{
  "intelligence": {
    "actors": [],
    "counts": {
      "actors": 0,
      "associated_entity_contexts": 0,
      "deduplicated_iocs": 33,
      "direct_entities": 99,
      "direct_relationships": 151,
      "invalid_iocs": 2,
      "iocs": 33,
      "mentioned": 10,
      "mitre_associated": 0,
      "mitre_direct": 0,
      "targets": 3,
      "techniques": 0,
      "unsupported_indicators": 18,
      "vulnerabilities": 8
    },
    "coverage": {
      "associated_repertoire_is_incident_evidence": false,
      "attribution_policy": "explicit-public-relationships-only",
      "descriptions_publicly_exported": false,
      "excluded_context_objects": 46,
      "excluded_graph_objects": 648,
      "graph_complete": true,
      "graph_objects": 99,
      "graph_relationships": 151,
      "mitre_context_complete": true,
      "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
      "status_as_of": "2026-10-09T23:52:36+00:00",
      "table_preview_limit": 20
    },
    "direct_entities": [
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.094Z",
          "created_at": "2026-09-25T11:28:13.263Z",
          "modified": "2026-09-25T11:29:18.943Z",
          "updated_at": "2026-09-25T11:29:18.943Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "013033b3-7d66-4e8f-bd45-292d18ccb827",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--a4474315-afa7-5343-80d4-842efc7f86f2",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.027Z",
          "created_at": "2026-09-25T11:27:10.445Z",
          "modified": "2026-09-25T11:28:15.891Z",
          "updated_at": "2026-09-25T11:28:15.891Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "030563bd-95e2-4178-a888-2a75f885d47e",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--0f76ad30-f916-5c2b-bc49-a0391a3dd4bd",
        "type": "Indicator"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:00.231Z",
          "updated_at": "2026-09-25T11:26:00.585Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "042a0aa4-f669-42bb-9484-a1caca264589",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--85d0c519-9629-5f1a-9af2-cedcae301c7e",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.046Z",
          "created_at": "2026-09-25T11:27:49.633Z",
          "modified": "2026-09-25T11:28:32.558Z",
          "updated_at": "2026-09-25T11:28:32.558Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "0487a567-5c15-46f1-ac79-9a55cabe1e46",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--dc26805d-fbf9-5738-825a-28f908aef9bc",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.025Z",
          "created_at": "2026-09-25T11:27:10.444Z",
          "modified": "2026-09-25T11:28:12.967Z",
          "updated_at": "2026-09-25T11:28:12.967Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "04c11238-b4ec-4972-a7d6-27acf52a7bdb",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--722c20cf-aabd-5b75-ba63-5f12d921ab95",
        "type": "Indicator"
      },
      {
        "__typename": "Sector",
        "aliases": [
          "Communications",
          "Telecom",
          "Telecommunication",
          "Telecoms"
        ],
        "attributes": {},
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:33.395Z",
          "created_at": "2026-01-18T14:35:13.791Z",
          "modified": "2026-03-01T15:18:16.401Z",
          "updated_at": "2026-03-01T15:18:16.401Z"
        },
        "description_available": true,
        "entity_type": "Sector",
        "id": "08257c10-e1ae-4471-bc3f-251792c1126c",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "Telecommunications",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "identity--4b68fb1a-ff8b-5bef-8d2a-0e477b3ad78e",
        "type": "Sector"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:14.841Z",
          "updated_at": "2026-09-25T11:26:15.366Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "0adf5841-2f73-43df-9cde-db0bab24c415",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "hostname--9604116c-822b-552f-8093-15003d280708",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.085Z",
          "created_at": "2026-09-25T11:28:11.517Z",
          "modified": "2026-09-25T11:29:13.607Z",
          "updated_at": "2026-09-25T11:29:13.607Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "0bd5ecc2-d486-4f52-966b-58518a2ff6c1",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--c02f9cd3-acdf-5487-95cd-43a195acd3c6",
        "type": "Indicator"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:12.165Z",
          "updated_at": "2026-09-25T11:26:12.465Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "0e8efb60-4556-4db5-90c0-021f57d8d269",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "url--0b7df255-766a-5264-aae3-05fb5317c3ad",
        "type": "Url"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 20
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.075Z",
          "created_at": "2026-09-25T11:28:09.928Z",
          "modified": "2026-09-25T11:29:01.386Z",
          "updated_at": "2026-09-25T11:29:01.386Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "0f574f6c-99d0-4113-a3c8-d42c090c5ff6",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": true,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--98183b9f-4aba-59a2-b9be-192cd1e29067",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-02-07T16:05:20.455Z",
          "updated_at": "2026-09-25T11:25:56.884Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "0f68b5b1-564b-4f15-84c9-3e40b4590c9d",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "appleseed",
          "apt",
          "backdoor",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "kimsuky",
          "kisa",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "hostname--45b37e33-ac9b-5962-a42a-be58363cc99e",
        "type": "Hostname"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:10.994Z",
          "updated_at": "2026-09-25T11:26:11.409Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "130ecd19-0fd7-429c-ba5e-0f0062d69898",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "url--9f5df898-0c18-59ce-b3f9-718a2ebf6998",
        "type": "Url"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.000Z",
          "created_at": "2026-09-25T11:26:25.780Z",
          "modified": "2026-09-25T11:27:36.037Z",
          "updated_at": "2026-09-25T11:27:36.037Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "16c395d5-bc9f-440b-9ffd-6bfeef0799bf",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--a8cbd557-8ce1-57a1-8a8c-1e60b10e2577",
        "type": "Indicator"
      },
      {
        "__typename": "IPv4Addr",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:09.006Z",
          "updated_at": "2026-09-25T11:26:12.539Z"
        },
        "description_available": false,
        "entity_type": "IPv4-Addr",
        "id": "1a7685ee-b6f6-4532-a5e7-5e28e1a41e02",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "ipv4-addr--1d760789-b826-57a7-84c9-cefbbeb6cda2",
        "type": "IPv4Addr"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.032Z",
          "created_at": "2026-09-25T11:27:20.455Z",
          "modified": "2026-09-25T11:28:25.406Z",
          "updated_at": "2026-09-25T11:28:25.406Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "1ea86536-3685-4d0b-8beb-78f3c6aba369",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--b7437b6b-66c4-59f1-9442-58b7114a5482",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:13.784Z",
          "updated_at": "2026-09-25T11:26:14.044Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "20528565-fdf0-404f-aace-d90b546fcf3a",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "hostname--b9bcd0d3-44e2-5e6a-a8f8-04925710a815",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.049Z",
          "created_at": "2026-09-25T11:28:01.498Z",
          "modified": "2026-09-25T11:28:35.469Z",
          "updated_at": "2026-09-25T11:28:35.469Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "23121d85-6f9a-45f7-aa0d-ffcbc19df175",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--2c57086d-9084-5802-86c0-813ae08ff5cc",
        "type": "Indicator"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:03.931Z",
          "updated_at": "2026-09-25T11:26:05.692Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "235fb1f3-9cfb-4e55-90f6-6cdcb0ac66f1",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--d2c27ac7-398e-504b-a093-85fd8a35765e",
        "type": "StixFile"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:02.575Z",
          "updated_at": "2026-09-25T11:26:02.771Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "28d269ea-ee81-4290-95bc-b28fac9b157d",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--d306a961-afb3-55b5-899d-74505b936fcf",
        "type": "StixFile"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:08.889Z",
          "updated_at": "2026-09-25T11:26:10.297Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "2e7dcb76-0539-40f2-83d1-e64425a87424",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--5a443308-2ce4-5c4c-87f5-a0ae15f83eda",
        "type": "StixFile"
      },
      {
        "__typename": "Malware",
        "aliases": [
          "php.glutton"
        ],
        "attributes": {
          "is_family": true
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": {
          "authorized_members": [],
          "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a",
          "is_inferred": false,
          "name": "Malpedia",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2026-01-18T18:00:25.641Z",
          "created_at": "2026-01-18T21:12:48.592Z",
          "first_seen": "1970-01-01T00:00:00.000Z",
          "last_seen": "5138-11-16T09:46:40.000Z",
          "modified": "2026-10-07T03:13:59.313Z",
          "updated_at": "2026-10-07T03:13:59.313Z"
        },
        "description_available": true,
        "entity_type": "Malware",
        "id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "Glutton",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": null,
            "id": "03617af2-01d4-49a3-ac85-ee5a25ce94e0",
            "source_name": "malpedia",
            "url": "https://blog.xlab.qianxin.com/glutton_stealthily_targets_mainstream_php_frameworks-en/"
          },
          {
            "external_id": null,
            "id": "343cd139-738f-454a-aec1-470cdb368e94",
            "source_name": "malpedia",
            "url": "https://malpedia.caad.fkie.fraunhofer.de/details/php.glutton"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "malware--f79bc805-7803-5dc0-aaf9-2f5a419438c4",
        "type": "Malware"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:12.564Z",
          "updated_at": "2026-09-25T11:26:12.861Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "304545c7-be38-41d9-8532-e9857b2fb2ab",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "url--dfc5248a-ffbe-5f66-8588-5ccf49e9c12a",
        "type": "Url"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:25:55.476Z",
          "updated_at": "2026-09-25T11:25:56.141Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "3494c909-cd93-4813-a248-91f0623d82c1",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--023f9679-be3d-5880-a245-b7956df61da7",
        "type": "StixFile"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:03.760Z",
          "updated_at": "2026-09-25T11:26:05.449Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "3538cd43-e839-49fe-837b-8b61ac7bec3c",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--9bc6dc05-93ab-5d35-964c-260a2ce0b5eb",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.106Z",
          "created_at": "2026-09-25T11:28:16.275Z",
          "modified": "2026-09-25T11:29:23.305Z",
          "updated_at": "2026-09-25T11:29:23.305Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "40d8f563-a648-4c78-9a7f-c4365c1ffa47",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--c94f71d8-db1b-5f2f-9f4a-a75cf1dab5d4",
        "type": "Indicator"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:07.776Z",
          "updated_at": "2026-09-25T11:26:08.066Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "419df831-4a4f-4e98-a297-bae3a7bb53bb",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--1d207822-acf0-58f8-84e0-646370fc1813",
        "type": "StixFile"
      },
      {
        "__typename": "Vulnerability",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": 80,
        "created_by": null,
        "dates": {
          "created": "2014-09-24T18:48:04.477Z",
          "created_at": "2026-01-18T19:28:51.425Z",
          "modified": "2026-04-23T23:59:11.722Z",
          "updated_at": "2026-04-23T23:59:11.722Z"
        },
        "description_available": true,
        "entity_type": "Vulnerability",
        "id": "44543676-564d-428f-93d4-412969169a8d",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "CVE-2014-6271",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": "CVE-2014-6271",
            "id": "b8ef5b56-7ce3-474e-a066-ec7615a29ad1",
            "source_name": "NIST NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6271"
          },
          {
            "external_id": null,
            "id": "d39f50db-1144-4776-b432-1d90b83f4e7d",
            "source_name": "cve@mitre.org",
            "url": "https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes"
          },
          {
            "external_id": null,
            "id": "9c0ff6eb-c63b-4efd-8b4c-77c8ba2b2753",
            "source_name": "product-security@apple.com",
            "url": "https://support.apple.com/kb/HT6535"
          },
          {
            "external_id": null,
            "id": "ff8dd0dc-297e-4a4a-88aa-5cce6cda9981",
            "source_name": "security@debian.org",
            "url": "https://access.redhat.com/articles/1200223"
          },
          {
            "external_id": null,
            "id": "ff89e005-a17b-4a95-9104-91110b892515",
            "source_name": "security@debian.org",
            "url": "https://access.redhat.com/node/1200223"
          },
          {
            "external_id": null,
            "id": "5b83e619-06fe-401c-b326-ae7ab87cc7bd",
            "source_name": "security@debian.org",
            "url": "https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/"
          },
          {
            "external_id": null,
            "id": "676e1b76-ada7-46c1-ad8d-9fcefd02647d",
            "source_name": "security@debian.org",
            "url": "https://support.citrix.com/article/CTX200217"
          },
          {
            "external_id": null,
            "id": "7df2376f-c9e1-4b64-892e-8be2379b0a13",
            "source_name": "security@debian.org",
            "url": "https://support.citrix.com/article/CTX200223"
          },
          {
            "external_id": null,
            "id": "9defdc90-5d2f-41cc-8d49-2418d1e64a5e",
