dd1",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--f592c678-5f03-5a8d-af4f-6f1d4715f01e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--d6ec6b74-6f15-57f3-a2f3-22edfcd1b7fe",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--46b4818c-62a8-5084-b4ee-237081bf7dcd",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain statistic-ms[.]live",
   "pattern": "[domain-name:value = 'statistic-ms.live']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Primary RAT C2 domain",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--906f3624-83c7-5b2e-a3fd-89e34cabad23",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2167",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2167"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--d975f030-95a9-566e-962e-ca83f343abd6",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--46b4818c-62a8-5084-b4ee-237081bf7dcd",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--6c00d09d-bb3a-5147-8f4c-c50429b2ecc6",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain stuseamandesilt[.]org",
   "pattern": "[domain-name:value = 'stuseamandesilt.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Campaign base domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--705377d9-0260-505d-8155-7421c05654b9",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--9577b005-04db-5013-8e0f-6470141d3d0e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--6c00d09d-bb3a-5147-8f4c-c50429b2ecc6",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--181e5d17-f44a-5860-83c7-5376b364cac3",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain ukrinform-share[.]net",
   "pattern": "[domain-name:value = 'ukrinform-share.net']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Lookalike of Ukrinform",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--f771082c-777c-54b9-ab1c-364271862e5d",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--7943a845-aa42-58c5-b4c9-2bafd4c3c811",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--181e5d17-f44a-5860-83c7-5376b364cac3",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--2f6549b7-45e9-53c0-a748-9ffa23762ec6",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain wa-connect[.]eu",
   "pattern": "[domain-name:value = 'wa-connect.eu']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "ClickFix cookie exfil C2",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--f46943bd-d777-5cb7-9e94-4a9b4d162e38",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--b50bde66-26a8-5fd9-b437-0051ad8d706e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--2f6549b7-45e9-53c0-a748-9ffa23762ec6",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--ebec6115-665a-5d05-8297-530ccec96240",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 domain wa-meeting[.]com",
   "pattern": "[domain-name:value = 'wa-meeting.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "WhatsApp Web pairing code phishing domain",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--65fbeb0e-b4de-5e8a-9a5b-f86152f7e1ff",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--287df2b2-0b05-5f25-ace8-4e7378632fa5",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--ebec6115-665a-5d05-8297-530ccec96240",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--83a7940d-843e-5cd7-aaaf-82be0d76b030",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 email anna.manager@russianearabroad[.]net",
   "pattern": "[email-addr:value = 'anna.manager@russianearabroad.net']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Phishing persona address",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--988380a4-0eaf-51d7-b0ae-42d37b9d03aa",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--478881c4-d582-53b1-ab6d-13c26502fd3b",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--83a7940d-843e-5cd7-aaaf-82be0d76b030",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--b9e3689d-2329-5443-a3e0-eea713b73dbf",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 email events@embassy-protocol[.]int",
   "pattern": "[email-addr:value = 'events@embassy-protocol.int']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Phishing persona address",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--94c66d25-93ab-553d-b86a-898bb6c40a3e",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--4bfe0cdc-9ef1-5e6b-a5d8-ccbb18f2f7e6",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--b9e3689d-2329-5443-a3e0-eea713b73dbf",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--566978a4-fab8-5aa6-81cb-1b2db354843d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 filename WUEngine.exe",
   "pattern": "[file:name = 'WUEngine.exe']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Malware file name. Windows malware",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--d82d4da0-5a43-577e-be63-a3321bef47b6",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--6c93fb82-c2cd-5a98-b4fc-4d8eaffa46b9",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--566978a4-fab8-5aa6-81cb-1b2db354843d",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--43d2a225-0dc4-5809-bd11-b02cdbc90a0d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 filename client_20260507093021_4286d211_x64.exe",
   "pattern": "[file:name = 'client_20260507093021_4286d211_x64.exe']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Malware build artifact",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--7a486c27-c66c-5536-acd2-c8fd3985a0f0",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--d4b0a842-8001-5324-b217-d270a2336630",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--43d2a225-0dc4-5809-bd11-b02cdbc90a0d",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--581fc666-827d-579a-b22a-688c95dc584b",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 filename fix_network.apk",
   "pattern": "[file:name = 'fix_network.apk']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Android malware payload",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--66d52f33-0e22-50f1-b5a1-f50371c77326",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--00ba362d-97eb-53be-8b16-c8c6915ac684",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--581fc666-827d-579a-b22a-688c95dc584b",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--f7f9f8af-7505-56a7-9c5f-73e9c47eca95",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 filename msedgeupdate_v3.exe",
   "pattern": "[file:name = 'msedgeupdate_v3.exe']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Malware implant build",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--23be3f31-3ff9-5b0b-b787-15af6b16e434",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--6302205d-9d9d-5ee4-8921-4f4ff1f22d98",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--f7f9f8af-7505-56a7-9c5f-73e9c47eca95",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--180f9ca1-dc94-5a82-9728-521f764a8413",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 hostname api.stuseamandesilt[.]org",
   "pattern": "[domain-name:value = 'api.stuseamandesilt.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Campaign C2",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--26365551-dd02-5df4-bfc8-92ceb7147858",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--f406f002-4560-5b0f-9f6e-cee37c1b1a3f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--180f9ca1-dc94-5a82-9728-521f764a8413",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--4ebad550-e1f4-51a2-b81a-8c7ae569cf5e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 hostname cdn.stuseamandesilt[.]org",
   "pattern": "[domain-name:value = 'cdn.stuseamandesilt.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Campaign malware delivery",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--d43bcf0c-8546-534e-ad7b-32926f9b0f4d",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--892580d7-8f47-5b36-b727-65df06abcb02",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--4ebad550-e1f4-51a2-b81a-8c7ae569cf5e",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--f266a238-4df0-5faf-bedb-d39ae2e68227",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 hostname mslivetest.duckdns[.]org",
   "pattern": "[domain-name:value = 'mslivetest.duckdns.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Dynamic-DNS C2",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--744a203d-e581-58ec-9481-0e2e859ef4b6",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--2c1e24b7-fa78-5107-9261-1b5fe36f759a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--f266a238-4df0-5faf-bedb-d39ae2e68227",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--7e106b6b-e4d3-5010-baef-e6a07225c784",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 hostname pdfviewer2024.b-cdn[.]net",
   "pattern": "[domain-name:value = 'pdfviewer2024.b-cdn.net']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Malware payload domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--b2a33d3f-b624-589d-a977-e439ce4d6656",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--07835bde-eb12-5bd1-8ef7-17845e79798b",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--7e106b6b-e4d3-5010-baef-e6a07225c784",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--e6143565-b368-5fd6-9eba-92cfdf361d9b",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 hostname static.cdncounter[.]net",
   "pattern": "[domain-name:value = 'static.cdncounter.net']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Exploit/payload delivery hostname",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--7e4a757b-a87d-5cb7-844b-88edc52f85fd",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-0245",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-0245"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--d9dca863-aff3-5fd3-9be0-393d8555758f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--e6143565-b368-5fd6-9eba-92cfdf361d9b",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--fe05059a-e3ec-50eb-b4de-b0da8b9b70c8",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 hostname teams.ms365-live[.]com",
   "pattern": "[domain-name:value = 'teams.ms365-live.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Microsoft 365 Phishing",
   "labels": [
    "in-threadlinqs-after-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--132b3ad6-3074-51f1-a2fd-c3171e085c06",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2446",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2446"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--ea77bcc5-e3f5-52fe-80ab-8026084ff9f5",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--fe05059a-e3ec-50eb-b4de-b0da8b9b70c8",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--85f308ae-3c3a-5550-93c6-e0d1f4a9c938",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 hostname update.stuseamandesilt[.]org",
   "pattern": "[domain-name:value = 'update.stuseamandesilt.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Campaign subdomain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--0cf17acc-f1e5-5a3d-85ea-dc3e1f54ba7b",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--592b6844-cdfa-528b-bd45-85734d8aafd9",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--85f308ae-3c3a-5550-93c6-e0d1f4a9c938",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--8fe6d3a0-cc41-5662-a68c-633b0782b89f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 ipv4 104.145.210[.]184",
   "pattern": "[ipv4-addr:value = '104.145.210.184']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Embassy Kit device-code phishing VPS",
   "labels": [
    "in-threadlinqs-after-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--7938faa0-e73e-5ad8-b259-a0fe00b83771",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2446",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2446"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--9aa280a4-7f16-5449-992f-e47606222cc9",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--8fe6d3a0-cc41-5662-a68c-633b0782b89f",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--f655a86e-3712-5d6f-ae04-6b549eb856bd",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 ipv4 104.194.149[.]228",
   "pattern": "[ipv4-addr:value = '104.194.149.228']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Phishing VPS",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--f8e3403d-a6b9-5ac1-a331-e15e95bc4827",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--741c0bfe-324e-52fd-be01-908c31824c04",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--f655a86e-3712-5d6f-ae04-6b549eb856bd",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--ca811beb-0b67-5367-8118-943516f20c9d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 ipv4 104.194.151[.]133",
   "pattern": "[ipv4-addr:value = '104.194.151.133']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Primary C2 VPS",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--9dbb0b2e-010e-5aac-9067-39080e3aeb1a",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--bd2af9c8-1426-5144-b8ab-6ae943419aae",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--ca811beb-0b67-5367-8118-943516f20c9d",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--c62788ab-3323-56de-9e5e-f445adda9568",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 ipv4 104.194.159[.]55",
   "pattern": "[ipv4-addr:value = '104.194.159.55']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "C2 holding exfiltrated browser-data zips",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--6daade92-1e00-536e-bf74-dac53ac72c5a",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--eca59b4f-f76c-58e9-abfb-d8b50f80fd79",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--c62788ab-3323-56de-9e5e-f445adda9568",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--12b592bd-86d1-5047-b0d7-8796e973adcc",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 ipv4 144.172.114[.]192",
   "pattern": "[ipv4-addr:value = '144.172.114.192']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "C2 proxy IP / operator VPS",
   "labels": [
    "in-threadlinqs-after-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--561f4d0e-51bc-5177-92d5-1a9ecba1aaf7",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--1722a015-2d8b-57c0-bd1f-c9044a133ba5",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--12b592bd-86d1-5047-b0d7-8796e973adcc",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--e4cf11f9-b5ee-5555-88d8-a3f0ba05f4b8",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 ipv4 148.135.195[.]111",
   "pattern": "[ipv4-addr:value = '148.135.195.111']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "C2 Endpoint",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--f210b95b-1c5c-552c-8230-f96129c5ab02",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--fc7d93d5-c16b-58a2-bbeb-ab5a58d01e95",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--e4cf11f9-b5ee-5555-88d8-a3f0ba05f4b8",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--486b4888-a54f-5583-9174-492f97d3f572",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 ipv4 149.54.42[.]106",
   "pattern": "[ipv4-addr:value = '149.54.42.106']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Operator/operational infrastructure",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--69dafcf2-b90c-5041-b04f-6440ecca368d",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--884658f3-2c73-55c9-9069-bb7b2b83e871",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--486b4888-a54f-5583-9174-492f97d3f572",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--00046ae4-2708-5b35-a34f-3f650b0d8da8",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 ipv4 185.198.234[.]101",
   "pattern": "[ipv4-addr:value = '185.198.234.101']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "C2 server",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--45ea9536-47e1-54e8-9435-004fb12133d2",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--c27c2608-3046-5aa4-a5e7-3e2a65c11917",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--00046ae4-2708-5b35-a34f-3f650b0d8da8",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--12e35b1f-03c0-5346-a89b-06ce88d4c605",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 ipv4 185.198.234[.]26",
   "pattern": "[ipv4-addr:value = '185.198.234.26']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Operator/operational infrastructure",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--e56e9721-d74e-5b2d-811e-5ba4b4b9e9e0",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--5e838beb-c6ac-53f7-bd5e-547e5fd04a9c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--12e35b1f-03c0-5346-a89b-06ce88d4c605",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--6ca539d7-96a2-573c-8802-59b7d6a18deb",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 ipv4 2.26.53[.]194",
   "pattern": "[ipv4-addr:value = '2.26.53.194']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Operator/operational infrastructure",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--77243ad0-cda0-54f6-a4e0-35133959f008",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--c67aa2e3-a2e3-5ae6-acc1-aeb12fb48c6d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--6ca539d7-96a2-573c-8802-59b7d6a18deb",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--53e3d674-5291-53e2-8768-28327daa4b1a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 ipv4 213.145.86[.]112",
   "pattern": "[ipv4-addr:value = '213.145.86.112']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Operator/operational infrastructure",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--47e2236f-036d-5fe4-b715-41056d82c3f8",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1808",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1808"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1838",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1838"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1853",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1853"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1857",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1857"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2446",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2446"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--a1d0aaa3-6d7e-5a6f-8f88-255f9a8fa311",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--53e3d674-5291-53e2-8768-28327daa4b1a",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--de19d5b1-40a4-58fa-a859-e9bdcb8af890",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 ipv4 31.57.243[.]154",
   "pattern": "[ipv4-addr:value = '31.57.243.154']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Phishing host",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--7fd24e23-6703-55bb-a063-22961cf64446",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1808",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1808"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1838",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1838"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1853",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1853"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1857",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1857"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2446",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2446"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--495c6bb9-3a5d-50c0-9773-0bb33a6d0b34",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--de19d5b1-40a4-58fa-a859-e9bdcb8af890",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--2c43628a-6b64-53a6-9f93-a2d23f1c1d78",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 ipv4 38.146.28[.]132",
   "pattern": "[ipv4-addr:value = '38.146.28.132']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Actor rogue DNS resolver",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--126b023b-80fe-5a16-93a7-fd7b1e3d7299",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1808",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1808"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1838",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1838"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1853",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1853"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1857",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1857"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2446",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2446"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--3accc272-2636-5509-9712-69ab08853680",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--2c43628a-6b64-53a6-9f93-a2d23f1c1d78",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--f28da9f6-e5f5-5aa0-a168-10e8324380e7",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 ipv4 38.146.28[.]75",
   "pattern": "[ipv4-addr:value = '38.146.28.75']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Notifier C2 for the phishing console",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--c616ac79-1218-58b6-a4f7-a8f3cd35f34c",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1808",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1808"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1838",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1838"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1853",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1853"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1857",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1857"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2446",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2446"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--8896c4bb-a457-51ad-95b4-c26e0816a1b8",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--f28da9f6-e5f5-5aa0-a168-10e8324380e7",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--76c729d3-c3ab-5c6b-984e-a1edc931be4e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 sha256 918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593",
   "pattern": "[file:hashes.'SHA-256' = '918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Windows Backdoor",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--55d759ad-ef5d-5f5f-a55a-e5d1a15b2243",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1808",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1808"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1838",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1838"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1853",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1853"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1857",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1857"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2446",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2446"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--86a4abc1-e9b6-5fb2-ab7d-73a9fe7fd23a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--76c729d3-c3ab-5c6b-984e-a1edc931be4e",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--f00ee9f7-8c5d-5195-9e2b-a507f6863d1b",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-20006 sha256 be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c",
   "pattern": "[file:hashes.'SHA-256' = 'be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Malware hash",
   "labels": [
    "in-threadlinqs-before-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-20006-russian-espionage",
     "external_id": "indicator--dec28c63-9893-5998-8e2c-bdcfaedcf774",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1808",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1808"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1838",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1838"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1853",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1853"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1857",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1857"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2167",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2167"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2446",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2446"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--dbed09dd-fb08-5728-8a66-445169331fc1",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--f00ee9f7-8c5d-5195-9e2b-a507f6863d1b",
   "target_ref": "intrusion-set--48ffb1a0-995b-50b4-8263-94a3a64622ee"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--acfc4a23-ad63-5d4b-adfb-def851df12b7",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 account https[:]//t[.]me/Soraki_Bot",
   "pattern": "[url:value = 'https://t.me/Soraki_Bot']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Criminal storefront account on Telegram",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--6eab3d56-8fa1-5653-8df0-d67e5fc14249",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--aa0707a7-36e9-5587-a65d-37e4688dbd79",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--acfc4a23-ad63-5d4b-adfb-def851df12b7",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--634eb501-8cfc-5523-b4ea-179affd66095",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 domain ari-chain[.]com",
   "pattern": "[domain-name:value = 'ari-chain.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Crypto Themed Phishing Domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--62c81f9b-2a77-52e0-b109-d6ae8a2e3519",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--195b5680-cdb6-5805-8c84-c195b7b37696",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--634eb501-8cfc-5523-b4ea-179affd66095",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--43296e2a-ab44-5e6f-bb17-9a28d59e84e4",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 domain arichain[.]network",
   "pattern": "[domain-name:value = 'arichain.network']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Crypto Themed Phishing Domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--31508b5a-3543-5cfc-acff-bb3969f85c90",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--cbdfbcbd-2df7-54e9-a965-bac687531b3f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--43296e2a-ab44-5e6f-bb17-9a28d59e84e4",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--1e854539-c3e9-5c65-8672-86b20891e5a9",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 domain bitmart-mystery[.]com",
   "pattern": "[domain-name:value = 'bitmart-mystery.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Crypto Themed Phishing Domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--0ef40b4e-799e-550f-9a2e-a7c2c8d226f3",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--adb46812-7114-5206-a0f6-f5ba920e9b0a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--1e854539-c3e9-5c65-8672-86b20891e5a9",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--01d1e9fa-5b4c-5114-b646-0fa1c7b6a6a2",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 domain defi-claim[.]xyz",
   "pattern": "[domain-name:value = 'defi-claim.xyz']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Phishing Domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--6f4e5a4f-b6cd-543b-8879-d42298e552dd",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--7f886255-4c7e-5197-8915-900175f48b78",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--01d1e9fa-5b4c-5114-b646-0fa1c7b6a6a2",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--9f3c8bc3-4920-506b-9d81-d681bedc9356",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 domain emailsecure[.]email",
   "pattern": "[domain-name:value = 'emailsecure.email']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Actor email domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--d7053521-43c1-5d47-a6fe-0d715a882db1",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--c7813f1c-221d-513c-8db4-c4721f5fb9df",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--9f3c8bc3-4920-506b-9d81-d681bedc9356",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--648b0964-0f4e-5cce-9fd6-0627844eba07",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 domain mozilla[.]ws",
   "pattern": "[domain-name:value = 'mozilla.ws']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Mozilla brand-impersonation phishing",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--082f1d0a-c8f1-5e06-99c9-98ba0a728cf3",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--cb1eed09-2c0b-5905-82ff-bf17661b99c6",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--648b0964-0f4e-5cce-9fd6-0627844eba07",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--981941c8-1774-5f8e-abfb-556720f96fc3",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 domain on-pssword[.]com",
   "pattern": "[domain-name:value = 'on-pssword.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "1Password typosquat phishing",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--b03d50b4-17c6-5afa-af7e-1054c3180e88",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--65205977-3aa1-543a-b00c-d66345015f5c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--981941c8-1774-5f8e-abfb-556720f96fc3",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--f45fb989-88c6-5125-8bcb-42bc54f92f12",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 domain policenationale[.]cc",
   "pattern": "[domain-name:value = 'policenationale.cc']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "A domain name impersonating the French national police (though we believe this served as branding for the criminal storefront rather than as a phishing lure)",
   "labels": [
    "in-threadlinqs-after-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--12a4503e-2910-5489-95d7-a524cd0b6c95",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--573cd813-0389-5e19-a0a8-ff55b94ef796",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--f45fb989-88c6-5125-8bcb-42bc54f92f12",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--2d5756ff-8f1a-5f11-8fcf-987e02129c4f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 domain service-infos[.]info",
   "pattern": "[domain-name:value = 'service-infos.info']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Phishing email domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--13ab5e9d-c488-520b-bd2e-b71ff0f2734b",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--17fba1fe-4c57-5cf6-bda2-6f1e5b6d3bdd",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--2d5756ff-8f1a-5f11-8fcf-987e02129c4f",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--98f722b7-4c4e-55a5-a8ef-fb7b95553f8d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 domain signin-1psswoord[.]com",
   "pattern": "[domain-name:value = 'signin-1psswoord.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "1Password phishing",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--4765a239-1b23-5194-a208-5d05757a4fc1",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--53e8074d-691d-5fe6-881b-ba9a152a7c3d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--98f722b7-4c4e-55a5-a8ef-fb7b95553f8d",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--c22f1106-56ef-5f90-9be1-9fbbf395f81a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 domain soraki[.]cc",
   "pattern": "[domain-name:value = 'soraki.cc']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "AutoShop carding storefront",
   "labels": [
    "in-threadlinqs-after-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--7b0f06d3-e9c6-5ddb-8c1f-5e58688b3358",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--09b17464-bab0-51ea-98f1-8af7559e73d0",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--c22f1106-56ef-5f90-9be1-9fbbf395f81a",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--d0d7de2b-f512-5a4a-a775-01398a4e5f67",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 domain soraki[.]work",
   "pattern": "[domain-name:value = 'soraki.work']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Actor infrastructure",
   "labels": [
    "in-threadlinqs-after-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--4f5b751b-d270-52ca-a599-fe3c990eefe3",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--8e3b6494-1ffb-58af-9e46-ea5be341c51a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--d0d7de2b-f512-5a4a-a775-01398a4e5f67",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--dc80efaa-eed5-58ef-8faf-788bdd1aedfa",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 hostname autoshop.policenationale[.]cc",
   "pattern": "[domain-name:value = 'autoshop.policenationale.cc']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Served as the web frontend for the actor's carding autoshop",
   "labels": [
    "in-threadlinqs-after-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--25ddd380-9190-5cae-874f-7e2940f519e5",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--5be8393f-3e06-544b-906b-045ccab05aaf",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--dc80efaa-eed5-58ef-8faf-788bdd1aedfa",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--0ee0ee14-2146-5e3f-805a-294ffe35ae69",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 hostname esvfecawvjmchjslqyemho2fiduc59wzn.oast[.]fun",
   "pattern": "[domain-name:value = 'esvfecawvjmchjslqyemho2fiduc59wzn.oast.fun']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Callback domain to confirm SSRF and out of band code execution",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--f6f86860-a392-5d07-87fc-da39989424a1",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--57cafd50-239b-5da3-bfaa-dcb969d63c03",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--0ee0ee14-2146-5e3f-805a-294ffe35ae69",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--1b6874b7-be93-5166-ac12-5c6a6790fb38",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 hostname soraki-proxy.20245aad98d27b1b1a2f0f103e1d7ee0.workers[.]dev",
   "pattern": "[domain-name:value = 'soraki-proxy.20245aad98d27b1b1a2f0f103e1d7ee0.workers.dev']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Cloudflare Workers proxy",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--17e82f16-3f5d-59f6-80ec-ee8f7de32bff",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--c15cba76-d3f8-5f18-99ca-9ce5b5a7d18a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--1b6874b7-be93-5166-ac12-5c6a6790fb38",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--dbbc0a86-200c-583d-b698-5ef9a398cf4d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 hostname updatebeacon.duckdns[.]org",
   "pattern": "[domain-name:value = 'updatebeacon.duckdns.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "C2 callback domain",
   "labels": [
    "in-threadlinqs-after-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--db1b96a6-9702-5bbf-bbdd-e61bd4b5adc5",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--305e43b4-b118-5ca9-9e36-af3515fb891e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--dbbc0a86-200c-583d-b698-5ef9a398cf4d",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--f5122104-71a2-5e1a-8d0d-565b0c1e893c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 ipv4 104.193.135[.]207",