            "source_name": "security@debian.org",
            "url": "https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html"
          },
          {
            "external_id": null,
            "id": "2436a923-fea3-4985-98bd-862e1a6da250",
            "source_name": "security@debian.org",
            "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/1008-security-advisory-0006"
          },
          {
            "external_id": null,
            "id": "82b48198-23a0-4e99-b91a-2685f2aef5e1",
            "source_name": "security@debian.org",
            "url": "https://www.exploit-db.com/exploits/34879/"
          },
          {
            "external_id": null,
            "id": "1ac31d28-e2cd-4a1b-91b4-c749f344077e",
            "source_name": "security@debian.org",
            "url": "https://www.exploit-db.com/exploits/37816/"
          },
          {
            "external_id": null,
            "id": "29df875c-e3fe-43cd-bb3c-9ab0a4616cac",
            "source_name": "security@debian.org",
            "url": "https://www.exploit-db.com/exploits/38849/"
          },
          {
            "external_id": null,
            "id": "85892fe2-1fd9-4d25-b53e-d4ddfcbc796b",
            "source_name": "security@debian.org",
            "url": "https://www.exploit-db.com/exploits/39918/"
          },
          {
            "external_id": null,
            "id": "dc018648-ce6b-4a4a-a2e5-b2550b71e715",
            "source_name": "security@debian.org",
            "url": "https://www.exploit-db.com/exploits/40619/"
          },
          {
            "external_id": null,
            "id": "f5011d53-b5e0-4f41-ae1b-30b64073d1bd",
            "source_name": "security@debian.org",
            "url": "https://www.exploit-db.com/exploits/40938/"
          },
          {
            "external_id": null,
            "id": "810965ef-8646-4d79-a654-2ddfe21fd16d",
            "source_name": "security@debian.org",
            "url": "https://www.exploit-db.com/exploits/42938/"
          },
          {
            "external_id": null,
            "id": "802debd6-544b-4630-9b42-0b78a7ac8ccb",
            "source_name": "security@debian.org",
            "url": "https://www.suse.com/support/shellshock/"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "vulnerability--e8fb7287-d693-5344-bee9-73fb22feda44",
        "type": "Vulnerability"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:06.392Z",
          "updated_at": "2026-09-25T11:26:06.749Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "44695416-e20e-49ca-bad7-84aeaa41f0b3",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--2ce1ce93-9801-5316-8bda-744270241369",
        "type": "StixFile"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:02.074Z",
          "updated_at": "2026-09-25T11:26:02.301Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "44f63798-0e3c-42b2-9a1f-ea2b5e9d2d2d",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--c44497da-7326-5a53-884b-b38f920b4b26",
        "type": "StixFile"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:03.049Z",
          "updated_at": "2026-09-25T11:26:03.279Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "4555c7d4-fc02-4904-8e9b-c1416a5a1273",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--516b3d7f-9ffd-57e1-9642-30fa878cd450",
        "type": "StixFile"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:03.300Z",
          "updated_at": "2026-09-25T11:26:03.599Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "46756e4f-2682-4d50-ac50-98f618fd4f39",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--924deacc-6d6e-5072-9587-37775a0e2ca5",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.992Z",
          "created_at": "2026-09-25T11:26:15.941Z",
          "modified": "2026-09-25T11:26:35.139Z",
          "updated_at": "2026-09-25T11:26:35.139Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "4ac1f979-42e9-4928-a7be-ea9f98bbc29e",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--8706081f-6d40-5a51-bacd-2d44e4408439",
        "type": "Indicator"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:05.899Z",
          "updated_at": "2026-09-25T11:26:06.307Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "4fa47aea-54e6-4343-8a8d-69135f159209",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--31c24399-dffd-5e30-b9bb-8a619ee1cee3",
        "type": "StixFile"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:08.670Z",
          "updated_at": "2026-09-25T11:26:08.905Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "50da2c1c-5373-496f-a499-8f02bd56e2ad",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--786846f2-0703-5b52-8737-7fc34bb528ea",
        "type": "StixFile"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:14.333Z",
          "updated_at": "2026-09-25T11:26:14.553Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "5271b9cb-5f30-4fb8-8149-096a0a405c2d",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "hostname--174428a7-90bc-56e8-a1ec-e5ac19f2f7ac",
        "type": "Hostname"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:25:57.348Z",
          "updated_at": "2026-09-25T11:25:59.749Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "531975f1-adc0-498d-ac0e-51c91ec0eac4",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--e5aef32b-a3c7-5bf5-8a0c-e0aeb7884833",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.103Z",
          "created_at": "2026-09-25T11:28:16.269Z",
          "modified": "2026-09-25T11:29:21.515Z",
          "updated_at": "2026-09-25T11:29:21.515Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "55582c90-ef77-43d4-81d9-244d1a5b1df7",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--4a55dc71-136a-57f6-8f4f-7a540df3955a",
        "type": "Indicator"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:11.610Z",
          "updated_at": "2026-09-25T11:26:11.775Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "637f2235-e7ea-45a7-9279-87a183b6dd80",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "url--a62f2991-e724-5889-91da-e4cf0882c7e4",
        "type": "Url"
      },
      {
        "__typename": "Vulnerability",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.907Z",
          "created_at": "2026-09-25T11:25:54.245Z",
          "modified": "2026-09-25T11:25:56.323Z",
          "updated_at": "2026-09-25T11:25:56.323Z"
        },
        "description_available": false,
        "entity_type": "Vulnerability",
        "id": "647f8a4a-1a25-456b-b2ab-f1675d2014e1",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "CVE-2024-4956",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": "CVE-2024-4956",
            "id": "9f901e71-7866-4593-a768-7b9788dc31a7",
            "source_name": "NIST NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4956"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "vulnerability--29b3d14e-3b4c-5d94-ab32-6934a9d66908",
        "type": "Vulnerability"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:25:57.231Z",
          "updated_at": "2026-09-25T11:25:59.720Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "65402ba6-da16-4a00-a0fe-9712ee7b5208",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--b9512454-5974-5f13-b4ee-c6751fe7b77c",
        "type": "StixFile"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:03.046Z",
          "updated_at": "2026-09-25T11:26:03.253Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "65c55cc2-d509-4e22-9849-30459e79fb87",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--4f9dd108-2610-518f-895c-fb8e668e1899",
        "type": "StixFile"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:14.640Z",
          "updated_at": "2026-09-25T11:26:14.974Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "671b7d39-055d-4a8e-a1d4-7439eef60a8e",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "hostname--ee6f29b5-13f4-50ca-8bfa-887e678935a5",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.035Z",
          "created_at": "2026-09-25T11:27:20.455Z",
          "modified": "2026-09-25T11:28:23.269Z",
          "updated_at": "2026-09-25T11:28:23.269Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "67291409-fb44-4cf3-b06f-f3a440a134cb",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--f8187a99-b781-5b16-b64e-2e7f1dd6f897",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.995Z",
          "created_at": "2026-09-25T11:26:16.197Z",
          "modified": "2026-09-25T11:26:57.814Z",
          "updated_at": "2026-09-25T11:26:57.814Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "6886e013-939f-4410-9dc1-cc1f81de1964",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--686938c7-f339-5201-b3d6-304234ab9b30",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "IPv4-Addr",
          "x_opencti_score": 20
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.062Z",
          "created_at": "2026-09-25T11:28:05.101Z",
          "modified": "2026-09-25T11:28:50.174Z",
          "updated_at": "2026-09-25T11:28:50.174Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "6e99d3f0-8adc-4bcd-845f-8a5116482e69",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": true,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--a219eee9-17dc-51ff-a981-be68d3be564f",
        "type": "Indicator"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:11.699Z",
          "updated_at": "2026-09-25T11:26:11.945Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "729ae26c-7838-4385-89c3-d6f6c1dc2547",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "url--dc3ed2d6-596a-5cdb-a7db-937d5af0835c",
        "type": "Url"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:00.242Z",
          "updated_at": "2026-09-25T11:26:00.587Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "740c6048-9b47-4a64-b58c-098f97e39392",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--ca92efdf-0780-5c60-a1eb-f35d1211c02a",
        "type": "StixFile"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:25:55.188Z",
          "updated_at": "2026-09-25T11:25:55.714Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "7505178f-5612-4e63-8e8a-a1c4258086c5",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--496ea57a-e58f-5dc0-bdc5-8e122f07e1de",
        "type": "StixFile"
      },
      {
        "__typename": "Vulnerability",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": 80,
        "created_by": null,
        "dates": {
          "created": "2016-06-07T14:06:13.247Z",
          "created_at": "2026-01-18T19:37:11.067Z",
          "modified": "2026-09-25T11:25:53.879Z",
          "updated_at": "2026-09-25T11:25:53.879Z"
        },
        "description_available": true,
        "entity_type": "Vulnerability",
        "id": "752a1bdd-3da2-4925-829b-63ddd793e841",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "CVE-2016-4437",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": "CVE-2016-4437",
            "id": "c0ed1b6d-1ec5-40b3-8ac7-fb8da5499b96",
            "source_name": "NIST NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4437"
          },
          {
            "external_id": null,
            "id": "beeec545-6afa-4d8b-b8cc-a00476d70438",
            "source_name": "secalert@redhat.com",
            "url": "https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "vulnerability--3fd83578-1643-5c7f-abab-37dcee4d43cb",
        "type": "Vulnerability"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 20
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.077Z",
          "created_at": "2026-09-25T11:28:10.431Z",
          "modified": "2026-09-25T11:29:06.751Z",
          "updated_at": "2026-09-25T11:29:06.751Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "78df0f58-436e-4889-90d8-1c2685bb68ae",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": true,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--3553ef01-9da9-51cf-87ef-d502acd241f1",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 20
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.082Z",
          "created_at": "2026-09-25T11:28:11.370Z",
          "modified": "2026-09-25T11:29:10.012Z",
          "updated_at": "2026-09-25T11:29:10.012Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "7a4b611c-7cb7-43b5-b257-5114cb6aef9f",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": true,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--7bc0bec4-888d-5c8f-acff-10fec47339da",
        "type": "Indicator"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:06.594Z",
          "updated_at": "2026-09-25T11:26:06.943Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "7bd77322-0405-4d8c-966d-c1e948645afd",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--bf327a8c-5388-5eca-86ad-1c4cba417983",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.038Z",
          "created_at": "2026-09-25T11:27:37.764Z",
          "modified": "2026-09-25T11:28:27.336Z",
          "updated_at": "2026-09-25T11:28:27.336Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "80d53d58-6a2c-4dfa-9e8d-542acc144bc8",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--99faab40-5d87-573a-a222-c40f930e6f66",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.003Z",
          "created_at": "2026-09-25T11:26:25.779Z",
          "modified": "2026-09-25T11:27:22.466Z",
          "updated_at": "2026-09-25T11:27:22.466Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "813df622-c624-4d52-80db-5e35fb4cb1b9",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--ec5479b6-850d-5971-9e20-da49ecf8cd7a",
        "type": "Indicator"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:10.801Z",
          "updated_at": "2026-09-25T11:26:11.089Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "82627cc4-7405-4c4b-9907-72204c8358a8",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "url--4291997c-7129-577b-a874-76c0c207a03a",
        "type": "Url"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.008Z",
          "created_at": "2026-09-25T11:26:35.222Z",
          "modified": "2026-09-25T11:28:02.665Z",
          "updated_at": "2026-09-25T11:28:02.665Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "86440ebf-51f9-4c87-be4d-dae12ee7c2e1",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--1dd6ad15-d18b-5a25-b4e5-a4497b285d3c",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 20
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.080Z",
          "created_at": "2026-09-25T11:28:10.426Z",
          "modified": "2026-09-25T11:29:05.019Z",
          "updated_at": "2026-09-25T11:29:05.019Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "8652a66a-1bbb-4aeb-96b0-00dddbcba7d3",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": true,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--fbd5c4bf-cfd6-5a68-9362-1949f5048731",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-01-19T16:27:14.405Z",