   "pattern": "[ipv4-addr:value = '104.193.135.207']",
   "pattern_type": "stix",
   "valid_from": "2026-04-05T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--28f84a81-daca-53f3-8cd1-7fec163702b2",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--0d2a5e61-db0d-55fe-a8d0-240f0586e570",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--f5122104-71a2-5e1a-8d0d-565b0c1e893c",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--ca275e16-37bb-5254-994b-94e190e902de",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 ipv4 104.36.50[.]54",
   "pattern": "[ipv4-addr:value = '104.36.50.54']",
   "pattern_type": "stix",
   "valid_from": "2026-04-24T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--964d3c2a-d5f4-5185-8ecb-dc3a04661603",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--281b5a30-32db-5fcb-8ac3-bd0ae7cdb42f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--ca275e16-37bb-5254-994b-94e190e902de",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--1317af69-b9d7-5801-8a98-86ec47af4867",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 ipv4 162.128.129[.]106",
   "pattern": "[ipv4-addr:value = '162.128.129.106']",
   "pattern_type": "stix",
   "valid_from": "2026-02-20T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "in-threadlinqs-after-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--663fbb19-8c82-554d-99d7-1a9c5fe2f6f1",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--cea87071-48c1-587e-a5c5-c844a4c99fe8",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--1317af69-b9d7-5801-8a98-86ec47af4867",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--97906706-d97f-5c7d-89bd-b3ca6a05affd",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 ipv4 176.177.12[.]62",
   "pattern": "[ipv4-addr:value = '176.177.12.62']",
   "pattern_type": "stix",
   "valid_from": "2026-04-19T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--e12d0d77-e9d1-53f3-a30d-5eacd1007916",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--8b5bddff-aede-5b7e-a970-22314c4cc254",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--97906706-d97f-5c7d-89bd-b3ca6a05affd",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--b306893c-d40d-5c3d-9495-8b337668b32a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 ipv4 185.65.134[.]199",
   "pattern": "[ipv4-addr:value = '185.65.134.199']",
   "pattern_type": "stix",
   "valid_from": "2026-04-19T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--2c31e056-9d29-5a08-8494-ff5f4b5530b7",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--d5b56fcb-80bc-5ece-a33c-9ef2df35dd00",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--b306893c-d40d-5c3d-9495-8b337668b32a",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--d82ae755-a374-597a-b2b6-1a07980f21b4",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 ipv4 185.65.134[.]246",
   "pattern": "[ipv4-addr:value = '185.65.134.246']",
   "pattern_type": "stix",
   "valid_from": "2026-04-19T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "in-threadlinqs-after-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--13b782f8-9768-5e4d-af24-d7eff96e9bc3",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--d55a890a-273c-58cc-8dd3-d88d84bff2fb",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--d82ae755-a374-597a-b2b6-1a07980f21b4",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--402cfb71-a693-562a-91d5-82812fde7340",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 ipv4 193.32.249[.]161",
   "pattern": "[ipv4-addr:value = '193.32.249.161']",
   "pattern_type": "stix",
   "valid_from": "2026-03-21T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "in-threadlinqs-after-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--e60ffa6e-09ac-50be-8839-1dc6b6d21293",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--875894eb-fad9-5a79-9806-b8a131cd8ae3",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--402cfb71-a693-562a-91d5-82812fde7340",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--45ed314c-e2ae-546d-8e41-bec7f505ba04",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 ipv4 193.32.249[.]164",
   "pattern": "[ipv4-addr:value = '193.32.249.164']",
   "pattern_type": "stix",
   "valid_from": "2026-04-18T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--68df1b97-7013-5ccc-9e68-229e44c12668",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--ad8ad392-3cee-5482-ab84-c95c90f5da04",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--45ed314c-e2ae-546d-8e41-bec7f505ba04",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--89fc5401-a525-5bfa-89a2-ccbf1c891e30",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 ipv4 193.32.249[.]170",
   "pattern": "[ipv4-addr:value = '193.32.249.170']",
   "pattern_type": "stix",
   "valid_from": "2026-03-20T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--7f4d109f-6965-53be-abdf-6cff7598118f",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--da4b266b-258a-5208-926a-a1299ec62447",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--89fc5401-a525-5bfa-89a2-ccbf1c891e30",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--b1888b3d-1d92-5592-89ac-53ee4843d940",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 ipv4 195.178.110[.]131",
   "pattern": "[ipv4-addr:value = '195.178.110.131']",
   "pattern_type": "stix",
   "valid_from": "2026-03-12T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "VPS Host",
   "labels": [
    "in-threadlinqs-after-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--e0421cd9-28ce-55ed-8621-32dc014d0ec8",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--874ea8e1-a9a9-59b7-8dee-ceff3ea1a215",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--b1888b3d-1d92-5592-89ac-53ee4843d940",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--1fe5cc8a-2822-5960-b843-5c4921d7fa83",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 ipv4 45.148.10[.]242",
   "pattern": "[ipv4-addr:value = '45.148.10.242']",
   "pattern_type": "stix",
   "valid_from": "2026-04-06T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "in-threadlinqs-after-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--495061d9-08b4-5355-88f8-8a21a26c689c",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--5de8b536-2c04-536a-a710-20c02f8b2a4e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--1fe5cc8a-2822-5960-b843-5c4921d7fa83",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--df068e44-5dac-5477-ba95-03ba7efe9b5e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 ipv4 91.171.138[.]169",
   "pattern": "[ipv4-addr:value = '91.171.138.169']",
   "pattern_type": "stix",
   "valid_from": "2026-04-19T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--c4fa6efa-9169-524d-9bb9-f22bcac83fa4",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--72ae8c96-121a-5ea2-838e-488156e093e9",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--df068e44-5dac-5477-ba95-03ba7efe9b5e",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--6820d3b4-c1f9-5b38-81f8-3b62544009f4",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 ipv4 92.118.39[.]3",
   "pattern": "[ipv4-addr:value = '92.118.39.3']",
   "pattern_type": "stix",
   "valid_from": "2026-04-10T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--59e45a42-1acb-50a7-abcc-da8f0241129a",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--b3b943a6-8beb-5941-946a-5ac2a356be62",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--6820d3b4-c1f9-5b38-81f8-3b62544009f4",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--b9699076-6f0a-5cd3-a53f-749a490aac10",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 ipv6 2a01:e0a:2e2:aa40:b15d:5d28:6f4a[:]8d53",
   "pattern": "[ipv6-addr:value = '2a01:e0a:2e2:aa40:b15d:5d28:6f4a:8d53']",
   "pattern_type": "stix",
   "valid_from": "2026-04-20T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--46880f5c-491e-5857-bf56-a0579083bfc8",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--1bcf8a05-6871-5d40-ae93-58ca3fbcaa37",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--b9699076-6f0a-5cd3-a53f-749a490aac10",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--19396641-fc92-5eda-9cab-c34025b3b522",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 ipv6 2a04:cec0:1185:34f2:a150:7081:caed[:]448e",
   "pattern": "[ipv6-addr:value = '2a04:cec0:1185:34f2:a150:7081:caed:448e']",
   "pattern_type": "stix",
   "valid_from": "2026-04-06T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--7d2b93fe-b5a5-5a53-9e70-af67366f6b39",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--a2a36929-4d4d-5d06-b686-732a133089e7",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--19396641-fc92-5eda-9cab-c34025b3b522",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--4cbcc941-e7a9-53c4-b2ca-bb87a7847250",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 telegram_bot_id 8628746407",
   "pattern": "[user-account:user_id = '8628746407' AND user-account:account_type = 'telegram']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Telegram bot delivering AWS SES credential-validation results directly to the operator's user account",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--4453187b-c2b4-5103-92cb-8477c332d392",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--9d0405a7-7324-5e42-8b08-5d1c43a97ca7",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--4cbcc941-e7a9-53c4-b2ca-bb87a7847250",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--6af407af-058b-50b6-bb7d-e96b050f0812",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 telegram_bot_id 8632748474",
   "pattern": "[user-account:user_id = '8632748474' AND user-account:account_type = 'telegram']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Telegram bot that posted stolen data.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--a024544b-b35a-54cd-835f-16d87794a61c",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--981a87f5-6faa-50df-be36-ec2be7cb7c13",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--6af407af-058b-50b6-bb7d-e96b050f0812",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--3d476e37-7393-5660-9af3-fe965e9089c8",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 telegram_bot_id 8664033117",
   "pattern": "[user-account:user_id = '8664033117' AND user-account:account_type = 'telegram']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Telegram bot that posted stolen data.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--ce1c5d35-0d6f-5bc2-8deb-41888f1fbb7c",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--9d1b5f74-7528-5d58-8a9b-07b2c35a14d0",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--3d476e37-7393-5660-9af3-fe965e9089c8",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--5d387767-3405-579c-b25b-7afeb4b52943",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 telegram_bot_id 8709258476",
   "pattern": "[user-account:user_id = '8709258476' AND user-account:account_type = 'telegram']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Telegram bot delivering AWS SNS SMS-abuse test results directly to the operator's user account",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--52158950-33ac-562e-9154-dac7f1b85826",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--a777a535-a7dc-59bd-b9ee-b04bef4cdccc",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--5d387767-3405-579c-b25b-7afeb4b52943",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--bda8b40a-a426-5aea-b91b-f8920b909aac",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 telegram_chat_id -1003311614569",
   "pattern": "[user-account:user_id = '-1003311614569' AND user-account:account_type = 'telegram']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Telegram group 'ChatMignon' that received stolen data.",
   "labels": [
    "in-threadlinqs-after-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--f94fb93a-6dfe-56b1-a180-f33bc687f60d",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--bc8e4414-9c51-50b7-b301-9d21816b5058",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--bda8b40a-a426-5aea-b91b-f8920b909aac",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--2236c6e6-42cb-5c67-a6b3-d611666cc16f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 telegram_chat_id -1003893854338",
   "pattern": "[user-account:user_id = '-1003893854338' AND user-account:account_type = 'telegram']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Telegram group 'ClintonHog' that received stolen data.",
   "labels": [
    "in-threadlinqs-after-report"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--9aad2a78-33b9-5559-b8e0-25c62927e9d3",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2466",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2466"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--7bc22155-8732-5f9b-85f5-1f51cea2c939",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--2236c6e6-42cb-5c67-a6b3-d611666cc16f",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--80774f95-7e7b-5a76-88e1-cb973e71a973",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 telegram_user_id 8179098353",
   "pattern": "[user-account:user_id = '8179098353' AND user-account:account_type = 'telegram']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Operator's Telegram account",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--a81233cd-1501-58a9-afc6-33252f19ca74",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--92aae03e-88d1-5d94-941e-dfc0a40f7f47",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--80774f95-7e7b-5a76-88e1-cb973e71a973",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--2e35aa0b-2a1b-51a3-b5f6-5a7f5c6a15bd",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50014 url https[:]//s3.eu-central-1.s4.mega[.]io/fuckyoubasil/",
   "pattern": "[url:value = 'https://s3.eu-central-1.s4.mega.io/fuckyoubasil/']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Exfiltration URL",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50014-shinyhunters-smash-and-grab-opportunists",
     "external_id": "indicator--22dabbc3-390c-5391-81b8-c0a8524ca2fa",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--62fcf41a-3ca5-5fb5-a65e-4cfb62bac118",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--2e35aa0b-2a1b-51a3-b5f6-5a7f5c6a15bd",
   "target_ref": "intrusion-set--c23976ec-ee12-52e9-ad7e-d64cbfdc3beb"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--de790661-6e6d-556f-9b9d-62969ee74c6b",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50020 ipv4 141.133.125[.]208",
   "pattern": "[ipv4-addr:value = '141.133.125.208']",
   "pattern_type": "stix",
   "valid_from": "2026-05-21T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50020-from-hotel-bookings-to-the-ai-supply-chain",
     "external_id": "indicator--b0421eab-80ea-5555-8a3f-6a257045a93a",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--003b143e-74dd-5cd4-a476-6d86b8757526",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--de790661-6e6d-556f-9b9d-62969ee74c6b",
   "target_ref": "intrusion-set--3b9df88d-fa10-5774-8893-6452682d9974"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--a0412729-ea3c-5d52-9fcc-4baa6ded57dc",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50020 ipv4 146.103.101[.]253",
   "pattern": "[ipv4-addr:value = '146.103.101.253']",
   "pattern_type": "stix",
   "valid_from": "2026-05-21T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50020-from-hotel-bookings-to-the-ai-supply-chain",
     "external_id": "indicator--1fbe82ae-58e2-56dd-8433-878fbf2820c3",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--56158db0-d5eb-5d78-add7-5c09ea275288",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--a0412729-ea3c-5d52-9fcc-4baa6ded57dc",
   "target_ref": "intrusion-set--3b9df88d-fa10-5774-8893-6452682d9974"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--edf507f3-2035-51cd-99f8-80111c4d73e3",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50020 ipv4 146.103.97[.]169",
   "pattern": "[ipv4-addr:value = '146.103.97.169']",
   "pattern_type": "stix",
   "valid_from": "2026-05-21T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50020-from-hotel-bookings-to-the-ai-supply-chain",
     "external_id": "indicator--cb589a57-7c6f-59a4-8545-55ecd9031634",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--b41009a0-f1a9-51ab-ba85-5d562c5c6fa1",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--edf507f3-2035-51cd-99f8-80111c4d73e3",
   "target_ref": "intrusion-set--3b9df88d-fa10-5774-8893-6452682d9974"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--3e4f1c4a-528c-5c3e-b8f3-ab48710b3df9",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50020 ipv4 167.250.111[.]136",
   "pattern": "[ipv4-addr:value = '167.250.111.136']",
   "pattern_type": "stix",
   "valid_from": "2026-05-23T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50020-from-hotel-bookings-to-the-ai-supply-chain",
     "external_id": "indicator--34fbb45d-7c45-52ff-a336-69a00a5cf2ab",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--2d2cf8f5-1192-573a-917a-55d723b642f9",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--3e4f1c4a-528c-5c3e-b8f3-ab48710b3df9",
   "target_ref": "intrusion-set--3b9df88d-fa10-5774-8893-6452682d9974"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--a7424aee-d52a-5450-8fd0-351483ceaa35",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50020 ipv4 178.16.54[.]141",
   "pattern": "[ipv4-addr:value = '178.16.54.141']",
   "pattern_type": "stix",