          "created_at": "2026-02-07T16:06:49.459Z",
          "modified": "2026-09-25T11:26:15.961Z",
          "updated_at": "2026-09-25T11:26:15.961Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "89f87c30-38eb-490d-bf32-0ba45a62701f",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "appleseed",
          "apt",
          "backdoor",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "kimsuky",
          "kisa",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--2f0ef215-6cef-53f3-8ab5-91a29fe64cca",
        "type": "Indicator"
      },
      {
        "__typename": "Sector",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:33.388Z",
          "created_at": "2026-01-18T14:35:02.955Z",
          "modified": "2026-01-20T20:57:28.767Z",
          "updated_at": "2026-01-20T20:57:28.767Z"
        },
        "description_available": true,
        "entity_type": "Sector",
        "id": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "Education",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "identity--2b0657c7-cf11-5d30-8867-4c6d9dd99270",
        "type": "Sector"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:02.064Z",
          "updated_at": "2026-09-25T11:26:02.300Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "8d3e9ce5-2c6f-4e7a-a23c-f76b1b5eb578",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--b67f4b84-1e34-56af-a685-40bf998f0672",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.052Z",
          "created_at": "2026-09-25T11:28:01.511Z",
          "modified": "2026-09-25T11:28:39.418Z",
          "updated_at": "2026-09-25T11:28:39.418Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "8eea5d36-230b-478b-858d-59f6f4a55c3b",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--53c7797e-d429-547a-8819-95b38b58cb00",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 20
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.064Z",
          "created_at": "2026-09-25T11:28:05.436Z",
          "modified": "2026-09-25T11:28:47.224Z",
          "updated_at": "2026-09-25T11:28:47.224Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "8fda0fcb-ae48-43fd-948d-652290dc22a5",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": true,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--818201b3-ce03-55ce-8216-b55df04fa4ff",
        "type": "Indicator"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:25:57.560Z",
          "updated_at": "2026-09-25T11:25:59.750Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "915aff68-0fa0-4907-b057-c12ef2573cb6",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--d73da31e-2811-5a36-bd2f-2c39c246f561",
        "type": "StixFile"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:12.809Z",
          "updated_at": "2026-09-25T11:26:13.051Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "925d70fe-819e-4dc4-bf85-c683b795d9ef",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "hostname--2341e918-fd0c-5b24-832e-35247f4fcd1f",
        "type": "Hostname"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:00.136Z",
          "updated_at": "2026-09-25T11:26:00.408Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "942e517e-5ef8-4a4f-9a8e-2721d9f40e68",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--61009b7f-bbcb-5237-b68a-47d7d4363da3",
        "type": "StixFile"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:11.907Z",
          "updated_at": "2026-09-25T11:26:12.128Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "94563d94-7c0e-43b9-8698-4cfda56fd47a",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "url--4c88a1ce-0540-57dd-b6d3-319bb3ecbc95",
        "type": "Url"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 20
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.067Z",
          "created_at": "2026-09-25T11:28:07.256Z",
          "modified": "2026-09-25T11:28:52.551Z",
          "updated_at": "2026-09-25T11:28:52.551Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "98a9f866-a8f3-4067-8b17-38825d31b5b0",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": true,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--18f16c55-59f8-5a92-8333-ba1551252b05",
        "type": "Indicator"
      },
      {
        "__typename": "Vulnerability",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-08-08T12:18:40.515Z",
          "created_at": "2026-08-08T12:19:45.742Z",
          "modified": "2026-08-08T12:20:25.387Z",
          "updated_at": "2026-08-08T12:20:25.387Z"
        },
        "description_available": false,
        "entity_type": "Vulnerability",
        "id": "98d3b7c9-4b06-44f1-8b1d-5c459f95abb7",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "CVE-2021-29441",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": "CVE-2021-29441",
            "id": "1643a451-2a35-48c4-b412-d9f55f02dd74",
            "source_name": "NIST NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29441"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "vulnerability--d0300638-0df9-59e6-b2d3-e5e31f96279f",
        "type": "Vulnerability"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.017Z",
          "created_at": "2026-09-25T11:26:57.957Z",
          "modified": "2026-09-25T11:28:07.589Z",
          "updated_at": "2026-09-25T11:28:07.589Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "99bbc016-0fcb-4a55-aa06-e4103f4b66a4",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--03e0cbde-6c88-5fda-9dd3-33b21c21db88",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.044Z",
          "created_at": "2026-09-25T11:27:44.723Z",
          "modified": "2026-09-25T11:28:30.189Z",
          "updated_at": "2026-09-25T11:28:30.189Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "99c10a57-16a9-47ef-95dd-5d9e568b6fdd",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--aec99bf3-27a7-57d7-8582-9e67b5bec6b9",
        "type": "Indicator"
      },
      {
        "__typename": "Malware",
        "aliases": [],
        "attributes": {
          "is_family": false
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.866Z",
          "created_at": "2026-09-25T11:25:50.180Z",
          "first_seen": "1970-01-01T00:00:00.000Z",
          "last_seen": "5138-11-16T09:46:40.000Z",
          "modified": "2026-09-25T11:25:51.097Z",
          "updated_at": "2026-09-25T11:25:51.097Z"
        },
        "description_available": false,
        "entity_type": "Malware",
        "id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "SecBox",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "malware--c0444b7d-f077-5b16-a0ef-27c4fd5b7f73",
        "type": "Malware"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.014Z",
          "created_at": "2026-09-25T11:26:57.945Z",
          "modified": "2026-09-25T11:28:09.866Z",
          "updated_at": "2026-09-25T11:28:09.866Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "9c4691bb-a528-4946-93a4-a57229725d5d",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--1b3432d2-8a6f-5f2b-aed1-72ef87b2eecb",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:13.321Z",
          "updated_at": "2026-09-25T11:26:13.600Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "9e4d5da0-bc7d-4267-800e-7bdccbf6ae69",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "hostname--f286e27a-47c4-59fa-8258-75189fd2c5d6",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.019Z",
          "created_at": "2026-09-25T11:26:57.945Z",
          "modified": "2026-09-25T11:28:11.477Z",
          "updated_at": "2026-09-25T11:28:11.477Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "9e65265b-6197-486f-b057-ee5af4142031",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--e8b8df9b-d2d9-514e-9ae5-d415193ade83",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:12.945Z",
          "updated_at": "2026-09-25T11:26:13.249Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "a7b202db-a12c-446b-b6cd-c3cf1a192cd0",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "hostname--f738269d-45bb-5860-b139-5a0d082fd9ad",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.055Z",
          "created_at": "2026-09-25T11:28:03.235Z",
          "modified": "2026-09-25T11:28:42.217Z",
          "updated_at": "2026-09-25T11:28:42.217Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "ac5b7942-fed5-4b20-8a97-bd9787a47e89",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--09343f1f-8901-5a3c-9823-b24fb8d0e686",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.100Z",
          "created_at": "2026-09-25T11:28:16.269Z",
          "modified": "2026-09-25T11:29:26.192Z",
          "updated_at": "2026-09-25T11:29:26.192Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "ace41c62-607c-4359-9b07-c9da5a8c0e0a",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--dbb91871-a2d4-54fc-ac84-e38f90cf06e6",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.022Z",
          "created_at": "2026-09-25T11:27:10.438Z",
          "modified": "2026-09-25T11:28:17.804Z",
          "updated_at": "2026-09-25T11:28:17.804Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "b1da6e8a-6e08-41f1-913b-7b932284fca0",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--58ad877d-a664-5f6c-8a32-746006992267",
        "type": "Indicator"
      },
      {
        "__typename": "Hostname",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:14.019Z",
          "updated_at": "2026-09-25T11:26:14.240Z"
        },
        "description_available": false,
        "entity_type": "Hostname",
        "id": "ba9578cb-357d-424a-8018-4a8a8fb727bf",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "hostname--abdad571-4678-571b-9ce0-48804e9dd567",
        "type": "Hostname"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.041Z",
          "created_at": "2026-09-25T11:27:44.716Z",
          "modified": "2026-09-25T11:28:28.352Z",
          "updated_at": "2026-09-25T11:28:28.352Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "be82d031-8282-4109-92bc-98f208b855e5",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--0c54762a-6da2-57a2-bb71-28b18228cca3",
        "type": "Indicator"
      },
      {
        "__typename": "Vulnerability",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": 80,
        "created_by": null,
        "dates": {
          "created": "2025-10-09T00:00:00.000Z",
          "created_at": "2026-01-18T17:38:34.122Z",
          "modified": "2026-02-13T08:06:50.588Z",
          "updated_at": "2026-02-13T08:06:50.588Z"
        },
        "description_available": true,
        "entity_type": "Vulnerability",
        "id": "cfa8b53b-4289-4e4d-b499-82ccb28f496e",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "CVE-2021-43798",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": "CVE-2021-43798",
            "id": "2382c8e2-1a3d-467f-aff9-46d1a5df4d4d",
            "source_name": "NIST NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43798"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "vulnerability--4ad13adb-8db1-5056-bfe5-1836d650d9ae",
        "type": "Vulnerability"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.030Z",
          "created_at": "2026-09-25T11:27:20.447Z",
          "modified": "2026-09-25T11:28:21.384Z",
          "updated_at": "2026-09-25T11:28:21.384Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "d127fb55-e610-4fc7-bbf9-f6ebf159de49",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--880df231-4064-5c76-b689-607a19b79c3f",
        "type": "Indicator"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:08.027Z",
          "updated_at": "2026-09-25T11:26:08.311Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "d9b5409e-5a97-485c-929e-0a7a7350cf52",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--304db617-8e3b-5288-bbb0-79c33b8d86c5",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.088Z",
          "created_at": "2026-09-25T11:28:11.611Z",
          "modified": "2026-09-25T11:29:12.288Z",
          "updated_at": "2026-09-25T11:29:12.288Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "db29312e-6d9d-4932-8850-bffeda8b932b",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--1711f75d-1024-564a-9914-4a2ec0b8e86b",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.058Z",
          "created_at": "2026-09-25T11:28:04.778Z",
          "modified": "2026-09-25T11:28:45.750Z",
          "updated_at": "2026-09-25T11:28:45.750Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "db984156-b205-4da0-805a-43a90b53458d",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--567ac89a-ffa0-5456-b5a0-8bf3ef5843ef",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.091Z",
          "created_at": "2026-09-25T11:28:13.056Z",
          "modified": "2026-09-25T11:29:15.769Z",
          "updated_at": "2026-09-25T11:29:15.769Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "ddb31a53-2e5a-4074-87e5-437ff450d235",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--70254951-f9b8-51dd-a04d-891755e10567",
        "type": "Indicator"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:01.827Z",
          "updated_at": "2026-09-25T11:26:02.024Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "ddc7e2c9-1e50-4c61-aa65-e897de0377dc",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--b0fdc9e6-230f-52b8-b539-01c086a26493",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 20
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.070Z",
          "created_at": "2026-09-25T11:28:07.809Z",
          "modified": "2026-09-25T11:28:54.730Z",
          "updated_at": "2026-09-25T11:28:54.730Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "df99b492-86ae-4152-a08e-0bb6bdd7a458",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": true,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--b62e8aaa-72e8-5a5c-b431-8223acc80aee",
        "type": "Indicator"
      },
      {
        "__typename": "Sector",
        "aliases": [
          "Election",
          "Government",
          "Voting"
        ],
        "attributes": {},
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:33.392Z",
          "created_at": "2026-01-18T14:35:09.055Z",
          "modified": "2026-01-22T08:00:46.641Z",
          "updated_at": "2026-01-22T08:00:46.641Z"
        },
        "description_available": true,
        "entity_type": "Sector",
        "id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "Government and administrations",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "identity--9d697b63-6ae0-5ddb-ae26-e3d6e03302e1",
        "type": "Sector"
      },
      {
        "__typename": "Vulnerability",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": 80,
        "created_by": null,
        "dates": {
          "created": "2022-04-04T00:00:00.000Z",
          "created_at": "2026-01-18T19:02:25.156Z",
          "modified": "2026-02-15T14:19:22.918Z",
          "updated_at": "2026-02-15T14:19:22.918Z"