   "valid_from": "2026-05-21T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "related-only"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50020-from-hotel-bookings-to-the-ai-supply-chain",
     "external_id": "indicator--ba3f24a8-3d5b-53cf-8c40-d335d4040a35",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--b12b6c34-7dd4-58b3-9d6c-830b8c1ca72f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--a7424aee-d52a-5450-8fd0-351483ceaa35",
   "target_ref": "intrusion-set--3b9df88d-fa10-5774-8893-6452682d9974"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--1ea799a9-4704-524b-a3a7-22fd70b553fd",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50020 ipv4 194.163.183[.]216",
   "pattern": "[ipv4-addr:value = '194.163.183.216']",
   "pattern_type": "stix",
   "valid_from": "2026-05-23T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50020-from-hotel-bookings-to-the-ai-supply-chain",
     "external_id": "indicator--2bc8f6a5-bf44-573e-a2b5-51afd9b0c128",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--42707754-7706-5956-b333-a944a4c1a48f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--1ea799a9-4704-524b-a3a7-22fd70b553fd",
   "target_ref": "intrusion-set--3b9df88d-fa10-5774-8893-6452682d9974"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--e5e98bf4-a86b-5dd8-8e2e-782a9f35bb4d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50020 ipv4 202.66.167[.]230",
   "pattern": "[ipv4-addr:value = '202.66.167.230']",
   "pattern_type": "stix",
   "valid_from": "2026-05-21T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50020-from-hotel-bookings-to-the-ai-supply-chain",
     "external_id": "indicator--86072bb7-2b10-5443-a6e6-6863ef0f9995",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--8d5f44ee-c803-5a11-a369-823d4fa359e6",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--e5e98bf4-a86b-5dd8-8e2e-782a9f35bb4d",
   "target_ref": "intrusion-set--3b9df88d-fa10-5774-8893-6452682d9974"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--5c343c12-9e47-5f51-be91-ade734e6da2d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50020 ipv4 37.27.103[.]22",
   "pattern": "[ipv4-addr:value = '37.27.103.22']",
   "pattern_type": "stix",
   "valid_from": "2026-05-26T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Attacker egress IP",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50020-from-hotel-bookings-to-the-ai-supply-chain",
     "external_id": "indicator--fb155a3f-5ded-58f8-bd8a-c782faee5fe4",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--1bb126b2-4787-5db6-8e4c-fe68de509607",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--5c343c12-9e47-5f51-be91-ade734e6da2d",
   "target_ref": "intrusion-set--3b9df88d-fa10-5774-8893-6452682d9974"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--9e508c4f-4395-5d0a-b79c-05067f9ac5b0",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50021 domain aws-us-east-3[.]com",
   "pattern": "[domain-name:value = 'aws-us-east-3.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "AWS lookalike domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50021-indicators-of-compromise",
     "external_id": "indicator--b9251a41-7b65-5d0d-9fcc-adaa15b2725b",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--ad9085da-8c06-5266-a5b7-ee489b166145",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--9e508c4f-4395-5d0a-b79c-05067f9ac5b0",
   "target_ref": "intrusion-set--6fb072fb-5710-518f-ab93-f696d10f5eae"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--ee316d90-6512-53c7-aa0c-21d1b08303aa",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50021 domain awstore[.]cloud",
   "pattern": "[domain-name:value = 'awstore.cloud']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake Claude API reseller storefront",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50021-indicators-of-compromise",
     "external_id": "indicator--bcfde13b-9053-5d95-911b-810c2f1c2580",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--fce751e6-9038-5496-b010-593653f83e85",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--ee316d90-6512-53c7-aa0c-21d1b08303aa",
   "target_ref": "intrusion-set--6fb072fb-5710-518f-ab93-f696d10f5eae"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--8aaf064c-db12-5f57-a841-75d4e840fe01",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50021 domain holdboost[.]store",
   "pattern": "[domain-name:value = 'holdboost.store']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Malware platform domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50021-indicators-of-compromise",
     "external_id": "indicator--5d31f4b6-42ed-52a4-afca-d173c6dcb22d",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--23a2414a-7eb8-5a74-9aff-ac03c486b513",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--8aaf064c-db12-5f57-a841-75d4e840fe01",
   "target_ref": "intrusion-set--6fb072fb-5710-518f-ab93-f696d10f5eae"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--de95d257-802f-5008-ac2e-fa5f28206d43",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50021 domain kiro[.]cheap",
   "pattern": "[domain-name:value = 'kiro.cheap']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake Kiro API reseller storefront",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50021-indicators-of-compromise",
     "external_id": "indicator--f8e7257e-4ca9-51e0-b9b8-e549076dbf79",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--8a930bab-1193-59ab-add2-1884508d8359",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--de95d257-802f-5008-ac2e-fa5f28206d43",
   "target_ref": "intrusion-set--6fb072fb-5710-518f-ab93-f696d10f5eae"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--42c1a81d-790f-5429-acbb-ca73c7889e9a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50021 domain sys-tools[.]cfd",
   "pattern": "[domain-name:value = 'sys-tools.cfd']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Malware C2",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50021-indicators-of-compromise",
     "external_id": "indicator--b836566e-b728-5fab-a5b6-6b2bd019b80c",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--599cee5f-1565-52e3-9cde-dbe5ba225878",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--42c1a81d-790f-5429-acbb-ca73c7889e9a",
   "target_ref": "intrusion-set--6fb072fb-5710-518f-ab93-f696d10f5eae"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--723aa953-0ee4-5405-ad4d-b40e39cb6b93",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50021 hostname iymkjuzymkapovrntoxy.supabase[.]co",
   "pattern": "[domain-name:value = 'iymkjuzymkapovrntoxy.supabase.co']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Malware Supabase backend",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50021-indicators-of-compromise",
     "external_id": "indicator--1fab62ad-e544-5a84-9ffc-69b971749bcb",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--b7a13c30-db7f-5406-9663-e0da06a040be",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--723aa953-0ee4-5405-ad4d-b40e39cb6b93",
   "target_ref": "intrusion-set--6fb072fb-5710-518f-ab93-f696d10f5eae"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--94723d71-56b1-5d40-a254-9455f77d0d86",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 domain fafwatch[.]xyz",
   "pattern": "[domain-name:value = 'fafwatch.xyz']",
   "pattern_type": "stix",
   "valid_from": "2026-04T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Actor-registered doxing adjacent domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--6df83c0b-ebc7-5d1b-93fd-e013388cbb2d",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--2e06dcc0-908d-5922-8fc6-be94ed6717a6",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--94723d71-56b1-5d40-a254-9455f77d0d86",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--c3d9ddeb-8401-514e-b34b-a0b10925a746",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 domain prod-artfkt[.]com",
   "pattern": "[domain-name:value = 'prod-artfkt.com']",
   "pattern_type": "stix",
   "valid_from": "2026-04T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Actor-registered operational domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--83c3b5f3-7c89-5d15-ae23-d8ee15e97db7",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--715935b9-dc5b-57ec-9ba0-e12a7f87ec33",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--c3d9ddeb-8401-514e-b34b-a0b10925a746",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--2a490852-0f1f-51bd-ab7a-2d2bc718716c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 hostname frntrs-analytics-863060591218.europe-west1.run[.]app",
   "pattern": "[domain-name:value = 'frntrs-analytics-863060591218.europe-west1.run.app']",
   "pattern_type": "stix",
   "valid_from": "2026-05-13T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Cloud Run origin behind C2 domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--9798cd34-2adc-5e7e-8b77-413482663c58",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--b6dcaf77-448e-5c51-aae3-d75c9cea3085",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--2a490852-0f1f-51bd-ab7a-2d2bc718716c",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--cd5f123e-0448-5d90-9252-623d49f00883",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 hostname frntrs-analytics.dedyn[.]io",
   "pattern": "[domain-name:value = 'frntrs-analytics.dedyn.io']",
   "pattern_type": "stix",
   "valid_from": "2026-05-13T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "BeEF browser-C2 hostname (deSEC dynamic DNS, actor-held API token)",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--10278b9d-3b1f-5a8d-8cb0-1562b260eff8",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--f027b39b-3b7e-5d0a-ae79-11c57600b5cb",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--cd5f123e-0448-5d90-9252-623d49f00883",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--1c6d598d-4bd5-5d6c-b6e1-84953482ccd7",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv4 103.124.165[.]199",
   "pattern": "[ipv4-addr:value = '103.124.165.199']",
   "pattern_type": "stix",
   "valid_from": "2026-03-25T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Commercial VPN/DC attack exits (Mullvad/M247/31173/Datacamp; AL/AT/AR/CH/BG/SK/DE) - primary-key ops window",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--1f69d987-8cb0-503f-98aa-5f9d1e7463a7",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--06c17fc0-d1b3-55b6-b43c-53b4eade77a4",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--1c6d598d-4bd5-5d6c-b6e1-84953482ccd7",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--adad3897-1624-5bf3-8ad6-3cea5f6a3ce2",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv4 103.141.60[.]144",
   "pattern": "[ipv4-addr:value = '103.141.60.144']",
   "pattern_type": "stix",
   "valid_from": "2026-03-25T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Commercial VPN/DC attack exits (Mullvad/M247/31173/Datacamp; AL/AT/AR/CH/BG/SK/DE) - primary-key ops window",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--17015242-edf8-5c6f-b358-45e5094054b3",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--06a0f12d-6b5b-5cb9-a631-f6b995846876",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--adad3897-1624-5bf3-8ad6-3cea5f6a3ce2",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--6e84ea5e-5510-5cc8-9245-cb4c7031fb0b",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv4 103.216.220[.]19",
   "pattern": "[ipv4-addr:value = '103.216.220.19']",
   "pattern_type": "stix",
   "valid_from": "2026-03-25T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Commercial VPN/DC attack exits (Mullvad/M247/31173/Datacamp; AL/AT/AR/CH/BG/SK/DE) - primary-key ops window",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--cedd116a-4afc-5cee-af5e-8bb3c7185fa2",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--a867b048-3996-5fec-9ac7-5f484fead7ac",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--6e84ea5e-5510-5cc8-9245-cb4c7031fb0b",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--e094b9ef-4ede-55b3-9227-6f64d647be05",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv4 136.144.242[.]56",
   "pattern": "[ipv4-addr:value = '136.144.242.56']",
   "pattern_type": "stix",
   "valid_from": "2026-05-17T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Staging & scan box used on EU political organizations",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--4ff9ea37-6095-57e2-90ea-74710320870a",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--83076c17-b304-5a1d-92f8-3793cdd7560d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--e094b9ef-4ede-55b3-9227-6f64d647be05",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--a5304ce6-c44d-51f4-8fe2-6140de5da917",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv4 138.199.6[.]208",
   "pattern": "[ipv4-addr:value = '138.199.6.208']",
   "pattern_type": "stix",
   "valid_from": "2026-03-25T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Commercial VPN/DC attack exits (Mullvad/M247/31173/Datacamp; AL/AT/AR/CH/BG/SK/DE) - primary-key ops window",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--1ceec36c-70da-59b8-961e-b44c538b69ae",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--105460e7-20a7-5c53-8f05-9a714487bb94",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--a5304ce6-c44d-51f4-8fe2-6140de5da917",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--1d629049-c41e-54d8-93d7-c1facd43d4db",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv4 138.199.60[.]29",
   "pattern": "[ipv4-addr:value = '138.199.60.29']",
   "pattern_type": "stix",
   "valid_from": "2026-03-25T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Commercial VPN/DC attack exits (Mullvad/M247/31173/Datacamp; AL/AT/AR/CH/BG/SK/DE) - primary-key ops window",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--d5adcf3d-c819-5ec3-81f1-23b878e711ce",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--4e21f727-e3ee-5570-90cc-783eb568bdd7",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--1d629049-c41e-54d8-93d7-c1facd43d4db",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--e870edd8-fed3-5e65-b05b-bf8ab8c09e2f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv4 139.59.2[.]243",
   "pattern": "[ipv4-addr:value = '139.59.2.243']",
   "pattern_type": "stix",
   "valid_from": "2026-02-06T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Key-validation box (DigitalOcean)",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--f55f0ae6-3f82-537f-887e-3780c25cad31",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--9e8e2207-1323-5451-b8c7-cc2fe966e948",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--e870edd8-fed3-5e65-b05b-bf8ab8c09e2f",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--b5a8fe65-71ff-5d13-9bf2-3944d3e3e7f6",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv4 146.70.116[.]131",
   "pattern": "[ipv4-addr:value = '146.70.116.131']",
   "pattern_type": "stix",
   "valid_from": "2026-03-25T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Commercial VPN/DC attack exits (Mullvad/M247/31173/Datacamp; AL/AT/AR/CH/BG/SK/DE) - primary-key ops window",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--fbc8440a-b4cf-50f0-b255-687b1780799d",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--8c45625e-2c48-5adf-8b22-f410e1dd2f21",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--b5a8fe65-71ff-5d13-9bf2-3944d3e3e7f6",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--313b11d4-8990-5343-a405-b6184b677b05",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv4 149.22.83[.]6",
   "pattern": "[ipv4-addr:value = '149.22.83.6']",
   "pattern_type": "stix",
   "valid_from": "2026-03-25T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Commercial VPN/DC attack exits (Mullvad/M247/31173/Datacamp; AL/AT/AR/CH/BG/SK/DE) - primary-key ops window",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--af19ee83-6672-5845-8336-c37f4af35443",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--007a4652-34ab-5a3f-8930-1f2db9fe80d8",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--313b11d4-8990-5343-a405-b6184b677b05",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--cb60843d-b96e-5758-9ace-9e09108ae932",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv4 158.173.46[.]118",
   "pattern": "[ipv4-addr:value = '158.173.46.118']",
   "pattern_type": "stix",
   "valid_from": "2026-03-25T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Commercial VPN/DC attack exits (Mullvad/M247/31173/Datacamp; AL/AT/AR/CH/BG/SK/DE) - primary-key ops window",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--c2459785-fc67-553c-9ca8-7379c727ddfb",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--8e22785a-bd34-5357-931d-755ea52845eb",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--cb60843d-b96e-5758-9ace-9e09108ae932",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--9a084846-0e59-553a-9747-41ff223a0604",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv4 163.172.157[.]53",
   "pattern": "[ipv4-addr:value = '163.172.157.53']",
   "pattern_type": "stix",
   "valid_from": "2026-06-26T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Persistent dedicated server, Scaleway FR used in late-phase operations",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--de62541b-3d08-5560-861f-5b8df5383e18",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--0b773a5d-f761-5afc-84b1-30f70a03fd16",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--9a084846-0e59-553a-9747-41ff223a0604",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--ac61e426-d311-5cac-898d-64f92f315647",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv4 34.156.199[.]132",
   "pattern": "[ipv4-addr:value = '34.156.199.132']",
   "pattern_type": "stix",
   "valid_from": "2026-04T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Exfiltration endpoints in hijacked GCP projects",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--a11052b9-c265-5b7a-b140-e834447bb30b",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--e2ddee59-a556-59f0-a95c-b7266d5aeaa6",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--ac61e426-d311-5cac-898d-64f92f315647",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--b08b9ed1-4a1c-5ee2-bbc3-e77ac1ff126a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv4 34.156.95[.]176",
   "pattern": "[ipv4-addr:value = '34.156.95.176']",
   "pattern_type": "stix",
   "valid_from": "2026-04T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Exfiltration endpoints in hijacked GCP projects",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--30930c59-e5ac-5ef3-b05d-e9a7a65727ae",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--2e118a3f-e318-5494-9f28-7832825505ab",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--b08b9ed1-4a1c-5ee2-bbc3-e77ac1ff126a",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--f3a8c3ad-0fba-5477-b7f7-698c86f39f11",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv6 2001:ac8:27[:]89::a02d",
   "pattern": "[ipv6-addr:value = '2001:ac8:27:89::a02d']",
   "pattern_type": "stix",
   "valid_from": "2026-03-25T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Commercial VPN/DC attack exits (Mullvad/M247/31173/Datacamp; AL/AT/AR/CH/BG/SK/DE) - primary-key ops window",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--4669ae66-af13-5857-af5b-ca9c68545534",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--294298c9-041b-5e3a-b4ea-5adb57d77def",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--f3a8c3ad-0fba-5477-b7f7-698c86f39f11",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--da1743ad-a76c-55a7-867d-c6997b4b4aab",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv6 2001:ac8:29[:]84::a01d",
   "pattern": "[ipv6-addr:value = '2001:ac8:29:84::a01d']",
   "pattern_type": "stix",
   "valid_from": "2026-03-25T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "Commercial VPN/DC attack exits (Mullvad/M247/31173/Datacamp; AL/AT/AR/CH/BG/SK/DE) - primary-key ops window",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--a734c595-dec7-5529-95f7-980d7bd2651e",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--8be57821-c578-5fc6-be43-1f867801dcea",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--da1743ad-a76c-55a7-867d-c6997b4b4aab",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--951815c3-e547-5533-aece-b9822026287a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 ipv6 2001:bc8:711:5854:dc00:1ff:fe18[:]ba53",
   "pattern": "[ipv6-addr:value = '2001:bc8:711:5854:dc00:1ff:fe18:ba53']",
   "pattern_type": "stix",
   "valid_from": "2026-06-26T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Persistent dedicated server, Scaleway FR used in late-phase operations",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--c3409ebd-ea0f-563c-b14a-f36a982078c6",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--a0486137-16c7-5856-a4bc-bda63b0458a5",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--951815c3-e547-5533-aece-b9822026287a",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--8fe9be07-0330-5a69-a92e-f975cb0f964c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 onion 3ell6n47y3ct4a3x67fbuz62q2mk2l4vo6eacho2suzftdshsnrfopyd[.]onion",
   "pattern": "[domain-name:value = '3ell6n47y3ct4a3x67fbuz62q2mk2l4vo6eacho2suzftdshsnrfopyd.onion']",
   "pattern_type": "stix",
   "valid_from": "2026-05T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "CRS credential-vault API",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--83ed26ed-c1c5-5f00-8a7d-b6f0c006b543",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--869c6500-e14c-5fc6-b73e-ddfec47bda9a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--8fe9be07-0330-5a69-a92e-f975cb0f964c",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--88ea8814-0fba-590e-85c7-20de0ed696e1",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-50029 onion 6mshbvhvzhdgumwwazf4jcep2xx4kdk6n4wgffc46msu2gc3j3t2fpad[.]onion",
   "pattern": "[domain-name:value = '6mshbvhvzhdgumwwazf4jcep2xx4kdk6n4wgffc46msu2gc3j3t2fpad.onion']",
   "pattern_type": "stix",
   "valid_from": "2026-06T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Actor's Tor LLM-gateway (third-party model routing)",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-50029-hacktivists-targeted-european-political-and-affiliated-entities",
     "external_id": "indicator--553ab5e9-abb4-55ea-974b-f59213017b0f",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--4f4562d2-b87f-5a82-a82c-bb45d6fe8708",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--88ea8814-0fba-590e-85c7-20de0ed696e1",
   "target_ref": "intrusion-set--52f27c30-83ae-5c2e-b97e-f3122d47c4f8"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--18932298-dce0-596f-812b-255e324d3eb2",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-24015 account https[:]//t[.]me/ATodaPotencia",
   "pattern": "[url:value = 'https://t.me/ATodaPotencia']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Deceptive amplification asset; (Telegram); Presents Kremlin-aligned content as organic Latin American analysis",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-24015-disrupting-russian-state-media-editorial-pipelines-built-on-claude",
     "external_id": "indicator--19482c78-6644-5e42-a9ab-4f3ba0f3b1df",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--5423a2a9-2cee-54eb-88ee-1245a24474c5",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--18932298-dce0-596f-812b-255e324d3eb2",
   "target_ref": "intrusion-set--e47526e5-6e4e-5763-b1d1-ccda9177effc"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--97d9e766-57fe-58fd-9da7-7775e5a9f083",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 account https[:]//x[.]com/AxumVoices",
   "pattern": "[url:value = 'https://x.com/AxumVoices']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on X 'Axum Voices'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--7896049b-b3f0-570f-842f-de8b0dbca927",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--3ef1e518-f95a-55d0-92dc-22c630716d1d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--97d9e766-57fe-58fd-9da7-7775e5a9f083",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--8aa37987-14c8-5027-85a6-fd3fd27270a5",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 account https[:]//x[.]com/Civicpulsemedia",
   "pattern": "[url:value = 'https://x.com/Civicpulsemedia']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on X 'Civic Pulse'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--052be309-7bc3-514e-8ef6-114aa63dc415",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--9c58ba44-938b-51f7-8ec3-81d16f04357f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--8aa37987-14c8-5027-85a6-fd3fd27270a5",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--d7c4545d-8cf4-5743-b4b5-dc20b5c48883",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 account https[:]//x[.]com/Fiftystatesnews",
   "pattern": "[url:value = 'https://x.com/Fiftystatesnews']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on X 'Fifty States'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--0d162690-0a72-5b06-960c-664e3622f950",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--7153bd2a-f13a-5557-be12-8b59cc1491d5",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--d7c4545d-8cf4-5743-b4b5-dc20b5c48883",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--b51ddbdb-a276-526d-a516-29734954dc30",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 account https[:]//x[.]com/Naijapulse_",
   "pattern": "[url:value = 'https://x.com/Naijapulse_']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on X 'Naija Pulse'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--080d0715-8837-58a0-a6fa-14cc300a9f68",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--c7f2ff16-3cd4-58ab-be4d-a2669c82b6c3",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--b51ddbdb-a276-526d-a516-29734954dc30",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--7693670f-99ba-5710-aa95-2457a7009dd2",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 account https[:]//x[.]com/PSarzameeninfo",
   "pattern": "[url:value = 'https://x.com/PSarzameeninfo']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on X 'Pak Sarzameen'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--29087f10-31fb-59f5-ab09-f781de601706",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--8dd1561c-9dfd-502c-83dc-e61ad21bee99",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--7693670f-99ba-5710-aa95-2457a7009dd2",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--d60c6314-3243-5969-b6f2-871113f4e3bd",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 account https[:]//x[.]com/RussianWayMedia",
   "pattern": "[url:value = 'https://x.com/RussianWayMedia']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on X 'Russian Way'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--3b6f7502-cf77-5864-908d-accc808387b9",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--de9acf81-39f1-5dda-9c6a-08ece6559968",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--d60c6314-3243-5969-b6f2-871113f4e3bd",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--b3f46005-8c08-525f-893b-efc3a2520be8",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 account https[:]//x[.]com/berlin_echo",
   "pattern": "[url:value = 'https://x.com/berlin_echo']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on X 'Echo Berlin'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--7d63a534-4ea9-58fe-8d42-ed64d01bcddb",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--3e04f280-ffa6-5b79-b10f-58d27372a248",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--b3f46005-8c08-525f-893b-efc3a2520be8",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--769d68fc-885e-5a25-afea-fa3a27a73449",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 account https[:]//x[.]com/britishdaily_",
   "pattern": "[url:value = 'https://x.com/britishdaily_']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on X 'The British Daily'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--0712f804-722a-525d-a935-780791ff5683",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--e705dd44-fae6-570b-8ecc-b4bdb8f61966",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--769d68fc-885e-5a25-afea-fa3a27a73449",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--08b5aa40-08e7-5320-b6e5-c9f76d0eb8d3",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 account https[:]//x[.]com/cmwthpost",
   "pattern": "[url:value = 'https://x.com/cmwthpost']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on X 'Commonwealth Post'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--e24e7a6c-c1fe-5f51-a062-832672f4dbc6",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--01231e0f-a18d-5982-ae96-3be0512d5fa9",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--08b5aa40-08e7-5320-b6e5-c9f76d0eb8d3",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--5a03169b-1c48-5f01-8c77-570b7ed58270",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 account https[:]//x[.]com/elpulsopopular",
   "pattern": "[url:value = 'https://x.com/elpulsopopular']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on X 'El Pulso Popular'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--f2123e18-a353-53bf-8e4c-e191a41784c6",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--e418e1a6-4a54-50a2-ba8d-7b7f692a09be",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--5a03169b-1c48-5f01-8c77-570b7ed58270",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--e23267c5-77ee-5d15-86c5-a60c7ac414ca",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 account https[:]//x[.]com/fuxingmedia",
   "pattern": "[url:value = 'https://x.com/fuxingmedia']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on X 'Voice of the Rejuvenation'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--0a906927-7bfe-58f5-b077-f68cfae6d8f1",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--571c429b-6f78-55ca-87f5-54c86789f954",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--e23267c5-77ee-5d15-86c5-a60c7ac414ca",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--53fb6c8e-94bb-5312-9129-bffda108f35a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 account https[:]//x[.]com/journaljambo",
   "pattern": "[url:value = 'https://x.com/journaljambo']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on X 'Jambo Journal'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--6fd752db-682a-5600-a597-cfb4c42b6c78",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--afbb257e-bbe0-5cf2-9ae3-bc0970aee9d2",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--53fb6c8e-94bb-5312-9129-bffda108f35a",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--3b916d1b-b097-5e42-b897-9a55bc0c8d8d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 account https[:]//x[.]com/saudinews966",
   "pattern": "[url:value = 'https://x.com/saudinews966']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on X 'Al Watan Al Akbar'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--9af6e585-8f9f-5af4-a4a0-83f466880143",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--641ede47-7d22-5cfc-bcf6-2bc669f39a9b",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--3b916d1b-b097-5e42-b897-9a55bc0c8d8d",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--758f3319-6bf1-59a7-8328-341bef18713c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 account https[:]//x[.]com/zionpulse",
   "pattern": "[url:value = 'https://x.com/zionpulse']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on X 'Zion Pulse'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--01cf5c2e-53bd-5b74-bcf2-173cae9873e0",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--eaaa8d65-5ec5-5bd3-81e3-3d9f116a349e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--758f3319-6bf1-59a7-8328-341bef18713c",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--fdb15fc1-8aa8-54be-b44b-ccc8e0fc813f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 domain alwatanalakbar[.]com",
   "pattern": "[domain-name:value = 'alwatanalakbar.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet domain 'Al Watan Al Akbar'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--f3a0f67b-ffc2-563b-824e-434ab3badd24",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--6a408cb7-708a-5eaf-bfd8-3e3a0f9dc8be",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--fdb15fc1-8aa8-54be-b44b-ccc8e0fc813f",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--3f8c30f0-73a2-50f4-a845-0f4ed4575c9d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 domain axumvoices[.]org",
   "pattern": "[domain-name:value = 'axumvoices.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet domain 'Axum Voices'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--35b1a113-108d-57eb-9047-07bcb89a5a7d",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--65ee1e0c-fe7d-5845-b4d9-3f9d511754f5",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--3f8c30f0-73a2-50f4-a845-0f4ed4575c9d",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--957da000-4561-585c-997d-bffc39626ee4",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 domain british-daily[.]com",
   "pattern": "[domain-name:value = 'british-daily.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet domain 'The British Daily'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--d7c98877-fe19-54a2-af6d-61aa060058de",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--8bebb1a7-b887-510b-8d63-1bab7e91dec0",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--957da000-4561-585c-997d-bffc39626ee4",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--9e295ee5-4260-553b-83e0-52859e438470",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 domain civicpulse[.]info",
   "pattern": "[domain-name:value = 'civicpulse.info']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet domain 'Civic Pulse'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--584d446e-787d-5e50-99f5-f36441c27f08",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--fb12a01d-775c-589e-990d-cc4ea945e21d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--9e295ee5-4260-553b-83e0-52859e438470",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--7c378810-783e-53b0-a0e2-3ef9f0904519",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 domain commonwealth-post[.]com",
   "pattern": "[domain-name:value = 'commonwealth-post.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet domain 'Commonwealth Post'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--2de96fc4-ed76-5eb5-a4ce-b6bb3457d93d",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--e736c70c-94b6-5c15-bec7-3a6f00e7422a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--7c378810-783e-53b0-a0e2-3ef9f0904519",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--dfae3c5c-881a-5e6c-bb0f-06667b519c99",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 domain echoberlin[.]info",