        },
        "description_available": true,
        "entity_type": "Vulnerability",
        "id": "e6a2db30-d198-49d9-8ba2-9d861062bf46",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "CVE-2022-22965",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": "CVE-2022-22965",
            "id": "56faeab1-0197-4940-9a49-2432af2cfb3f",
            "source_name": "NIST NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22965"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "vulnerability--6b22f13c-4df8-59ac-a510-f72ecb2b8169",
        "type": "Vulnerability"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.005Z",
          "created_at": "2026-09-25T11:26:33.426Z",
          "modified": "2026-09-25T11:28:05.197Z",
          "updated_at": "2026-09-25T11:28:05.197Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "e710f05a-d70b-49f6-8a6a-64855677b7c1",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--8079daca-5e86-5a32-a30b-299a16e35839",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.997Z",
          "created_at": "2026-09-25T11:26:17.856Z",
          "modified": "2026-09-25T11:27:08.591Z",
          "updated_at": "2026-09-25T11:27:08.591Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "e7b61757-a84d-4be3-aed4-c249b08d198c",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--b5da954c-2121-5234-aed9-2969519c1874",
        "type": "Indicator"
      },
      {
        "__typename": "Vulnerability",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": 80,
        "created_by": null,
        "dates": {
          "created": "2020-02-24T22:15:12.057Z",
          "created_at": "2026-01-18T19:18:07.328Z",
          "modified": "2026-09-25T11:25:53.489Z",
          "updated_at": "2026-09-25T11:25:53.489Z"
        },
        "description_available": true,
        "entity_type": "Vulnerability",
        "id": "ea11a4cc-e594-4e18-b6c3-c9138cebabf3",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "CVE-2020-1938",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": "CVE-2020-1938",
            "id": "6df40249-724e-49b6-92ff-394b57c485e8",
            "source_name": "NIST NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1938"
          },
          {
            "external_id": null,
            "id": "6223a085-4c2f-4363-8582-26211cc3f342",
            "source_name": "cve@mitre.org",
            "url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "e32c4228-fbb5-4c18-bf6d-f27b35af68fc",
            "source_name": "security-advisories@github.com",
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "external_id": null,
            "id": "18023ad6-47eb-49ea-b893-01cd6220a751",
            "source_name": "security-advisories@github.com",
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "external_id": null,
            "id": "583c9213-dd51-4e97-ab5d-319a4d1d97bc",
            "source_name": "security-advisories@github.com",
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          },
          {
            "external_id": null,
            "id": "3ea7b62f-de30-4d06-baf9-fe721f194948",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r089dc67c0358a1556dd279c762c74f32d7a254a54836b7ee2d839d8e%40%3Cdev.tomee.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "4d724591-3ec4-4df6-95d6-9c30df289011",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "2914778e-94ad-4817-acde-0bebd0d8b4b7",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "bb08944b-8b47-4ee4-bf87-f3ae01aaac3a",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "c15d1eb2-0f3d-4de3-9bf4-0e881c5243cc",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r43faacf64570b1d9a4bada407a5af3b2738b0c007b905f1b6b608c65%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "6a93b1ac-3bea-44a8-87c1-104f5f10038d",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r47caef01f663106c2bb81d116b8380d62beac9e543dd3f3bc2c2beda%40%3Ccommits.tomee.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "02538fc1-d032-4e5e-bc92-ed4b89327afe",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r4afa11e0464408e68f0e9560e90b185749363a66398b1491254f7864%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "77a1e52d-ff52-488f-8236-0f6a5cde912c",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r4f86cb260196e5cfcbbe782822c225ddcc70f54560f14a8f11c6926f%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "30311c4c-11cb-406a-80de-e6f2ccf45652",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r549b43509e387a42656f0641fa311bf27c127c244fe02007d5b8d6f6%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "97ada46f-1f96-4b49-b199-a029cd69586c",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r57f5e4ced436ace518a9e222fabe27fb785f09f5bf974814cc48ca97%40%3Ccommits.tomee.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "97e0ecd8-88cd-4df7-b077-a343eff2be4a",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r5e2f1201b92ee05a0527cfc076a81ea0c270be299b87895c0ddbe02b%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "d354f0f6-a862-45ad-bf2e-b1771c76ef65",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r61f280a76902b594692f0b24a1dbf647bb5a4c197b9395e9a6796e7c%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "a997afc6-b863-42f9-bb2f-4883ed0efa51",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r6a5633cad1b560a1e51f5b425f02918bdf30e090fdf18c5f7c2617eb%40%3Ccommits.tomee.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "2abab703-7a16-460a-be47-1689d8c655a1",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r74328b178f9f37fe759dffbc9c1f2793e66d79d7a8a20d3836551794%40%3Cnotifications.ofbiz.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "b1ab2b06-1eb9-44de-bcdd-6b454ea7fdca",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r75113652e46c4dee687236510649acfb70d2c63e074152049c3f399d%40%3Cnotifications.ofbiz.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "bbe19dda-a802-49ea-bd2a-017460a88ca8",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r772335e6851ad33ddb076218fa4ff70de1bf398d5b43e2ddf0130e5d%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "37e9bd09-852f-49a6-afdf-e03087306be2",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r7c6f492fbd39af34a68681dbbba0468490ff1a97a1bd79c6a53610ef%40%3Cannounce.tomcat.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "ac8368bd-9a1e-4ea6-a235-c770e341a575",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r856cdd87eda7af40b50278d6de80ee4b42d63adeb433a34a7bdaf9db%40%3Cnotifications.ofbiz.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "0c2a1cfe-b7bf-42a2-a52d-b80a488611f4",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "e955e18b-61d0-4dba-a8f2-e7325ecf9480",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "c78b87d3-8d33-4bc7-8028-a58284ce663d",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r92d78655c068d0bc991d1edbdfb24f9c5134603e647cade1113d4e0a%40%3Cusers.tomee.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "137df562-04fa-4c02-b7ad-91e38d76a9b4",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/r9f119d9ce9239114022e13dbfe385b3de7c972f24f05d6dbd35c1a2f%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "73ef1cbb-b6f9-46d5-a3a2-5582d0a45773",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "b6610d1a-bdde-42c4-8988-4bde322d5896",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rad36ec6a1ffc9e43266b030c22ceeea569243555d34fb4187ff08522%40%3Cnotifications.ofbiz.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "843076a8-d927-4350-b0f7-f0466c688551",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "09d7411a-9380-4977-bef3-f273950abb74",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rb2fc890bef23cbc7f343900005fe1edd3b091cf18dada455580258f9%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "d34fe512-6464-47d1-af3e-2675a630d336",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rbdb1d2b651a3728f0ceba9e0853575b6f90296a94a71836a15f7364a%40%3Cdev.tomee.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "a0155285-0c3a-4efb-9c02-abb124b40e08",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2%40%3Cdev.tomee.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "ec9dc146-2980-4b06-8c5e-33bcdd924434",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rcd5cd301e9e7e39f939baf2f5d58704750be07a5e2d3393e40ca7194%40%3Ccommits.tomee.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "54607f22-8647-4a8f-91ed-9b9161e493c9",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rce2af55f6e144ffcdc025f997eddceb315dfbc0b230e3d750a7f7425%40%3Cnotifications.ofbiz.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "1bfe4365-0a0d-4b20-b8f0-2e1548a79fef",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rd0774c95699d5aeb5e16e9a600fb2ea296e81175e30a62094e27e3e7%40%3Ccommits.ofbiz.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "04d2f918-1b11-4f85-81c3-92baaa491cd0",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "01ed4945-5a58-4455-80ad-7234618f1d25",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/re5eecbe5bf967439bafeeaa85987b3a43f0e6efe06b6976ee768cde2%40%3Cusers.tomcat.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "cdcaf501-f60f-41e4-8e5d-a9641c401ee1",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rf26663f42e7f1a1d1cac732469fb5e92c89908a48b61ec546dbb79ca%40%3Cbugs.httpd.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "5d33ed7c-32af-44d7-83cb-d2364234176a",
            "source_name": "security@apache.org",
            "url": "https://lists.apache.org/thread.html/rf992c5adf376294af31378a70aa8a158388a41d7039668821be28df3%40%3Ccommits.tomee.apache.org%3E"
          },
          {
            "external_id": null,
            "id": "4c3add2a-e093-40ab-8e8b-2a8f0f9b0325",
            "source_name": "security@apache.org",
            "url": "https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html"
          },
          {
            "external_id": null,
            "id": "93094bc2-d7c6-4076-b44b-eaf2d6c68a16",
            "source_name": "security@apache.org",
            "url": "https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html"
          },
          {
            "external_id": null,
            "id": "c6508a83-96de-4b7b-b9b9-9dc1b673f975",
            "source_name": "security@apache.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XFLQB3O5QVP4ZBIPVIXBEZV7F2R7ZMS/"
          },
          {
            "external_id": null,
            "id": "e2273a8b-b62c-4134-a5e6-27cb69194cf2",
            "source_name": "security@apache.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3IPNHCKFVUKSHDTM45UL4Q765EHHTFG/"
          },
          {
            "external_id": null,
            "id": "857fd7c7-ce56-4019-97b3-b0d20beccbf2",
            "source_name": "security@apache.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L46WJIV6UV3FWA5O5YEY6XLA73RYD53B/"
          },
          {
            "external_id": null,
            "id": "972762a8-4f99-4682-b487-025fac9097d6",
            "source_name": "security@apache.org",
            "url": "https://security.gentoo.org/glsa/202003-43"
          },
          {
            "external_id": null,
            "id": "1fa7c406-4a12-49b7-8843-3d9f8f580577",
            "source_name": "security@apache.org",
            "url": "https://security.netapp.com/advisory/ntap-20200226-0002/"
          },
          {
            "external_id": null,
            "id": "29fab62f-fd24-4538-b311-a5f2356abda9",
            "source_name": "security@apache.org",
            "url": "https://www.debian.org/security/2020/dsa-4673"
          },
          {
            "external_id": null,
            "id": "7b6b5a89-eeca-4d84-8d20-8704a629fa4f",
            "source_name": "security@apache.org",
            "url": "https://www.debian.org/security/2020/dsa-4680"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "vulnerability--2dfca9c4-ae87-5287-aea9-de8d8d72e370",
        "type": "Vulnerability"
      },
      {
        "__typename": "Vulnerability",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": 80,
        "created_by": null,
        "dates": {
          "created": "2021-12-10T00:00:00.000Z",
          "created_at": "2026-01-18T19:35:03.957Z",
          "modified": "2026-08-12T22:31:00.356Z",
          "updated_at": "2026-08-12T22:31:00.356Z"
        },
        "description_available": true,
        "entity_type": "Vulnerability",
        "id": "ebcc7e47-61c4-43a6-8605-4a202598eada",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "CVE-2021-44228",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": "CVE-2021-44228",
            "id": "ca11d515-c6dc-4a98-abae-21c4ded3f4ea",
            "source_name": "NIST NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228"
          },
          {
            "external_id": null,
            "id": "666972fb-6e28-476c-8f5f-3623270b77c0",
            "source_name": "security@apache.org",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf"
          },
          {
            "external_id": null,
            "id": "7d60680b-eef0-46c9-81f4-35d0ea3368fa",
            "source_name": "security@apache.org",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf"
          },
          {
            "external_id": null,
            "id": "fb856808-7922-4a10-a7e5-475f1afd9762",
            "source_name": "security@apache.org",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf"
          },
          {
            "external_id": null,
            "id": "08b0643c-1755-40f3-be3a-610159a93627",
            "source_name": "security@apache.org",
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf"
          },
          {
            "external_id": null,
            "id": "0a9e7a7c-a444-43ef-9a7e-b3022c1115ec",
            "source_name": "security@apache.org",
            "url": "https://github.com/cisagov/log4j-affected-db"
          },
          {
            "external_id": null,
            "id": "e422e1ed-4fb4-482e-b1fc-9cfd641bb24c",
            "source_name": "security@apache.org",
            "url": "https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md"
          },
          {
            "external_id": null,
            "id": "0a074988-5670-4859-832d-d78bc1089af8",
            "source_name": "security@apache.org",
            "url": "https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228"
          },
          {
            "external_id": null,
            "id": "06164eff-52d3-40b0-b5b5-2a91e3482fba",
            "source_name": "security@apache.org",
            "url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00007.html"
          },
          {
            "external_id": null,
            "id": "3181acbd-f583-4bca-98e7-33c00dc54154",
            "source_name": "security@apache.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/"
          },
          {
            "external_id": null,