   "pattern": "[domain-name:value = 'echoberlin.info']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet domain 'Echo Berlin'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--978a4806-65b5-59fc-adcd-7d371a895849",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--09b5db2c-5c9f-54a1-8e9c-4d9864f2056a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--dfae3c5c-881a-5e6c-bb0f-06667b519c99",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--f2ad8d81-325c-55ee-b9d0-10fb57e9c0b1",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 domain elpulsopopular[.]com",
   "pattern": "[domain-name:value = 'elpulsopopular.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet domain 'El Pulso Popular'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--54e78173-071e-56c0-b638-e1eb5123fc31",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--3e18f09e-9c12-58c3-abcc-b5e0a7ee9fda",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--f2ad8d81-325c-55ee-b9d0-10fb57e9c0b1",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--4462e8bd-29b8-5069-ac3d-0452c13ab06c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 domain fiftystates[.]news",
   "pattern": "[domain-name:value = 'fiftystates.news']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet domain 'Fifty States'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--1f09e23f-d57c-5009-a717-9eeacbf11f69",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--b841c891-8e58-558f-89fb-e51c804552cd",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--4462e8bd-29b8-5069-ac3d-0452c13ab06c",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--759370fc-6e3d-5269-a2b7-6c3b428d9d7f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 domain jambojournal[.]org",
   "pattern": "[domain-name:value = 'jambojournal.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet domain 'Jambo Journal'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--9d8fd0d7-3b7f-5bd9-8b62-3ddc8cb495e7",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--234d4a22-6270-5e8a-bd08-1cff90b990b5",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--759370fc-6e3d-5269-a2b7-6c3b428d9d7f",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--032ecdd2-e981-5630-a8a4-4a1a67bbaeef",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 domain naijapulse[.]org",
   "pattern": "[domain-name:value = 'naijapulse.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet domain 'Naija Pulse'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--1dbe1724-83a7-5b8e-a8eb-c186bbef8b7b",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--33f4ecf3-0bdc-501c-a250-7d0d362ffe59",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--032ecdd2-e981-5630-a8a4-4a1a67bbaeef",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--87705102-356a-5dcf-bf5e-a244b03040dd",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 domain pakssarzameen[.]org",
   "pattern": "[domain-name:value = 'pakssarzameen.org']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet domain 'Pak Sarzameen'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--b1fab3e0-94f9-5a73-aeec-00655e93854c",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--eb503a33-6fbf-5e1c-b89b-0d946fe45592",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--87705102-356a-5dcf-bf5e-a244b03040dd",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--7a4b082a-1193-53c8-8629-e469d84bd293",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 domain russianway[.]info",
   "pattern": "[domain-name:value = 'russianway.info']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet domain 'Russian Way'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--0b99d049-2630-545a-ad91-18b8f4dd62c4",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--4cebcd01-5058-538c-856c-45fe7d29f54a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--7a4b082a-1193-53c8-8629-e469d84bd293",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--c9007d4d-0980-54ce-815b-4c004b595c26",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 domain voiceoftherejuvenation[.]com",
   "pattern": "[domain-name:value = 'voiceoftherejuvenation.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet domain 'Voice of the Rejuvenation'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--cff771e0-bb5b-5dce-9bd8-e125b94eae5b",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--1d775ed3-de39-5499-9dd2-318308b1e1cf",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--c9007d4d-0980-54ce-815b-4c004b595c26",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--0520ed7f-102c-55db-b326-997d2d2b4652",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-54002 domain zion-pulse[.]com",
   "pattern": "[domain-name:value = 'zion-pulse.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet domain 'Zion Pulse'.",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-54002-disrupting-a-commercial-influence-as-a-service-operation-spanning-six-continents",
     "external_id": "indicator--3c882957-3a91-56d7-aad1-1d061f277ded",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--2db8951a-2afc-5c12-a41f-c7189ba332a3",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--0520ed7f-102c-55db-b326-997d2d2b4652",
   "target_ref": "intrusion-set--66fce4ec-604e-5aed-83b4-01ead1070084"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--d43f8b42-516e-59de-af76-6a13800c7ea4",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 account https[:]//www.youtube[.]com/@malaysiapulseof",
   "pattern": "[url:value = 'https://www.youtube.com/@malaysiapulseof']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on YouTube 'Malaysia Pulse' - YouTube channel for the synthetic news operation",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--0e4682d0-1261-5128-b3a9-20aa71acd8a6",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--7a64ded7-cd4e-5a13-8ad0-1337bf980716",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--d43f8b42-516e-59de-af76-6a13800c7ea4",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--986dc306-12af-546a-a934-4bfc5368b1a7",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 account https[:]//x[.]com/Chikmore",
   "pattern": "[url:value = 'https://x.com/Chikmore']",
   "pattern_type": "stix",
   "valid_from": "2026-05-17T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Sockpuppet account on X",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--473bbda0-c344-58be-87bc-03eb868b549d",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--7df4d5e9-375e-5c5c-9119-fcd9393ce77e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--986dc306-12af-546a-a934-4bfc5368b1a7",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--d1decb7b-122e-5e32-8c50-7d356cb0893c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 account https[:]//x[.]com/SHIHAN1947",
   "pattern": "[url:value = 'https://x.com/SHIHAN1947']",
   "pattern_type": "stix",
   "valid_from": "2026-05-17T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Sockpuppet account on X",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--75adbf9c-e243-5169-92c4-967960a3cbdf",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--b3f508f1-1f79-5907-b0b3-eda920fdb178",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--d1decb7b-122e-5e32-8c50-7d356cb0893c",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--e2e8e557-bfb9-52f8-b9be-31598fbcf3c0",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 account https[:]//x[.]com/adriansantodo",
   "pattern": "[url:value = 'https://x.com/adriansantodo']",
   "pattern_type": "stix",
   "valid_from": "2026-05-17T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Sockpuppet account on X",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--ee70d130-be45-5221-be87-0353d610be99",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--f77a7e70-b433-5edf-ac05-8ee33107df82",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--e2e8e557-bfb9-52f8-b9be-31598fbcf3c0",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--e6d5218d-ad1f-5020-b70f-d7de05054003",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 account https[:]//x[.]com/armsam1209",
   "pattern": "[url:value = 'https://x.com/armsam1209']",
   "pattern_type": "stix",
   "valid_from": "2026-05-17T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Sockpuppet account on X",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--3b92efee-e7e4-58a4-8cb0-db62862305f1",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--337f0cf4-d6e0-595c-b216-a1e5ea6f326c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--e6d5218d-ad1f-5020-b70f-d7de05054003",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--d69e4e9a-38bc-57db-a5a6-3a9a59f3a39c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 account https[:]//x[.]com/avihoue",
   "pattern": "[url:value = 'https://x.com/avihoue']",
   "pattern_type": "stix",
   "valid_from": "2026-05-17T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Sockpuppet account on X",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--232e9914-7659-5286-8969-606755aaf74b",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--2ca417cc-f869-5695-bcf9-680d4d98c78b",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--d69e4e9a-38bc-57db-a5a6-3a9a59f3a39c",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--f3672bd4-6500-546b-a694-a604db479610",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 account https[:]//x[.]com/bmmyangels",
   "pattern": "[url:value = 'https://x.com/bmmyangels']",
   "pattern_type": "stix",
   "valid_from": "2026-05-17T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Sockpuppet account on X",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--4b897487-b772-5ad2-b622-46ed6226d4a1",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--c873616b-6196-5c8f-9ef2-bc91baf08a32",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--f3672bd4-6500-546b-a694-a604db479610",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--13d246e8-b955-5c54-b0b7-7b2990e452df",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 account https[:]//x[.]com/exceiivier",
   "pattern": "[url:value = 'https://x.com/exceiivier']",
   "pattern_type": "stix",
   "valid_from": "2026-05-17T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Sockpuppet account on X",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--4b67dfc8-0a5a-5d5c-a277-abed6116d0ee",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--0a8c4052-480d-5cbf-ad39-21654418c668",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--13d246e8-b955-5c54-b0b7-7b2990e452df",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--8b8bfb5f-116f-5e6d-83e6-af80ef2e96af",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 account https[:]//x[.]com/garyponce",
   "pattern": "[url:value = 'https://x.com/garyponce']",
   "pattern_type": "stix",
   "valid_from": "2026-05-17T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Sockpuppet account on X",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--c1a47c28-f22b-5f2e-9b8e-c4d96e210cb0",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--42e37799-563e-58d2-8c7d-5244e379accd",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--8b8bfb5f-116f-5e6d-83e6-af80ef2e96af",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--39d833a3-a4ad-571e-80a8-5dd539360f80",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 account https[:]//x[.]com/goldsteve1",
   "pattern": "[url:value = 'https://x.com/goldsteve1']",
   "pattern_type": "stix",
   "valid_from": "2026-05-17T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Sockpuppet account on X",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--3f09d3a7-9f1b-525b-aaae-53b51a651eb9",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--7146e248-bb2a-53b7-89df-f2cca4b99c65",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--39d833a3-a4ad-571e-80a8-5dd539360f80",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--de82e277-d12a-5628-9944-1431cb51dcc3",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 account https[:]//x[.]com/hugolaurent",
   "pattern": "[url:value = 'https://x.com/hugolaurent']",
   "pattern_type": "stix",
   "valid_from": "2026-05-17T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Sockpuppet account on X",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--419dfa41-c1bf-5296-9a2a-2838841b6c93",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--d14beec7-d7bf-5e36-ac6b-30ce1cf03498",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--de82e277-d12a-5628-9944-1431cb51dcc3",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--98d80f2f-ca69-5c63-ade2-b7c7f5f616e7",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 account https[:]//x[.]com/kioskou",
   "pattern": "[url:value = 'https://x.com/kioskou']",
   "pattern_type": "stix",
   "valid_from": "2026-05-17T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Sockpuppet account on X",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--fac56fd7-455c-5061-a219-18745c401176",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--c9707dc3-f02d-5628-9f84-d838325c3171",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--98d80f2f-ca69-5c63-ade2-b7c7f5f616e7",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--4602bacf-8dce-5ef6-b29d-5b1caa159554",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 account https[:]//x[.]com/telkisoszoba",
   "pattern": "[url:value = 'https://x.com/telkisoszoba']",
   "pattern_type": "stix",
   "valid_from": "2026-05-17T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Sockpuppet account on X",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--db8f1968-4001-5988-8b83-e61c51b2053b",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--4e730a26-5d74-573a-a332-0d5e863c6aaf",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--4602bacf-8dce-5ef6-b29d-5b1caa159554",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--e1e028bd-abc1-5b76-90e4-360e871ebf8e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 domain malaysiapulse[.]com",
   "pattern": "[domain-name:value = 'malaysiapulse.com']",
   "pattern_type": "stix",
   "valid_from": "2026-05-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet domain 'Malaysia Pulse'",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--3ce7752c-f17a-50ad-9c0c-1bd425bbc4a2",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--acc18658-96b5-5368-9458-e4a46c4b1920",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--e1e028bd-abc1-5b76-90e4-360e871ebf8e",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--a0854786-1379-512d-96bb-2e2b988531f3",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 domain bbsteknoloji[.]com",
   "pattern": "[domain-name:value = 'bbsteknoloji.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Actor-controlled: news front",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--50e44b12-27a6-5165-bd0a-e21a9e7fd08f",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--6a5399e6-95a4-58c3-b6aa-cb6f780a8330",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--a0854786-1379-512d-96bb-2e2b988531f3",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--cc7e0dc5-f874-5adc-b2dc-d05e107e8c41",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 ipv4 157.180.93[.]7",
   "pattern": "[ipv4-addr:value = '157.180.93.7']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "XPanel/MalaysiaPulse, NEOS, renderer, NEOS Docker, panel, Voxta",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--18e132a9-90b5-5661-8c19-b241d52c2fe3",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--43605a67-f96d-5ecd-8d6d-3a36364fbe8f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--cc7e0dc5-f874-5adc-b2dc-d05e107e8c41",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--05c6e5f4-2600-57e2-9f24-d7d53a98bd91",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 ipv4 167.235.157[.]100",
   "pattern": "[ipv4-addr:value = '167.235.157.100']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "XPanel/MalaysiaPulse, NEOS, renderer, NEOS Docker, panel, Voxta",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--f3d3c9cc-7264-5352-b9bc-f1b51a0da98c",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--297f2d96-0887-50a7-8a83-e9a79cde6758",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--05c6e5f4-2600-57e2-9f24-d7d53a98bd91",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--9f26a756-8a69-547b-bb18-abbb2b377d8d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 ipv4 23.88.118[.]216",
   "pattern": "[ipv4-addr:value = '23.88.118.216']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "XPanel/MalaysiaPulse, NEOS, renderer, NEOS Docker, panel, Voxta",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--051a79f8-4818-5839-85a0-c831482314a8",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--b5b42286-8b9e-5b84-aa47-21b34a73fcad",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--9f26a756-8a69-547b-bb18-abbb2b377d8d",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--5ca573db-b0a5-5c6d-bf60-fde105b315ce",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 ipv4 46.225.91[.]180",
   "pattern": "[ipv4-addr:value = '46.225.91.180']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "XPanel/MalaysiaPulse, NEOS, renderer, NEOS Docker, panel, Voxta",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--3e2af680-1bad-53b1-8dc4-793263eaf7c8",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--a6d5863d-d0be-551c-a44e-71bfe67dc4b8",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--5ca573db-b0a5-5c6d-bf60-fde105b315ce",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--25000379-2364-581e-8465-f594aab142de",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 ipv4 46.62.214[.]3",