            "id": "ff86c5d1-7ae6-4a35-87e0-2bffd6f29f89",
            "source_name": "security@apache.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/"
          },
          {
            "external_id": null,
            "id": "44185285-3967-46ca-8970-ef35936a7463",
            "source_name": "security@apache.org",
            "url": "https://logging.apache.org/log4j/2.x/security.html"
          },
          {
            "external_id": null,
            "id": "83499c57-d8fb-414d-8899-6f3d243cf4ea",
            "source_name": "security@apache.org",
            "url": "https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/"
          },
          {
            "external_id": null,
            "id": "948bde9b-8596-42c0-bb26-604e2e0b0f8f",
            "source_name": "security@apache.org",
            "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032"
          },
          {
            "external_id": null,
            "id": "4c0b5761-c6e6-43ee-b5f1-aa7736564dbb",
            "source_name": "security@apache.org",
            "url": "https://security.netapp.com/advisory/ntap-20211210-0007/"
          },
          {
            "external_id": null,
            "id": "3fc08955-b7b5-4e72-b3ef-cc2612a858cc",
            "source_name": "security@apache.org",
            "url": "https://support.apple.com/kb/HT213189"
          },
          {
            "external_id": null,
            "id": "58b961f9-8311-4b15-824f-ee1cc90f1ebf",
            "source_name": "security@apache.org",
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd"
          },
          {
            "external_id": null,
            "id": "6ae4d434-cf47-45a9-a8fc-e70f5389b693",
            "source_name": "security@apache.org",
            "url": "https://twitter.com/kurtseifried/status/1469345530182455296"
          },
          {
            "external_id": null,
            "id": "f54f70f9-a065-421f-b8ad-24163aea8d86",
            "source_name": "security@apache.org",
            "url": "https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001"
          },
          {
            "external_id": null,
            "id": "0a768b90-16f7-4d9f-b782-3905beae4ffc",
            "source_name": "security@apache.org",
            "url": "https://www.debian.org/security/2021/dsa-5020"
          },
          {
            "external_id": null,
            "id": "f60458d0-b697-4100-8c97-1f49934346f4",
            "source_name": "security@apache.org",
            "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html"
          },
          {
            "external_id": null,
            "id": "0f162f53-4b5d-4c87-986f-41ecca1d77ef",
            "source_name": "security@apache.org",
            "url": "https://www.kb.cert.org/vuls/id/930724"
          },
          {
            "external_id": null,
            "id": "6d45a63a-e70a-4601-b8d6-6edc22dc2c47",
            "source_name": "security@apache.org",
            "url": "https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html"
          },
          {
            "external_id": null,
            "id": "c21a24ac-cbd9-4d6f-b68f-aa38c62a8e15",
            "source_name": "security@apache.org",
            "url": "https://www.oracle.com/security-alerts/alert-cve-2021-44228.html"
          },
          {
            "external_id": null,
            "id": "46250a2e-0bd4-43e5-942c-ca19a15f33a2",
            "source_name": "security@apache.org",
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "external_id": null,
            "id": "35e2c245-faf4-453b-813c-3f77e49c80ae",
            "source_name": "security@apache.org",
            "url": "https://www.oracle.com/security-alerts/cpujan2022.html"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "vulnerability--693c68fd-9a33-5d6d-b44e-407b6a48b05b",
        "type": "Vulnerability"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:07.096Z",
          "updated_at": "2026-09-25T11:26:07.774Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "ebdeab82-dc9a-442e-9caa-bf06d6241549",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "file--1d8e74d3-f04b-5259-868c-199d1d3f5e93",
        "type": "StixFile"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Url",
          "x_opencti_score": 20
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.072Z",
          "created_at": "2026-09-25T11:28:07.816Z",
          "modified": "2026-09-25T11:28:58.225Z",
          "updated_at": "2026-09-25T11:28:58.225Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "f0965bed-f0b4-4579-a554-479225fc2260",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": true,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--c7014521-acf8-5c1e-bccc-9a85203e0481",
        "type": "Indicator"
      },
      {
        "__typename": "Url",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-25T11:26:12.384Z",
          "updated_at": "2026-09-25T11:26:12.591Z"
        },
        "description_available": false,
        "entity_type": "Url",
        "id": "f1e52e35-ce7d-4bb2-9d2d-9e05d7fc0855",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "url--9d3a61fc-9c2c-55c9-97f3-cedbdd0f8412",
        "type": "Url"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Hostname",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.097Z",
          "created_at": "2026-09-25T11:28:13.267Z",
          "modified": "2026-09-25T11:29:17.644Z",
          "updated_at": "2026-09-25T11:29:17.644Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "f556fb44-b049-4bc7-9cea-ad80a92657a9",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--e6ec33f2-2610-56b1-a51a-4103329d09dd",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.011Z",
          "created_at": "2026-09-25T11:26:35.321Z",
          "modified": "2026-09-25T11:27:49.101Z",
          "updated_at": "2026-09-25T11:27:49.101Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "f962693e-2f34-4d4c-b299-3afeb96987aa",
        "is_inferred": false,
        "labels": [
          "ai-assisted intrusions",
          "fengtai government",
          "glutton",
          "glutton webshells",
          "secbox",
          "secflow framework",
          "steganographic payloads"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "indicator--bdf8c036-3fe4-5583-a6a2-35305b554e4b",
        "type": "Indicator"
      }
    ],
    "direct_relationships": [
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.491Z",
          "created_at": "2026-09-25T11:38:08.064Z",
          "modified": "2026-09-25T11:38:08.365Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:38:08.365Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "013033b3-7d66-4e8f-bd45-292d18ccb827",
        "from_id": "013033b3-7d66-4e8f-bd45-292d18ccb827",
        "from_name": null,
        "from_type": "Indicator",
        "id": "0018935d-3351-4cbd-bec2-d54b32e2fd72",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--a60a155c-da0a-5e46-a793-123044f2b27c",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.074Z",
          "created_at": "2026-09-25T11:30:22.568Z",
          "modified": "2026-09-25T11:30:24.392Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:24.392Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "f0965bed-f0b4-4579-a554-479225fc2260",
        "from_id": "f0965bed-f0b4-4579-a554-479225fc2260",
        "from_name": null,
        "from_type": "Indicator",
        "id": "0924d007-0809-4ec5-a729-e876c13d66f5",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--94368670-cc55-5fa8-9461-4e07cf3dec47",
        "toId": "729ae26c-7838-4385-89c3-d6f6c1dc2547",
        "to_id": "729ae26c-7838-4385-89c3-d6f6c1dc2547",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.023Z",
          "created_at": "2026-09-25T11:30:12.524Z",
          "modified": "2026-09-25T11:30:12.980Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:12.980Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "b1da6e8a-6e08-41f1-913b-7b932284fca0",
        "from_id": "b1da6e8a-6e08-41f1-913b-7b932284fca0",
        "from_name": null,
        "from_type": "Indicator",
        "id": "0b58deef-4e54-456e-8db7-09895a0c5d28",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--ce427707-3b29-5930-ac80-ba7e64bc39f6",
        "toId": "28d269ea-ee81-4290-95bc-b28fac9b157d",
        "to_id": "28d269ea-ee81-4290-95bc-b28fac9b157d",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.409Z",
          "created_at": "2026-09-25T11:36:50.537Z",
          "modified": "2026-09-25T11:36:50.729Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:36:50.729Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "df99b492-86ae-4152-a08e-0bb6bdd7a458",
        "from_id": "df99b492-86ae-4152-a08e-0bb6bdd7a458",
        "from_name": null,
        "from_type": "Indicator",
        "id": "0bfec2dd-217b-49cb-a9c7-9bc57ef2fd97",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--062cd028-00af-51ad-b319-863430f3e283",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.179Z",
          "created_at": "2026-09-25T11:33:02.648Z",
          "modified": "2026-09-25T11:33:07.478Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:33:07.478Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "f962693e-2f34-4d4c-b299-3afeb96987aa",
        "from_id": "f962693e-2f34-4d4c-b299-3afeb96987aa",
        "from_name": null,
        "from_type": "Indicator",
        "id": "0ca4e5b7-b56a-491a-ae9a-5882828caccb",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--2b25847c-18a0-5879-86fc-bef08211aa4e",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.039Z",
          "created_at": "2026-09-25T11:30:17.138Z",
          "modified": "2026-09-25T11:30:17.764Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:17.764Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "80d53d58-6a2c-4dfa-9e8d-542acc144bc8",
        "from_id": "80d53d58-6a2c-4dfa-9e8d-542acc144bc8",
        "from_name": null,
        "from_type": "Indicator",
        "id": "0cfa84a0-d58c-4ff3-9825-7f40b6104412",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--4a9387ce-9ef3-59c7-b116-c44dde4aeaab",
        "toId": "4fa47aea-54e6-4343-8a8d-69135f159209",
        "to_id": "4fa47aea-54e6-4343-8a8d-69135f159209",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.105Z",
          "created_at": "2026-09-25T11:30:29.929Z",
          "modified": "2026-09-25T11:30:30.225Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:30.225Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "55582c90-ef77-43d4-81d9-244d1a5b1df7",
        "from_id": "55582c90-ef77-43d4-81d9-244d1a5b1df7",
        "from_name": null,
        "from_type": "Indicator",
        "id": "0e445b29-6b19-42ca-b542-574adb930727",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--0d55bc19-8e59-550f-b5d7-fddaf5de03e2",
        "toId": "671b7d39-055d-4a8e-a1d4-7439eef60a8e",
        "to_id": "671b7d39-055d-4a8e-a1d4-7439eef60a8e",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.126Z",
          "created_at": "2026-09-25T11:30:56.951Z",
          "modified": "2026-09-25T11:30:57.110Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:57.110Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "6886e013-939f-4410-9dc1-cc1f81de1964",
        "from_id": "6886e013-939f-4410-9dc1-cc1f81de1964",
        "from_name": null,
        "from_type": "Indicator",
        "id": "11870ad9-e45a-49d3-9270-166c4bf1ae30",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--99eec455-be99-58f3-b984-5a110632d983",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.996Z",
          "created_at": "2026-09-25T11:30:02.902Z",
          "modified": "2026-09-25T11:30:03.308Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:03.308Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "6886e013-939f-4410-9dc1-cc1f81de1964",
        "from_id": "6886e013-939f-4410-9dc1-cc1f81de1964",
        "from_name": null,
        "from_type": "Indicator",
        "id": "17c6c253-78fa-49d8-a13c-b81b139f16ab",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--1a33027a-9853-5c52-af76-fc8bca296938",
        "toId": "7505178f-5612-4e63-8e8a-a1c4258086c5",
        "to_id": "7505178f-5612-4e63-8e8a-a1c4258086c5",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.147Z",
          "created_at": "2026-09-25T11:31:21.457Z",
          "modified": "2026-09-25T11:31:21.764Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:31:21.764Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "16c395d5-bc9f-440b-9ffd-6bfeef0799bf",
        "from_id": "16c395d5-bc9f-440b-9ffd-6bfeef0799bf",
        "from_name": null,
        "from_type": "Indicator",
        "id": "1fde4bd5-c0c7-4e04-b495-6bb8a367af25",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--b321c207-59be-52d4-a6cb-18396834ac46",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.096Z",
          "created_at": "2026-09-25T11:30:28.834Z",
          "modified": "2026-09-25T11:30:29.337Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:29.337Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "013033b3-7d66-4e8f-bd45-292d18ccb827",
        "from_id": "013033b3-7d66-4e8f-bd45-292d18ccb827",
        "from_name": null,
        "from_type": "Indicator",
        "id": "24b01f88-4a72-4d93-b924-eaa24de76701",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--2b15b8df-8169-5612-baa8-ebad2904fc98",
        "toId": "20528565-fdf0-404f-aace-d90b546fcf3a",
        "to_id": "20528565-fdf0-404f-aace-d90b546fcf3a",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.499Z",
          "created_at": "2026-09-25T11:38:13.832Z",
          "modified": "2026-09-25T11:38:14.051Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:38:14.051Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "f556fb44-b049-4bc7-9cea-ad80a92657a9",
        "from_id": "f556fb44-b049-4bc7-9cea-ad80a92657a9",
        "from_name": null,
        "from_type": "Indicator",
        "id": "26125dcb-2094-4796-83d5-0c09b0145ff3",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--80b478fe-63bf-5363-9e92-b5699c4f4110",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.147Z",
          "created_at": "2026-09-25T11:31:19.907Z",
          "modified": "2026-09-25T11:31:20.040Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:31:20.040Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "16c395d5-bc9f-440b-9ffd-6bfeef0799bf",
        "from_id": "16c395d5-bc9f-440b-9ffd-6bfeef0799bf",
        "from_name": null,
        "from_type": "Indicator",
        "id": "2742d894-1d85-40e1-a6c9-00b7ba26a6d9",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--5b1230f0-ce8d-53ff-ad32-814738fcc43f",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.172Z",
          "created_at": "2026-09-25T11:31:51.360Z",
          "modified": "2026-09-25T11:31:51.698Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:31:51.698Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "86440ebf-51f9-4c87-be4d-dae12ee7c2e1",
        "from_id": "86440ebf-51f9-4c87-be4d-dae12ee7c2e1",
        "from_name": null,
        "from_type": "Indicator",
        "id": "2b18c214-6291-4e2f-b911-9fb69e61b320",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--b2a1e4a6-1964-51f8-9403-ba6a619fc65a",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.483Z",
          "created_at": "2026-09-25T11:37:52.188Z",
          "modified": "2026-09-25T11:37:53.264Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:37:53.264Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "ddb31a53-2e5a-4074-87e5-437ff450d235",
        "from_id": "ddb31a53-2e5a-4074-87e5-437ff450d235",
        "from_name": null,
        "from_type": "Indicator",
        "id": "2b9e5642-d4ab-4d2d-ace7-fd99b31fd347",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--ec17aa66-f4f6-5743-abc6-99564de3d10d",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.468Z",
          "created_at": "2026-09-25T11:37:32.789Z",
          "modified": "2026-09-25T11:37:33.039Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:37:33.039Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "0bd5ecc2-d486-4f52-966b-58518a2ff6c1",
        "from_id": "0bd5ecc2-d486-4f52-966b-58518a2ff6c1",
        "from_name": null,
        "from_type": "Indicator",
        "id": "2cb18656-c6f7-4276-bd2d-fd967a8f3e2b",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--13311879-3c73-54ab-b08e-81905c7a39a5",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.278Z",
          "created_at": "2026-09-25T11:34:46.309Z",
          "modified": "2026-09-25T11:34:46.497Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:34:46.497Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "1ea86536-3685-4d0b-8beb-78f3c6aba369",
        "from_id": "1ea86536-3685-4d0b-8beb-78f3c6aba369",
        "from_name": null,
        "from_type": "Indicator",
        "id": "2cbb9b17-b917-4cca-b97c-3465af4d8925",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--484288eb-9e4e-56a3-8d73-a746ebd49d0f",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.911Z",
          "created_at": "2026-09-25T11:28:47.910Z",
          "modified": "2026-09-25T11:28:48.149Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:48.149Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_name": "SecBox",
        "from_type": "Malware",
        "id": "2cbc3283-9293-47f0-ba1c-efa538db7ca0",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--07029f25-6b58-5c26-b8cc-1d9ff00d6df7",
        "toId": "e6a2db30-d198-49d9-8ba2-9d861062bf46",
        "to_id": "e6a2db30-d198-49d9-8ba2-9d861062bf46",
        "to_name": "CVE-2022-22965",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.911Z",
          "created_at": "2026-09-25T11:28:51.094Z",
          "modified": "2026-09-25T11:28:51.577Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:51.577Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_name": "SecBox",
        "from_type": "Malware",
        "id": "2cebe487-74dd-46be-9d17-121ae0bedcd4",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--d0b25263-d4f5-5890-98cc-1e40a3a57870",
        "toId": "647f8a4a-1a25-456b-b2ab-f1675d2014e1",
        "to_id": "647f8a4a-1a25-456b-b2ab-f1675d2014e1",
        "to_name": "CVE-2024-4956",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.508Z",
          "created_at": "2026-09-25T11:38:29.545Z",
          "modified": "2026-09-25T11:38:29.883Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:38:29.883Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "ace41c62-607c-4359-9b07-c9da5a8c0e0a",
        "from_id": "ace41c62-607c-4359-9b07-c9da5a8c0e0a",
        "from_name": null,
        "from_type": "Indicator",
        "id": "2d56d462-6cd4-4a5f-a211-22e004fde3c3",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--9be74a31-ce7c-5ec6-b7ad-6f8074ea8f60",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.087Z",
          "created_at": "2026-09-25T11:30:26.027Z",
          "modified": "2026-09-25T11:30:26.695Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:26.695Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "0bd5ecc2-d486-4f52-966b-58518a2ff6c1",
        "from_id": "0bd5ecc2-d486-4f52-966b-58518a2ff6c1",
        "from_name": null,
        "from_type": "Indicator",
        "id": "2dcad5a5-4ef8-4d7e-8eca-ba96f834ff5e",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--bbf7d6a2-b3f1-55c3-96f6-6a7ba9b7686f",
        "toId": "925d70fe-819e-4dc4-bf85-c683b795d9ef",
        "to_id": "925d70fe-819e-4dc4-bf85-c683b795d9ef",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.319Z",
          "created_at": "2026-09-25T11:35:18.980Z",
          "modified": "2026-09-25T11:35:19.518Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:35:19.518Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "99c10a57-16a9-47ef-95dd-5d9e568b6fdd",
        "from_id": "99c10a57-16a9-47ef-95dd-5d9e568b6fdd",
        "from_name": null,
        "from_type": "Indicator",
        "id": "2ed1c507-2398-4b0c-b8bd-55b780db902a",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--215d561f-e079-5d2a-ba1f-bd1231364404",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.431Z",
          "created_at": "2026-09-25T11:37:00.927Z",
          "modified": "2026-09-25T11:37:01.101Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:37:01.101Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "0f574f6c-99d0-4113-a3c8-d42c090c5ff6",
        "from_id": "0f574f6c-99d0-4113-a3c8-d42c090c5ff6",
        "from_name": null,
        "from_type": "Indicator",
        "id": "334fc4bd-1801-45c7-950b-fdb4cb47ad5f",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--d45782f5-5186-5691-aa68-ffee6490672c",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.367Z",
          "created_at": "2026-09-25T11:36:18.548Z",
          "modified": "2026-09-25T11:36:18.774Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:36:18.774Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "6e99d3f0-8adc-4bcd-845f-8a5116482e69",
        "from_id": "6e99d3f0-8adc-4bcd-845f-8a5116482e69",
        "from_name": null,
        "from_type": "Indicator",
        "id": "34f18c83-ec47-40bb-94b3-9eed6c1c5091",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--ae5c86d2-642d-5f95-85e5-69b8e4d7d9be",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.407Z",
          "created_at": "2026-09-25T11:36:44.080Z",
          "modified": "2026-09-25T11:36:44.403Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:36:44.403Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "df99b492-86ae-4152-a08e-0bb6bdd7a458",
        "from_id": "df99b492-86ae-4152-a08e-0bb6bdd7a458",
        "from_name": null,
        "from_type": "Indicator",
        "id": "354d4224-fd98-4a68-b890-69eaf332ea28",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--9d9c541f-414e-55db-a822-80c3674bbea3",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.262Z",
          "created_at": "2026-09-25T11:34:40.111Z",
          "modified": "2026-09-25T11:34:40.395Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:34:40.395Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "d127fb55-e610-4fc7-bbf9-f6ebf159de49",
        "from_id": "d127fb55-e610-4fc7-bbf9-f6ebf159de49",
        "from_name": null,
        "from_type": "Indicator",
        "id": "385e5708-556a-4cf5-abd8-9c7710d18e2a",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--4de02096-a310-5aa9-ba07-6827e92f8a0d",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.390Z",
          "created_at": "2026-09-25T11:36:34.764Z",
          "modified": "2026-09-25T11:36:35.026Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:36:35.026Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "98a9f866-a8f3-4067-8b17-38825d31b5b0",
        "from_id": "98a9f866-a8f3-4067-8b17-38825d31b5b0",
        "from_name": null,
        "from_type": "Indicator",
        "id": "39000329-0b33-45e4-ac73-d3722729058c",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--0bc675dd-3660-5273-a504-5869ed281c06",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.899Z",
          "created_at": "2026-09-25T11:28:19.458Z",
          "modified": "2026-09-25T11:28:21.240Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:21.240Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_name": "SecBox",
        "from_type": "Malware",
        "id": "39383774-1cef-469c-9325-31416e571ead",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--c4f5fd5a-c8c9-5389-8f30-01de04427c71",
        "toId": "08257c10-e1ae-4471-bc3f-251792c1126c",
        "to_id": "08257c10-e1ae-4471-bc3f-251792c1126c",
        "to_name": "Telecommunications",
        "to_type": "Sector"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.007Z",
          "created_at": "2026-09-25T11:30:07.858Z",
          "modified": "2026-09-25T11:30:08.505Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:08.505Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "e710f05a-d70b-49f6-8a6a-64855677b7c1",
        "from_id": "e710f05a-d70b-49f6-8a6a-64855677b7c1",
        "from_name": null,
        "from_type": "Indicator",
        "id": "3aa5898b-aa20-4c50-94fc-ba66a6cf6677",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--1e4170c2-7568-5f4e-8edb-1b9b3e1413dd",
        "toId": "942e517e-5ef8-4a4f-9a8e-2721d9f40e68",
        "to_id": "942e517e-5ef8-4a4f-9a8e-2721d9f40e68",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.155Z",
          "created_at": "2026-09-25T11:31:33.533Z",
          "modified": "2026-09-25T11:31:34.410Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:31:34.410Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "813df622-c624-4d52-80db-5e35fb4cb1b9",
        "from_id": "813df622-c624-4d52-80db-5e35fb4cb1b9",
        "from_name": null,
        "from_type": "Indicator",
        "id": "3c49e98d-a249-4384-b6a5-8bef01ffae7d",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--86a3ce17-70a3-5235-8ae2-9a872b4e3563",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.081Z",
          "created_at": "2026-09-25T11:30:25.544Z",
          "modified": "2026-09-25T11:30:25.888Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:25.888Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "8652a66a-1bbb-4aeb-96b0-00dddbcba7d3",
        "from_id": "8652a66a-1bbb-4aeb-96b0-00dddbcba7d3",
        "from_name": null,
        "from_type": "Indicator",
        "id": "3e40b53d-5e23-4a7b-b07f-2c61a5676e18",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--bbce37ab-c38b-5979-9eb7-4beae0fb008f",
        "toId": "f1e52e35-ce7d-4bb2-9d2d-9e05d7fc0855",
        "to_id": "f1e52e35-ce7d-4bb2-9d2d-9e05d7fc0855",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.099Z",
          "created_at": "2026-09-25T11:30:29.050Z",
          "modified": "2026-09-25T11:30:29.338Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:29.338Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "f556fb44-b049-4bc7-9cea-ad80a92657a9",
        "from_id": "f556fb44-b049-4bc7-9cea-ad80a92657a9",
        "from_name": null,
        "from_type": "Indicator",
        "id": "40d65dd7-e0fe-4d74-ab7c-8bfddbc1ae9b",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--2560629f-2858-55cb-8fff-d7037fd21e69",
        "toId": "ba9578cb-357d-424a-8018-4a8a8fb727bf",
        "to_id": "ba9578cb-357d-424a-8018-4a8a8fb727bf",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.054Z",
          "created_at": "2026-09-25T11:30:18.382Z",
          "modified": "2026-09-25T11:30:18.662Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:18.662Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "8eea5d36-230b-478b-858d-59f6f4a55c3b",
        "from_id": "8eea5d36-230b-478b-858d-59f6f4a55c3b",
        "from_name": null,
        "from_type": "Indicator",
        "id": "45ac9fd8-8942-4c3c-9813-938ff9a4a6b4",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--b10586df-871e-5c88-81cf-abe55cfb9747",
        "toId": "d9b5409e-5a97-485c-929e-0a7a7350cf52",
        "to_id": "d9b5409e-5a97-485c-929e-0a7a7350cf52",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.525Z",
          "created_at": "2026-09-25T11:39:20.523Z",
          "modified": "2026-09-25T11:39:23.444Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:39:23.444Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "40d8f563-a648-4c78-9a7f-c4365c1ffa47",
        "from_id": "40d8f563-a648-4c78-9a7f-c4365c1ffa47",
        "from_name": null,
        "from_type": "Indicator",
        "id": "481fd4fd-788f-4de2-aab4-616b75704f82",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--9f110963-a96d-5bea-8b7d-17895744305b",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.994Z",
          "created_at": "2026-09-25T11:30:02.891Z",
          "modified": "2026-09-25T11:30:03.307Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:03.307Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "4ac1f979-42e9-4928-a7be-ea9f98bbc29e",
        "from_id": "4ac1f979-42e9-4928-a7be-ea9f98bbc29e",
        "from_name": null,
        "from_type": "Indicator",
        "id": "48e6c2da-a411-4efe-89a2-fb994e3b2fd6",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--3f269aa3-1fdb-52b4-a706-32325bbedf2e",
        "toId": "3494c909-cd93-4813-a248-91f0623d82c1",
        "to_id": "3494c909-cd93-4813-a248-91f0623d82c1",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.208Z",
          "created_at": "2026-09-25T11:34:05.531Z",
          "modified": "2026-09-25T11:34:05.799Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:34:05.799Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "9e65265b-6197-486f-b057-ee5af4142031",
        "from_id": "9e65265b-6197-486f-b057-ee5af4142031",
        "from_name": null,
        "from_type": "Indicator",
        "id": "4be8c493-cb54-4910-8bf4-44e5408f7a82",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--aff344a5-3ed0-58d8-97b0-81946083595d",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.299Z",
          "created_at": "2026-09-25T11:35:03.943Z",
          "modified": "2026-09-25T11:35:04.494Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:35:04.494Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "80d53d58-6a2c-4dfa-9e8d-542acc144bc8",
        "from_id": "80d53d58-6a2c-4dfa-9e8d-542acc144bc8",
        "from_name": null,
        "from_type": "Indicator",
        "id": "4d5a6b4d-4d81-4864-8fbd-75973203ed34",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--8de3a7bb-f37c-51eb-bab7-327ad89dba1f",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.045Z",
          "created_at": "2026-09-25T11:30:17.236Z",
          "modified": "2026-09-25T11:30:17.765Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:17.765Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "99c10a57-16a9-47ef-95dd-5d9e568b6fdd",
        "from_id": "99c10a57-16a9-47ef-95dd-5d9e568b6fdd",
        "from_name": null,