   "pattern": "[ipv4-addr:value = '46.62.214.3']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "XPanel/MalaysiaPulse, NEOS, renderer, NEOS Docker, panel, Voxta",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--4360b994-259e-5ef2-981c-4db3b10ac3b5",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--022ef736-8bd3-5efc-9cae-46f3de388f53",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--25000379-2364-581e-8465-f594aab142de",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--0196036d-2e83-556d-9948-8bb5a5643863",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84005 ipv4 91.99.117[.]166",
   "pattern": "[ipv4-addr:value = '91.99.117.166']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "XPanel/MalaysiaPulse, NEOS, renderer, NEOS Docker, panel, Voxta",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84005-disrupting-a-commercial-election-manipulation-platform-targeting-malaysia",
     "external_id": "indicator--9317faf1-bf3b-518e-95d5-5ba951af416a",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--cbc8a88a-46a6-552f-9291-55c660909069",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--0196036d-2e83-556d-9948-8bb5a5643863",
   "target_ref": "intrusion-set--b3397d37-957b-5ccc-89cf-4ef87dba948f"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--1dc5f657-a6cf-55f7-9699-e290e957a8b5",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84006 account https[:]//www.instagram[.]com/fwr.ir",
   "pattern": "[url:value = 'https://www.instagram.com/fwr.ir']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Instagram Sockpuppet funnel and surveillance endpoint",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84006-disrupting-a-distributed-mekncri-aligned-influence-operation-that-used-a-shared-ai-agent-to-impersonate-real-people-and-recruit-inside-iran",
     "external_id": "indicator--ec5cfb88-47e2-5401-8406-832f1a300567",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--d4b77e81-1f14-5f86-a118-40cb6b9826dc",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--1dc5f657-a6cf-55f7-9699-e290e957a8b5",
   "target_ref": "intrusion-set--c199537e-06a4-5c7e-b514-53fc1928125d"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--5c6cef00-7c40-5fea-9acf-9cf2d0d0b80e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84006 account https[:]//t[.]me/FWR_ir",
   "pattern": "[url:value = 'https://t.me/FWR_ir']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Telegram Sockpuppet funnel and surveillance endpoint",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84006-disrupting-a-distributed-mekncri-aligned-influence-operation-that-used-a-shared-ai-agent-to-impersonate-real-people-and-recruit-inside-iran",
     "external_id": "indicator--b6e352ae-20bc-584b-bde0-151b476c57b9",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--ce1dfeac-81cc-58a9-8a32-aec4bb975582",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--5c6cef00-7c40-5fea-9acf-9cf2d0d0b80e",
   "target_ref": "intrusion-set--c199537e-06a4-5c7e-b514-53fc1928125d"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--7dfade7e-bc51-5d81-b079-c5dd241768ea",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84006 account https[:]//t[.]me/anti_silent",
   "pattern": "[url:value = 'https://t.me/anti_silent']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Telegram Student surveillance funnel",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84006-disrupting-a-distributed-mekncri-aligned-influence-operation-that-used-a-shared-ai-agent-to-impersonate-real-people-and-recruit-inside-iran",
     "external_id": "indicator--00d675b6-1469-5066-80c2-140dd18930cb",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--9439c4be-7874-51ae-be02-731c1bd9d2e5",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--7dfade7e-bc51-5d81-b079-c5dd241768ea",
   "target_ref": "intrusion-set--c199537e-06a4-5c7e-b514-53fc1928125d"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--097df85f-3da5-571c-90de-878a0532395b",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84006 account https[:]//www.instagram[.]com/faryade_mamnoo",
   "pattern": "[url:value = 'https://www.instagram.com/faryade_mamnoo']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Influence network account on Instagram",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84006-disrupting-a-distributed-mekncri-aligned-influence-operation-that-used-a-shared-ai-agent-to-impersonate-real-people-and-recruit-inside-iran",
     "external_id": "indicator--f6873bc2-631e-5fc0-bd36-081cef4fcc61",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--ebcb87c2-3873-53e6-82e2-9c6b8954628c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--097df85f-3da5-571c-90de-878a0532395b",
   "target_ref": "intrusion-set--c199537e-06a4-5c7e-b514-53fc1928125d"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--bc67a078-ffd9-538e-9a69-a25f9f1d40f1",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84006 account https[:]//www.instagram[.]com/iranpayam_tehran5",
   "pattern": "[url:value = 'https://www.instagram.com/iranpayam_tehran5']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Influence network account on Instagram",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84006-disrupting-a-distributed-mekncri-aligned-influence-operation-that-used-a-shared-ai-agent-to-impersonate-real-people-and-recruit-inside-iran",
     "external_id": "indicator--fb16a061-a7d3-54d9-9eb5-ff2655f11cf8",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--1b0b6832-a45d-5aa3-8a36-a42aa6a36d0c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--bc67a078-ffd9-538e-9a69-a25f9f1d40f1",
   "target_ref": "intrusion-set--c199537e-06a4-5c7e-b514-53fc1928125d"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--0764f53a-c842-5e17-be68-83de028d6cf9",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84006 account https[:]//www.instagram[.]com/javanane_shargt",
   "pattern": "[url:value = 'https://www.instagram.com/javanane_shargt']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Influence network account on Instagram",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84006-disrupting-a-distributed-mekncri-aligned-influence-operation-that-used-a-shared-ai-agent-to-impersonate-real-people-and-recruit-inside-iran",
     "external_id": "indicator--43d069ba-ec6e-548d-a82c-a1f04273ece7",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--e05b6186-c23a-54ec-a4d2-3c89ead4c0fb",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--0764f53a-c842-5e17-be68-83de028d6cf9",
   "target_ref": "intrusion-set--c199537e-06a4-5c7e-b514-53fc1928125d"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--83168fb1-fd80-5cbf-8af6-1b42d0d5ba50",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84006 account https[:]//www.instagram[.]com/khabar_fouri_mardom",
   "pattern": "[url:value = 'https://www.instagram.com/khabar_fouri_mardom']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Influence network account on Instagram",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84006-disrupting-a-distributed-mekncri-aligned-influence-operation-that-used-a-shared-ai-agent-to-impersonate-real-people-and-recruit-inside-iran",
     "external_id": "indicator--a663c8cd-e3cc-5265-bae2-8af0a424e500",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--ed7d01a8-e278-5522-a76f-c73e7bde0a66",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--83168fb1-fd80-5cbf-8af6-1b42d0d5ba50",
   "target_ref": "intrusion-set--c199537e-06a4-5c7e-b514-53fc1928125d"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--226fcb56-b5ee-522b-847f-26474246e3db",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84006 account https[:]//www.instagram[.]com/tehranchekhabar19",
   "pattern": "[url:value = 'https://www.instagram.com/tehranchekhabar19']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Fake news outlet account on Instagram",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84006-disrupting-a-distributed-mekncri-aligned-influence-operation-that-used-a-shared-ai-agent-to-impersonate-real-people-and-recruit-inside-iran",
     "external_id": "indicator--1340e543-8a7d-5321-9513-325701406f97",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--3a845ac6-41a2-5f36-afc4-210986406915",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--226fcb56-b5ee-522b-847f-26474246e3db",
   "target_ref": "intrusion-set--c199537e-06a4-5c7e-b514-53fc1928125d"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--78a1ec82-6f51-5641-b485-ebdcbb907d90",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84006 account https[:]//www.instagram[.]com/jomhouri_democratic",
   "pattern": "[url:value = 'https://www.instagram.com/jomhouri_democratic']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Instagram Ten-point-plan promotion",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84006-disrupting-a-distributed-mekncri-aligned-influence-operation-that-used-a-shared-ai-agent-to-impersonate-real-people-and-recruit-inside-iran",
     "external_id": "indicator--5307a5b7-61aa-56ff-bcd6-f66f861c1fc4",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--c99f146b-e0c1-58f6-8f9e-19e4eea5b5cb",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--78a1ec82-6f51-5641-b485-ebdcbb907d90",
   "target_ref": "intrusion-set--c199537e-06a4-5c7e-b514-53fc1928125d"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--de9e3d2d-25a0-5468-a1dd-1b6c56376252",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-84006 account https[:]//t[.]me/jomhouri_democratic",
   "pattern": "[url:value = 'https://t.me/jomhouri_democratic']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Telegram Ten-point-plan promotion",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-84006-disrupting-a-distributed-mekncri-aligned-influence-operation-that-used-a-shared-ai-agent-to-impersonate-real-people-and-recruit-inside-iran",
     "external_id": "indicator--5307a5b7-61aa-56ff-bcd6-f66f861c1fc5",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--c715d85a-6303-5aad-bc37-849ab02fc371",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--de9e3d2d-25a0-5468-a1dd-1b6c56376252",
   "target_ref": "intrusion-set--c199537e-06a4-5c7e-b514-53fc1928125d"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--5d342fa3-5142-532b-bf26-4995109e9b43",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-30006 android_package com.app.safeguard",
   "pattern": "[software:name = 'com.app.safeguard']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Android package; silent contacts/SMS/media exfiltration",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-30006-building-the-tools-for-domestic-surveillance",
     "external_id": "indicator--e6ad51b4-37d1-5f18-93c6-68b22e3a5d51",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--fa9fb80f-9158-536f-b6a9-98d6bfa8e1fa",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--5d342fa3-5142-532b-bf26-4995109e9b43",
   "target_ref": "intrusion-set--e40f642d-0fd5-5290-a2cb-e5c4c04aa0bd"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--5d2579a6-34f7-570c-b19d-bb7e368fc1d7",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-30006 filename fontdrivehost.exe",
   "pattern": "[file:name = 'fontdrivehost.exe']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "SECOMS64 implant masquerading as Windows fontdrvhost.exe",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-30006-building-the-tools-for-domestic-surveillance",
     "external_id": "indicator--bcd8f309-f52a-50ff-aa8d-f9b12f203e81",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--5e2a3bc9-71b1-5009-83ad-cf7cfe780a22",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--5d2579a6-34f7-570c-b19d-bb7e368fc1d7",
   "target_ref": "intrusion-set--e40f642d-0fd5-5290-a2cb-e5c4c04aa0bd"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--6c8a7e94-f3e2-5ae8-9561-b8ff675dcdb3",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-30006 filename telegram_listener_v12_2.vbs",
   "pattern": "[file:name = 'telegram_listener_v12_2.vbs']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "VBScript dropper",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-30006-building-the-tools-for-domestic-surveillance",
     "external_id": "indicator--c2e92f02-9d6a-5a4a-8367-f5f095c1ca12",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--0e4a2ecf-8edb-5101-be9c-099b003cae72",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--6c8a7e94-f3e2-5ae8-9561-b8ff675dcdb3",
   "target_ref": "intrusion-set--e40f642d-0fd5-5290-a2cb-e5c4c04aa0bd"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--3a65af04-828f-5109-b1cd-19e1b3fc880f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-30006 filepath C:\\ProgramData\\fontdrivehostServicePackages\\drv3060nt10-69s64mmm\\fontdrivehost.exe",
   "pattern": "[file:name = 'fontdrivehost.exe']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "File path used for malware persistence",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-30006-building-the-tools-for-domestic-surveillance",
     "external_id": "indicator--6dada0b8-f78d-531f-93dc-4515915c0939",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--eaa97c6b-f3a1-5ebb-85b0-40dde0e16ed3",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--3a65af04-828f-5109-b1cd-19e1b3fc880f",
   "target_ref": "intrusion-set--e40f642d-0fd5-5290-a2cb-e5c4c04aa0bd"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--2a789c47-6c77-5db5-8b36-dba1ab54ca31",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-30006 telegram_chat_id -1003197249446",
   "pattern": "[user-account:user_id = '-1003197249446' AND user-account:account_type = 'telegram']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Telegram chat used for command and control",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-30006-building-the-tools-for-domestic-surveillance",
     "external_id": "indicator--b6ca1b32-b17b-5162-b21e-1968009cb77a",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--1d0fc322-cd8a-5826-87f2-45b33361a078",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--2a789c47-6c77-5db5-8b36-dba1ab54ca31",
   "target_ref": "intrusion-set--e40f642d-0fd5-5290-a2cb-e5c4c04aa0bd"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--6ab22c4b-29ed-509d-9060-9a60b8ef3452",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-30006 telegram_chat_id -1003233252",
   "pattern": "[user-account:user_id = '-1003233252' AND user-account:account_type = 'telegram']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Telegram chat used for command and control",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-30006-building-the-tools-for-domestic-surveillance",
     "external_id": "indicator--7e5bb15e-3587-57fe-b07e-4530cc0dd726",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--d6009c3b-cd09-5a21-967e-fccaa4e70c29",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--6ab22c4b-29ed-509d-9060-9a60b8ef3452",
   "target_ref": "intrusion-set--e40f642d-0fd5-5290-a2cb-e5c4c04aa0bd"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--69ad8d22-637b-540a-92a8-9737e6c1de21",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-30006 telegram_chat_id -10078223223323",
   "pattern": "[user-account:user_id = '-10078223223323' AND user-account:account_type = 'telegram']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Telegram chat used for command and control",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-30006-building-the-tools-for-domestic-surveillance",
     "external_id": "indicator--ce1701a2-a49a-5768-b5aa-9c813c948dd1",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--5208bc71-147b-59c7-b90f-108dadf5d506",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--69ad8d22-637b-540a-92a8-9737e6c1de21",
   "target_ref": "intrusion-set--e40f642d-0fd5-5290-a2cb-e5c4c04aa0bd"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--773c043d-a046-5f0a-9de9-0e3200118eed",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-30006 telegram_chat_id 7828288328",
   "pattern": "[user-account:user_id = '7828288328' AND user-account:account_type = 'telegram']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Telegram chat used for command and control",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-30006-building-the-tools-for-domestic-surveillance",
     "external_id": "indicator--8d42a6b2-db4c-5605-94e4-01b764b7395c",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--1a54e712-2955-5817-85ed-6b05f68f1fef",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--773c043d-a046-5f0a-9de9-0e3200118eed",
   "target_ref": "intrusion-set--e40f642d-0fd5-5290-a2cb-e5c4c04aa0bd"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--e5106eb4-a45d-582d-8920-d4e876e91a28",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-15001 app_id com.cavalier.nalo",
   "pattern": "[software:name = 'com.cavalier.nalo']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Mobile app ID of a scam dating app",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-15001-deceptive-dating-app-network",
     "external_id": "indicator--10369064-b30d-5fac-93df-e57854811b1d",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--dfd2e0c0-fcca-59ec-9e3e-02fd01dfa248",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--e5106eb4-a45d-582d-8920-d4e876e91a28",
   "target_ref": "intrusion-set--377acd3e-8e07-5354-80a0-1035f887e856"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--1097cc69-c72d-5ce6-84ac-575274d6e0e2",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-15001 app_id com.qiga.vio",
   "pattern": "[software:name = 'com.qiga.vio']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Mobile app ID of a scam dating app",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-15001-deceptive-dating-app-network",
     "external_id": "indicator--ddf39b83-7513-5a21-8337-80a72a5b5027",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--91fea5dd-accf-5ecc-a715-c7d324bed73e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--1097cc69-c72d-5ce6-84ac-575274d6e0e2",
   "target_ref": "intrusion-set--377acd3e-8e07-5354-80a0-1035f887e856"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--eaf11f38-1bbe-5192-8b59-c08624e7f657",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-15001 domain archat[.]us",
   "pattern": "[domain-name:value = 'archat.us']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Domain used as actor infrastructure",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-15001-deceptive-dating-app-network",
     "external_id": "indicator--82fb64af-a123-5fa2-8c9f-4b5829ef5535",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--2e9216df-3991-5531-990a-9240e5be5194",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--eaf11f38-1bbe-5192-8b59-c08624e7f657",
   "target_ref": "intrusion-set--377acd3e-8e07-5354-80a0-1035f887e856"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--21f65fa5-eb84-5416-ba41-5f8ce8ecaf6c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-15001 domain heyhru[.]com",
   "pattern": "[domain-name:value = 'heyhru.com']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Operator's Corporate Domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-15001-deceptive-dating-app-network",
     "external_id": "indicator--9abe2ae3-21ce-5c97-a636-5d34341e416a",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--56b8a194-09a7-5418-964f-b3f23cc232f0",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--21f65fa5-eb84-5416-ba41-5f8ce8ecaf6c",
   "target_ref": "intrusion-set--377acd3e-8e07-5354-80a0-1035f887e856"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--13878d87-adec-59f3-b630-ab304d7ffae7",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-15001 domain sitin[.]ai",
   "pattern": "[domain-name:value = 'sitin.ai']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Web app domain",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-15001-deceptive-dating-app-network",
     "external_id": "indicator--49ec4246-506c-510b-adb6-dc0498290344",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--3173ab87-64f6-59ab-b47f-cddc0dd60091",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--13878d87-adec-59f3-b630-ab304d7ffae7",
   "target_ref": "intrusion-set--377acd3e-8e07-5354-80a0-1035f887e856"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--7ad69914-f6ee-5a8a-a4d4-53fc24e032b3",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-15001 hostname file.archat[.]us",
   "pattern": "[domain-name:value = 'file.archat.us']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "CDN serving scam-persona avatar images",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-15001-deceptive-dating-app-network",
     "external_id": "indicator--a9d081a8-e62f-5046-8cb5-3d06acfa09cf",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--6562b83d-0ec7-5b0e-b06e-e4fc50112305",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--7ad69914-f6ee-5a8a-a4d4-53fc24e032b3",
   "target_ref": "intrusion-set--377acd3e-8e07-5354-80a0-1035f887e856"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--10949f17-aeb3-59c5-8147-cad824f5f5f0",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-15001 hostname managedkafka.heyhru-server.cloud[.]goog",
   "pattern": "[domain-name:value = 'managedkafka.heyhru-server.cloud.goog']",
   "pattern_type": "stix",
   "valid_from": "2026-09-10T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "Production managed Kafka host",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-15001-deceptive-dating-app-network",
     "external_id": "indicator--1ffff264-f28b-555e-ba92-34090ee58c22",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--8abf40fb-a3fd-5ce8-8127-6112df8d4048",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--10949f17-aeb3-59c5-8147-cad824f5f5f0",
   "target_ref": "intrusion-set--377acd3e-8e07-5354-80a0-1035f887e856"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--dd5db4b6-18a7-5eb6-b045-91844cbabc18",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "GTG-15001 ipv4 38.129.138[.]244",
   "pattern": "[ipv4-addr:value = '38.129.138.244']",
   "pattern_type": "stix",
   "valid_from": "2026-04T00:00:00.000Z",
   "indicator_types": [
    "anomalous-activity"
   ],
   "description": "AS26042, a US-based egress proxy that the operation's API traffic was routed through (observed April 2026)",
   "labels": [
    "not-in-corpus"
   ],
   "external_references": [
    {
     "source_name": "Anthropic",
     "url": "https://www.anthropic.com/threat-intelligence-report-september-2026#gtg-15001-deceptive-dating-app-network",
     "external_id": "indicator--5c27b54e-c6dc-5266-90dd-d6266840178b",
     "description": "Anthropic AI misuse report IoC CSV (2026-09-10)"
    },
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--1c55af3e-1a55-528d-9cc6-fb81eb3e1fa7",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--dd5db4b6-18a7-5eb6-b045-91844cbabc18",
   "target_ref": "intrusion-set--377acd3e-8e07-5354-80a0-1035f887e856"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--d33534c2-2e69-5ed5-b740-998c5d6fb1b8",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "Storm-2945 (Microsoft) ipv4 104.194.159[.]150",
   "pattern": "[ipv4-addr:value = '104.194.159.150']",
   "pattern_type": "stix",
   "valid_from": "2026-07-31T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1808",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1808"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--87f66ae9-0bd9-51a5-8a38-cec78734b0e9",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--d33534c2-2e69-5ed5-b740-998c5d6fb1b8",
   "target_ref": "intrusion-set--d576c25e-27c4-5b1e-8775-52b966d99620"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--bb411796-a87f-5eb2-863f-dd86e700a04c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "Storm-2945 (Microsoft) ipv4 107.189.26[.]194",
   "pattern": "[ipv4-addr:value = '107.189.26.194']",
   "pattern_type": "stix",
   "valid_from": "2026-08-03T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1838",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1838"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--1cd77589-784b-5b14-b919-366030cf93c5",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--bb411796-a87f-5eb2-863f-dd86e700a04c",
   "target_ref": "intrusion-set--d576c25e-27c4-5b1e-8775-52b966d99620"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--79208336-7adc-580e-a3dc-4e531b88b118",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "Storm-2945 (Microsoft) url hxxps://213.145.86[.]112/t/pixel.gif?m=",
   "pattern": "[url:value = 'https://213.145.86.112/t/pixel.gif?m=']",
   "pattern_type": "stix",
   "valid_from": "2026-08-04T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1857",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1857"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--ebb5caeb-84e4-5a33-8734-956090f6b853",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--79208336-7adc-580e-a3dc-4e531b88b118",
   "target_ref": "intrusion-set--d576c25e-27c4-5b1e-8775-52b966d99620"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--bedca823-748a-53bc-b0ab-5ac4f1e83519",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "Storm-2945 (Microsoft) url hxxps://213.145.86[.]112/cdn/chunks/polyfill-7e2b.min.js",
   "pattern": "[url:value = 'https://213.145.86.112/cdn/chunks/polyfill-7e2b.min.js']",
   "pattern_type": "stix",
   "valid_from": "2026-08-04T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1857",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1857"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--4a91d8e1-ec90-570c-beb5-4699d1e928d4",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--bedca823-748a-53bc-b0ab-5ac4f1e83519",
   "target_ref": "intrusion-set--d576c25e-27c4-5b1e-8775-52b966d99620"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--d7872616-fa4f-5e04-bc8e-6c966c5cd93f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "Storm-2945 (Microsoft) url hxxps://213.145.86[.]112/t/event",
   "pattern": "[url:value = 'https://213.145.86.112/t/event']",
   "pattern_type": "stix",
   "valid_from": "2026-08-04T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-1857",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-1857"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--a35d4fbe-8d4b-54a2-8ab4-9ea0e78ae090",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--d7872616-fa4f-5e04-bc8e-6c966c5cd93f",
   "target_ref": "intrusion-set--d576c25e-27c4-5b1e-8775-52b966d99620"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--6a0faa80-c235-59e7-9d36-39480488ce2c",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) domain wa-connect[.]net",
   "pattern": "[domain-name:value = 'wa-connect.net']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--1f53ea15-eb6d-53c9-bb4e-2f80a40d9d50",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--6a0faa80-c235-59e7-9d36-39480488ce2c",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--653e5e46-3662-5e01-891e-1ffe5bbeb789",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) domain wa-invite[.]com",
   "pattern": "[domain-name:value = 'wa-invite.com']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--887d77a6-474f-5262-92ca-5b048f89e95d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--653e5e46-3662-5e01-891e-1ffe5bbeb789",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--9d845a5d-8110-574a-af5c-2e551227a777",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) domain wa-device[.]com",
   "pattern": "[domain-name:value = 'wa-device.com']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--50cd67d2-0ee8-5338-b277-2fa061a1ab6e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--9d845a5d-8110-574a-af5c-2e551227a777",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--3ab3e1d1-f28c-5746-98fe-5a65519311a5",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) domain shopinvite[.]org",
   "pattern": "[domain-name:value = 'shopinvite.org']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--ac863935-0176-55a0-a932-7263e7952cad",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--3ab3e1d1-f28c-5746-98fe-5a65519311a5",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--d8d9f2fe-b5ee-5f03-9aab-7c588f178022",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) domain globsec[.]net",
   "pattern": "[domain-name:value = 'globsec.net']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--030b19dd-2858-5411-af50-384fc56cc818",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--d8d9f2fe-b5ee-5f03-9aab-7c588f178022",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--a51ae44f-8d46-51a9-b61e-f550e2b9721f",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) domain finishoperations[.]com",
   "pattern": "[domain-name:value = 'finishoperations.com']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--1d299d96-e9f3-5a7f-a55a-f7104d4d7c4e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--a51ae44f-8d46-51a9-b61e-f550e2b9721f",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--1f390f98-c2c6-5302-b7df-fdff848cbb21",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) domain finishoperations[.]org",
   "pattern": "[domain-name:value = 'finishoperations.org']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--ffc21527-8c93-5191-9c26-c17c7347792a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--1f390f98-c2c6-5302-b7df-fdff848cbb21",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--3305b095-c9b0-5ccc-92a6-49acbd7e3366",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) domain foc-share[.]com",
   "pattern": "[domain-name:value = 'foc-share.com']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--8a0a83a7-9972-5655-92b5-a38fa471d3f6",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--3305b095-c9b0-5ccc-92a6-49acbd7e3366",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--10c21b07-4bcb-5ba8-aa0e-4c60c6be5ad0",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) domain share-foc[.]com",
   "pattern": "[domain-name:value = 'share-foc.com']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--af12567e-1c26-5f51-9fdf-b3a48c716b50",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--10c21b07-4bcb-5ba8-aa0e-4c60c6be5ad0",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--ecfe7350-4fe2-5d6e-8fa0-48cdc4560c40",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) domain internal-share[.]com",
   "pattern": "[domain-name:value = 'internal-share.com']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--1fa5816e-9144-581f-9fb5-d6254e1c03e7",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--ecfe7350-4fe2-5d6e-8fa0-48cdc4560c40",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--ca11be09-5cb2-5c61-be74-c18926ec36cf",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) domain foc-share[.]org",
   "pattern": "[domain-name:value = 'foc-share.org']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--838bb631-0bde-5ee9-a260-876eb92b022a",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--ca11be09-5cb2-5c61-be74-c18926ec36cf",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--7d866abc-92dd-5793-b81c-822b09a6f1ba",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) ipv4 107.189.18[.]7",
   "pattern": "[ipv4-addr:value = '107.189.18.7']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--bb901e17-7ca6-5afa-886b-0d45d6a23da4",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--7d866abc-92dd-5793-b81c-822b09a6f1ba",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--a4534e11-f0b7-5709-9e65-e4d0284c0fc8",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) sha256 1d9299799a7b8da67c44ebec064d64542c27645f8e84de4a22ca3f6cbc843e3c",
   "pattern": "[file:hashes.'SHA-256' = '1d9299799a7b8da67c44ebec064d64542c27645f8e84de4a22ca3f6cbc843e3c']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--f134925d-b6e2-5844-bbaa-e6f31432ffb0",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--a4534e11-f0b7-5709-9e65-e4d0284c0fc8",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--44ce6314-c5fc-5e1b-b2ed-a8382afd47bc",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) sha256 c5826032207d623a7f6caec8465af7364eccc355f9a48897da2a54f3e4420265",
   "pattern": "[file:hashes.'SHA-256' = 'c5826032207d623a7f6caec8465af7364eccc355f9a48897da2a54f3e4420265']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--7963543f-373d-597f-a6db-a3db66d39d83",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--44ce6314-c5fc-5e1b-b2ed-a8382afd47bc",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--61ccf0fa-c3ea-547f-8db0-f3df120a7524",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) sha256 125752ad7c20d715920a3b2fb0fdde660f07b3f2b053665cf38c2d6d9de86e1e",
   "pattern": "[file:hashes.'SHA-256' = '125752ad7c20d715920a3b2fb0fdde660f07b3f2b053665cf38c2d6d9de86e1e']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--e49bca1e-fe83-5b30-a93d-e086e16314e3",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--61ccf0fa-c3ea-547f-8db0-f3df120a7524",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--dc348d35-92dd-50b5-b020-0249374f707d",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) sha256 403b624e35777cbc07dbe66398b21bba70396a20b859c880732338ce1dd1f41f",
   "pattern": "[file:hashes.'SHA-256' = '403b624e35777cbc07dbe66398b21bba70396a20b859c880732338ce1dd1f41f']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--8044410a-d084-5978-a5f5-5df2d3cf98cc",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--dc348d35-92dd-50b5-b020-0249374f707d",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--2b64d87e-cebe-53c0-ac46-8f12dae49a93",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) sha256 a06a8fd1b6fa1924199a4540cf16d089217ce8f78c617739946f145fd1fc88c1",
   "pattern": "[file:hashes.'SHA-256' = 'a06a8fd1b6fa1924199a4540cf16d089217ce8f78c617739946f145fd1fc88c1']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--d81901d5-d85d-5693-add2-194b7be0a3cf",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--2b64d87e-cebe-53c0-ac46-8f12dae49a93",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  },
  {
   "type": "indicator",
   "spec_version": "2.1",
   "id": "indicator--c605e7ec-a8ba-57db-8ce5-7491d9d9343e",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "name": "UNC7005 (Google) sha256 5b8d50c2e8cc3038b7c6e6dbf1219f6e814930a1e3c0053143a1191ae67f8ffc",
   "pattern": "[file:hashes.'SHA-256' = '5b8d50c2e8cc3038b7c6e6dbf1219f6e814930a1e3c0053143a1191ae67f8ffc']",
   "pattern_type": "stix",
   "valid_from": "2026-08-21T00:00:00.000Z",
   "indicator_types": [
    "malicious-activity"
   ],
   "description": "",
   "labels": [
    "threadlinqs-extra"
   ],
   "external_references": [
    {
     "source_name": "Threadlinqs",
     "url": "https://threadlinqs.com/blog/anthropic-claude-misuse-sep2026/"
    },
    {
     "source_name": "Threadlinqs",
     "external_id": "TL-2026-2091",
     "url": "https://intel.threadlinqs.com/threat/TL-2026-2091"
    }
   ]
  },
  {
   "type": "relationship",
   "spec_version": "2.1",
   "id": "relationship--09364277-5284-5258-817d-5a34e4cdb944",
   "created": "2026-09-25T20:50:53.000Z",
   "modified": "2026-09-25T20:50:53.000Z",
   "created_by_ref": "identity--377c8bd7-179c-51d7-97dc-9080d57e2ed6",
   "relationship_type": "indicates",
   "source_ref": "indicator--c605e7ec-a8ba-57db-8ce5-7491d9d9343e",
   "target_ref": "intrusion-set--b0eae170-93ba-5dd2-b8b7-f140d1b2a987"
  }
 ]
}