        "from_type": "Indicator",
        "id": "5045e253-6c9a-402b-bcbd-1b41e613ede0",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--2c0224fc-5319-5639-9234-2a3d4a1bfa91",
        "toId": "7bd77322-0405-4d8c-966d-c1e948645afd",
        "to_id": "7bd77322-0405-4d8c-966d-c1e948645afd",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.899Z",
          "created_at": "2026-09-25T11:28:23.091Z",
          "modified": "2026-09-25T11:28:23.788Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:23.788Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_name": "SecBox",
        "from_type": "Malware",
        "id": "506e7d41-a822-451c-810c-4a90b375b2ed",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--5bbe1499-d7b3-5b98-9b97-812439ceb641",
        "toId": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed",
        "to_id": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed",
        "to_name": "Education",
        "to_type": "Sector"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.311Z",
          "created_at": "2026-09-25T11:35:13.433Z",
          "modified": "2026-09-25T11:35:13.629Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:35:13.629Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "be82d031-8282-4109-92bc-98f208b855e5",
        "from_id": "be82d031-8282-4109-92bc-98f208b855e5",
        "from_name": null,
        "from_type": "Indicator",
        "id": "50dc2f79-e9c5-47e3-a01e-035d714bd732",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--f4d8752f-4a34-5a1c-9fb1-046366ddfefe",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.326Z",
          "created_at": "2026-09-25T11:35:31.441Z",
          "modified": "2026-09-25T11:35:32.301Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:35:32.301Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "0487a567-5c15-46f1-ac79-9a55cabe1e46",
        "from_id": "0487a567-5c15-46f1-ac79-9a55cabe1e46",
        "from_name": null,
        "from_type": "Indicator",
        "id": "51f1dc7e-6071-4283-90fc-8ca4042e83ae",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--e0c8f2b7-ca4d-543c-96e1-512b0b5c2b04",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.118Z",
          "created_at": "2026-09-25T11:30:44.001Z",
          "modified": "2026-09-25T11:30:44.329Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:44.329Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "4ac1f979-42e9-4928-a7be-ea9f98bbc29e",
        "from_id": "4ac1f979-42e9-4928-a7be-ea9f98bbc29e",
        "from_name": null,
        "from_type": "Indicator",
        "id": "523b4f64-b033-4c5d-a24b-66f2dce1957d",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--605e7b6a-70c5-54b4-8bac-86792df44ad4",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.108Z",
          "created_at": "2026-09-25T11:30:29.950Z",
          "modified": "2026-09-25T11:30:30.302Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:30.302Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "40d8f563-a648-4c78-9a7f-c4365c1ffa47",
        "from_id": "40d8f563-a648-4c78-9a7f-c4365c1ffa47",
        "from_name": null,
        "from_type": "Indicator",
        "id": "568a6f9b-4de8-4752-8049-85d11fe5cd5e",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--a984fe68-e5d9-501d-87ed-22cb720dadb0",
        "toId": "0adf5841-2f73-43df-9cde-db0bab24c415",
        "to_id": "0adf5841-2f73-43df-9cde-db0bab24c415",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.109Z",
          "created_at": "2026-09-25T11:30:30.848Z",
          "modified": "2026-09-25T11:30:31.179Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:31.179Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "89f87c30-38eb-490d-bf32-0ba45a62701f",
        "from_id": "89f87c30-38eb-490d-bf32-0ba45a62701f",
        "from_name": null,
        "from_type": "Indicator",
        "id": "56953214-f541-4ae5-b55f-b7d15ac412ed",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--5ccd18b8-60ba-569a-a24c-d184d8bf4653",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.036Z",
          "created_at": "2026-09-25T11:30:14.992Z",
          "modified": "2026-09-25T11:30:16.474Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:16.474Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "67291409-fb44-4cf3-b06f-f3a440a134cb",
        "from_id": "67291409-fb44-4cf3-b06f-f3a440a134cb",
        "from_name": null,
        "from_type": "Indicator",
        "id": "5a94acff-8df1-4306-b08d-9a72ae346d13",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--95e33416-8317-5fa6-9be1-48a78ff58432",
        "toId": "235fb1f3-9cfb-4e55-90f6-6cdcb0ac66f1",
        "to_id": "235fb1f3-9cfb-4e55-90f6-6cdcb0ac66f1",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.048Z",
          "created_at": "2026-09-25T11:30:18.127Z",
          "modified": "2026-09-25T11:30:18.415Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:18.415Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "0487a567-5c15-46f1-ac79-9a55cabe1e46",
        "from_id": "0487a567-5c15-46f1-ac79-9a55cabe1e46",
        "from_name": null,
        "from_type": "Indicator",
        "id": "5abdb7e6-0a4d-470f-93d0-cc1ea8f1d112",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--3ff30e4a-c427-51aa-926e-b05adb4efbe5",
        "toId": "ebdeab82-dc9a-442e-9caa-bf06d6241549",
        "to_id": "ebdeab82-dc9a-442e-9caa-bf06d6241549",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.208Z",
          "created_at": "2026-09-25T11:34:06.254Z",
          "modified": "2026-09-25T11:34:06.578Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:34:06.578Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "9e65265b-6197-486f-b057-ee5af4142031",
        "from_id": "9e65265b-6197-486f-b057-ee5af4142031",
        "from_name": null,
        "from_type": "Indicator",
        "id": "5ac46518-02d1-467a-8ce6-61d4a20b432a",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--becc471c-5295-5c4a-85ba-ba502054d7c3",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.026Z",
          "created_at": "2026-09-25T11:30:12.798Z",
          "modified": "2026-09-25T11:30:13.863Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:13.863Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "04c11238-b4ec-4972-a7d6-27acf52a7bdb",
        "from_id": "04c11238-b4ec-4972-a7d6-27acf52a7bdb",
        "from_name": null,
        "from_type": "Indicator",
        "id": "5d34ca61-680f-4adb-af15-e2c520c02bd2",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--2bb77f27-3b4d-52f8-b886-7531ac3f78bf",
        "toId": "4555c7d4-fc02-4904-8e9b-c1416a5a1273",
        "to_id": "4555c7d4-fc02-4904-8e9b-c1416a5a1273",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.004Z",
          "created_at": "2026-09-25T11:30:06.091Z",
          "modified": "2026-09-25T11:30:07.141Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:07.141Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "813df622-c624-4d52-80db-5e35fb4cb1b9",
        "from_id": "813df622-c624-4d52-80db-5e35fb4cb1b9",
        "from_name": null,
        "from_type": "Indicator",
        "id": "616101c6-cc87-4b9a-9e30-664595923856",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--02f2c7f6-1ef9-51bf-b034-78f026d46fb2",
        "toId": "915aff68-0fa0-4907-b057-c12ef2573cb6",
        "to_id": "915aff68-0fa0-4907-b057-c12ef2573cb6",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.216Z",
          "created_at": "2026-09-25T11:34:13.256Z",
          "modified": "2026-09-25T11:34:13.505Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:34:13.505Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "b1da6e8a-6e08-41f1-913b-7b932284fca0",
        "from_id": "b1da6e8a-6e08-41f1-913b-7b932284fca0",
        "from_name": null,
        "from_type": "Indicator",
        "id": "627daa0f-eec8-4585-8e9c-f7a77e655d86",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--a0fdd550-2dc9-54c8-aa7a-028a5ea34bec",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.066Z",
          "created_at": "2026-09-25T11:30:20.289Z",
          "modified": "2026-09-25T11:30:20.583Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:20.583Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "8fda0fcb-ae48-43fd-948d-652290dc22a5",
        "from_id": "8fda0fcb-ae48-43fd-948d-652290dc22a5",
        "from_name": null,
        "from_type": "Indicator",
        "id": "62cdd841-db46-43b2-b13f-5682d65523ad",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--b5c6fe79-d7ab-59e5-bf63-f19fe01d37a5",
        "toId": "82627cc4-7405-4c4b-9907-72204c8358a8",
        "to_id": "82627cc4-7405-4c4b-9907-72204c8358a8",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.491Z",
          "created_at": "2026-09-25T11:38:03.703Z",
          "modified": "2026-09-25T11:38:03.953Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:38:03.953Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "013033b3-7d66-4e8f-bd45-292d18ccb827",
        "from_id": "013033b3-7d66-4e8f-bd45-292d18ccb827",
        "from_name": null,
        "from_type": "Indicator",
        "id": "63442823-869e-44fb-aad7-a1dbd14b81f0",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--68ec67b6-bbf5-5ec2-ba2a-b8ee30283f15",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.368Z",
          "created_at": "2026-09-25T11:36:20.920Z",
          "modified": "2026-09-25T11:36:21.083Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:36:21.083Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "6e99d3f0-8adc-4bcd-845f-8a5116482e69",
        "from_id": "6e99d3f0-8adc-4bcd-845f-8a5116482e69",
        "from_name": null,
        "from_type": "Indicator",
        "id": "6609d834-89cb-428e-a2e4-92ddc5bbfb51",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--af93d9b2-bd8b-5996-914c-386a0bf02311",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.907Z",
          "created_at": "2026-09-25T11:28:43.103Z",
          "modified": "2026-09-25T11:28:44.893Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:44.893Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_name": "SecBox",
        "from_type": "Malware",
        "id": "67c8ab27-63f0-48bc-996f-848ccc8eb306",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--df191aa9-fdc3-5763-a3d3-4717df510e25",
        "toId": "44543676-564d-428f-93d4-412969169a8d",
        "to_id": "44543676-564d-428f-93d4-412969169a8d",
        "to_name": "CVE-2014-6271",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.910Z",
          "created_at": "2026-09-25T11:28:47.425Z",
          "modified": "2026-09-25T11:28:47.562Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:47.562Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_name": "SecBox",
        "from_type": "Malware",
        "id": "68cbc863-c296-44c5-b46c-68ddf0c9ba73",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--bb82e71e-ac26-516d-88c1-8d0cd5fba0c3",
        "toId": "ebcc7e47-61c4-43a6-8605-4a202598eada",
        "to_id": "ebcc7e47-61c4-43a6-8605-4a202598eada",
        "to_name": "CVE-2021-44228",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.460Z",
          "created_at": "2026-09-25T11:37:21.149Z",
          "modified": "2026-09-25T11:37:22.714Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:37:22.714Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "7a4b611c-7cb7-43b5-b257-5114cb6aef9f",
        "from_id": "7a4b611c-7cb7-43b5-b257-5114cb6aef9f",
        "from_name": null,
        "from_type": "Indicator",
        "id": "6a9da503-deab-45be-9e5e-74083eb87a86",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--0f01ad4f-cbf5-5a60-8dc9-b25ed9d18091",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.278Z",
          "created_at": "2026-09-25T11:34:47.758Z",
          "modified": "2026-09-25T11:34:47.949Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:34:47.949Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "1ea86536-3685-4d0b-8beb-78f3c6aba369",
        "from_id": "1ea86536-3685-4d0b-8beb-78f3c6aba369",
        "from_name": null,
        "from_type": "Indicator",
        "id": "6c6163f5-359e-4feb-8371-0f3a528c1036",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--e2a53de1-5e31-5db4-8d1f-5797fdd580af",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.163Z",
          "created_at": "2026-09-25T11:31:42.217Z",
          "modified": "2026-09-25T11:31:42.620Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:31:42.620Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "e710f05a-d70b-49f6-8a6a-64855677b7c1",
        "from_id": "e710f05a-d70b-49f6-8a6a-64855677b7c1",
        "from_name": null,
        "from_type": "Indicator",
        "id": "6c804594-8e0d-4961-8472-d235e3e8f72a",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--b7b91fd9-d315-5ce5-b62d-e36976c91a65",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.919Z",
          "created_at": "2026-09-25T11:28:53.077Z",
          "modified": "2026-09-25T11:28:53.332Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:53.332Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_name": "Glutton",
        "from_type": "Malware",
        "id": "6c9a76a4-2568-444e-961c-5aeb440d588f",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--19546ec4-b2a8-5f7d-8e28-692b93f64fe4",
        "toId": "ebcc7e47-61c4-43a6-8605-4a202598eada",
        "to_id": "ebcc7e47-61c4-43a6-8605-4a202598eada",
        "to_name": "CVE-2021-44228",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.445Z",
          "created_at": "2026-09-25T11:37:07.965Z",
          "modified": "2026-09-25T11:37:08.301Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:37:08.301Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "78df0f58-436e-4889-90d8-1c2685bb68ae",
        "from_id": "78df0f58-436e-4889-90d8-1c2685bb68ae",
        "from_name": null,
        "from_type": "Indicator",
        "id": "6fac1c6a-22bd-4bfd-ae95-ce7e5eecfa47",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--cdbe19f2-6434-5ed3-8b98-56652b45a284",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.460Z",
          "created_at": "2026-09-25T11:37:23.714Z",
          "modified": "2026-09-25T11:37:24.095Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:37:24.095Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "7a4b611c-7cb7-43b5-b257-5114cb6aef9f",
        "from_id": "7a4b611c-7cb7-43b5-b257-5114cb6aef9f",
        "from_name": null,
        "from_type": "Indicator",
        "id": "70e7425d-cbb0-4bf3-bfe2-9c129eba9438",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--f2173c12-0db0-5d83-bd94-7750b7c3791f",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.452Z",
          "created_at": "2026-09-25T11:37:17.387Z",
          "modified": "2026-09-25T11:37:17.526Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:37:17.526Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "8652a66a-1bbb-4aeb-96b0-00dddbcba7d3",
        "from_id": "8652a66a-1bbb-4aeb-96b0-00dddbcba7d3",
        "from_name": null,
        "from_type": "Indicator",
        "id": "7118bcce-d067-4513-8b7c-412e87bbb12a",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--5985776d-b0ba-50b8-a416-5572fbdfe023",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.524Z",
          "created_at": "2026-09-25T11:38:52.727Z",
          "modified": "2026-09-25T11:38:55.737Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:38:55.737Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "40d8f563-a648-4c78-9a7f-c4365c1ffa47",
        "from_id": "40d8f563-a648-4c78-9a7f-c4365c1ffa47",
        "from_name": null,
        "from_type": "Indicator",
        "id": "714b21da-1f99-45de-b873-ca972fd30b03",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--2b16fcff-6854-537e-a03d-d5a51bffe674",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.476Z",
          "created_at": "2026-09-25T11:37:45.670Z",
          "modified": "2026-09-25T11:37:45.907Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:37:45.907Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "db29312e-6d9d-4932-8850-bffeda8b932b",
        "from_id": "db29312e-6d9d-4932-8850-bffeda8b932b",
        "from_name": null,
        "from_type": "Indicator",
        "id": "76d02ad0-2708-458a-8ce7-7771cdb0ce58",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--794537f7-9f2f-56a3-b9a8-f3710dff13a6",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.298Z",
          "created_at": "2026-09-25T11:35:01.959Z",
          "modified": "2026-09-25T11:35:02.260Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:35:02.260Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "80d53d58-6a2c-4dfa-9e8d-542acc144bc8",
        "from_id": "80d53d58-6a2c-4dfa-9e8d-542acc144bc8",
        "from_name": null,
        "from_type": "Indicator",
        "id": "78a83937-c484-4de2-ac78-292ed492ba04",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--dd859bfa-c531-5cd7-9b42-9a886533ff48",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.452Z",
          "created_at": "2026-09-25T11:37:14.282Z",
          "modified": "2026-09-25T11:37:14.648Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:37:14.648Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "8652a66a-1bbb-4aeb-96b0-00dddbcba7d3",
        "from_id": "8652a66a-1bbb-4aeb-96b0-00dddbcba7d3",
        "from_name": null,
        "from_type": "Indicator",
        "id": "7a0300ca-2f1d-49af-bd51-ead7c919ed53",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--dfb22d5a-d616-5cf3-b881-dad74d59cec2",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.311Z",
          "created_at": "2026-09-25T11:35:11.910Z",
          "modified": "2026-09-25T11:35:12.429Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:35:12.429Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "be82d031-8282-4109-92bc-98f208b855e5",
        "from_id": "be82d031-8282-4109-92bc-98f208b855e5",
        "from_name": null,
        "from_type": "Indicator",
        "id": "7b21682b-fbe0-4bca-9265-d986a0fafe6d",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--82658995-5b1c-5d5d-9451-2fa3a5c14fcd",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.180Z",
          "created_at": "2026-09-25T11:33:10.226Z",
          "modified": "2026-09-25T11:33:11.308Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:33:11.308Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "f962693e-2f34-4d4c-b299-3afeb96987aa",
        "from_id": "f962693e-2f34-4d4c-b299-3afeb96987aa",
        "from_name": null,
        "from_type": "Indicator",
        "id": "7f5a784f-cd98-49c3-b242-3afd41812333",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--fbb0101d-e7ce-52c4-9383-393caab6af1e",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.359Z",
          "created_at": "2026-09-25T11:36:10.971Z",
          "modified": "2026-09-25T11:36:11.317Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:36:11.317Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "db984156-b205-4da0-805a-43a90b53458d",
        "from_id": "db984156-b205-4da0-805a-43a90b53458d",
        "from_name": null,
        "from_type": "Indicator",
        "id": "807ff2c4-ccd0-4061-b494-c842e6c57ea3",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--a4e53c88-e944-5f3a-9d29-8054eeaa0c7a",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.912Z",
          "created_at": "2026-09-25T11:28:49.380Z",
          "modified": "2026-09-25T11:28:50.635Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:50.635Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_name": "Glutton",
        "from_type": "Malware",
        "id": "80962f19-b636-40b4-8af8-d78f6a683f99",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--36768c1f-1b0e-5515-abea-f10bcd4c3aa8",
        "toId": "44543676-564d-428f-93d4-412969169a8d",
        "to_id": "44543676-564d-428f-93d4-412969169a8d",
        "to_name": "CVE-2014-6271",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.187Z",
          "created_at": "2026-09-25T11:33:45.582Z",
          "modified": "2026-09-25T11:33:47.241Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:33:47.241Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "9c4691bb-a528-4946-93a4-a57229725d5d",
        "from_id": "9c4691bb-a528-4946-93a4-a57229725d5d",
        "from_name": null,
        "from_type": "Indicator",
        "id": "8767217e-224d-48d6-a49f-53230435a80c",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--c221c243-8509-54e3-abc2-a87559a4c0d7",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.196Z",
          "created_at": "2026-09-25T11:33:55.674Z",
          "modified": "2026-09-25T11:33:56.104Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:33:56.104Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "99bbc016-0fcb-4a55-aa06-e4103f4b66a4",
        "from_id": "99bbc016-0fcb-4a55-aa06-e4103f4b66a4",
        "from_name": null,
        "from_type": "Indicator",
        "id": "8f642925-5bb5-4adf-b417-5679a3f51da3",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--7700473b-3bb9-58c2-85e8-f8b903845b61",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.155Z",
          "created_at": "2026-09-25T11:31:30.503Z",
          "modified": "2026-09-25T11:31:31.286Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:31:31.286Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "813df622-c624-4d52-80db-5e35fb4cb1b9",
        "from_id": "813df622-c624-4d52-80db-5e35fb4cb1b9",
        "from_name": null,
        "from_type": "Indicator",
        "id": "8faf3dac-5161-42f5-8a79-2273ddef2734",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--090d42d7-a0ed-5abf-894c-e583c1314238",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.127Z",
          "created_at": "2026-09-25T11:30:58.436Z",
          "modified": "2026-09-25T11:30:58.824Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:58.824Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "6886e013-939f-4410-9dc1-cc1f81de1964",
        "from_id": "6886e013-939f-4410-9dc1-cc1f81de1964",
        "from_name": null,
        "from_type": "Indicator",
        "id": "907b55ae-2a6d-41af-bd30-4991c494883f",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--6f3cfe0c-77bc-5fa8-babb-dac171163843",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.042Z",
          "created_at": "2026-09-25T11:30:17.132Z",
          "modified": "2026-09-25T11:30:17.398Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:17.398Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "be82d031-8282-4109-92bc-98f208b855e5",
        "from_id": "be82d031-8282-4109-92bc-98f208b855e5",
        "from_name": null,
        "from_type": "Indicator",
        "id": "9322336d-23d6-40d5-80e0-3fc45102a681",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--f656fbbe-c70a-5e15-9d03-298fd0276bc6",
        "toId": "44695416-e20e-49ca-bad7-84aeaa41f0b3",
        "to_id": "44695416-e20e-49ca-bad7-84aeaa41f0b3",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.898Z",
          "created_at": "2026-09-25T11:28:17.243Z",
          "modified": "2026-09-25T11:28:18.879Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:18.879Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_name": "SecBox",
        "from_type": "Malware",
        "id": "9354a053-c8e3-436b-85a1-fd2118bad0f8",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--9f77fe4d-ba13-5ef9-ba99-3252c10965e8",
        "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a",
        "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a",
        "to_name": "Government and administrations",
        "to_type": "Sector"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.118Z",
          "created_at": "2026-09-25T11:30:43.115Z",
          "modified": "2026-09-25T11:30:43.438Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:43.438Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "4ac1f979-42e9-4928-a7be-ea9f98bbc29e",
        "from_id": "4ac1f979-42e9-4928-a7be-ea9f98bbc29e",
        "from_name": null,
        "from_type": "Indicator",
        "id": "95746d22-555c-4fed-ab2b-8bc3077aa05f",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--a6c3b849-5383-592a-b10e-d57fd288d063",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.197Z",
          "created_at": "2026-09-25T11:33:57.778Z",
          "modified": "2026-09-25T11:33:58.248Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:33:58.248Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "99bbc016-0fcb-4a55-aa06-e4103f4b66a4",
        "from_id": "99bbc016-0fcb-4a55-aa06-e4103f4b66a4",
        "from_name": null,
        "from_type": "Indicator",
        "id": "9794959f-47e4-412c-91ed-bae9034cbdcd",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--1551aedb-adc1-5994-b3e1-c8b582746029",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.444Z",
          "created_at": "2026-09-25T11:37:06.717Z",
          "modified": "2026-09-25T11:37:07.166Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:37:07.166Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "78df0f58-436e-4889-90d8-1c2685bb68ae",
        "from_id": "78df0f58-436e-4889-90d8-1c2685bb68ae",
        "from_name": null,
        "from_type": "Indicator",
        "id": "984328d3-236b-4abf-99d1-506e563192cc",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--bf716b85-a341-5efb-9be4-238de35fa380",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.334Z",
          "created_at": "2026-09-25T11:35:41.337Z",
          "modified": "2026-09-25T11:35:41.994Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:35:41.994Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "23121d85-6f9a-45f7-aa0d-ffcbc19df175",
        "from_id": "23121d85-6f9a-45f7-aa0d-ffcbc19df175",
        "from_name": null,
        "from_type": "Indicator",
        "id": "9b67168b-45e7-4ac4-b9ac-c8b46202edfb",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--210bcc26-3834-5c78-a063-e6c9bff3945c",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.261Z",
          "created_at": "2026-09-25T11:34:39.147Z",
          "modified": "2026-09-25T11:34:39.592Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:34:39.592Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "d127fb55-e610-4fc7-bbf9-f6ebf159de49",
        "from_id": "d127fb55-e610-4fc7-bbf9-f6ebf159de49",
        "from_name": null,
        "from_type": "Indicator",
        "id": "9cb17789-46e2-4f0f-b55b-36f0bf5ce929",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--01589b05-cdb9-5015-8b33-501ba6dac95a",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.187Z",
          "created_at": "2026-09-25T11:33:47.609Z",
          "modified": "2026-09-25T11:33:47.898Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:33:47.898Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "9c4691bb-a528-4946-93a4-a57229725d5d",
        "from_id": "9c4691bb-a528-4946-93a4-a57229725d5d",
        "from_name": null,
        "from_type": "Indicator",
        "id": "9ef37337-5e72-4a27-b343-e0a62be11506",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--94633d32-bd23-52a2-9c88-f41b5c9a0c23",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.352Z",
          "created_at": "2026-09-25T11:36:03.359Z",
          "modified": "2026-09-25T11:36:03.760Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:36:03.760Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "ac5b7942-fed5-4b20-8a97-bd9787a47e89",
        "from_id": "ac5b7942-fed5-4b20-8a97-bd9787a47e89",
        "from_name": null,
        "from_type": "Indicator",
        "id": "9f57394d-c1c5-410c-84c9-fa9354e8ca4f",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--a5cab962-307e-5c3e-8062-de167e3eef87",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.319Z",
          "created_at": "2026-09-25T11:35:34.190Z",
          "modified": "2026-09-25T11:35:34.566Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:35:34.566Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "99c10a57-16a9-47ef-95dd-5d9e568b6fdd",
        "from_id": "99c10a57-16a9-47ef-95dd-5d9e568b6fdd",
        "from_name": null,
        "from_type": "Indicator",
        "id": "a1a1b3d5-6a6f-4532-a562-c29560edcaa8",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--34f8fc5c-4f16-535d-8bd7-5ad9b69d5abb",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.908Z",
          "created_at": "2026-09-25T11:28:49.383Z",
          "modified": "2026-09-25T11:28:50.636Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:50.636Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_name": "SecBox",
        "from_type": "Malware",
        "id": "a3e83781-f1dc-4791-bd18-c7a581935d2b",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--40fadd47-15b0-5e1d-ade3-27e7dba7e13f",
        "toId": "ea11a4cc-e594-4e18-b6c3-c9138cebabf3",
        "to_id": "ea11a4cc-e594-4e18-b6c3-c9138cebabf3",
        "to_name": "CVE-2020-1938",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.031Z",
          "created_at": "2026-09-25T11:30:14.126Z",
          "modified": "2026-09-25T11:30:15.007Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:15.007Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "d127fb55-e610-4fc7-bbf9-f6ebf159de49",
        "from_id": "d127fb55-e610-4fc7-bbf9-f6ebf159de49",
        "from_name": null,
        "from_type": "Indicator",
        "id": "a44c44e9-d030-4f43-8c56-eb7260746e0c",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--580d6a9e-29aa-551e-933f-4bbc27c11b31",
        "toId": "46756e4f-2682-4d50-ac50-98f618fd4f39",
        "to_id": "46756e4f-2682-4d50-ac50-98f618fd4f39",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.071Z",
          "created_at": "2026-09-25T11:30:20.669Z",
          "modified": "2026-09-25T11:30:22.460Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:22.460Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "df99b492-86ae-4152-a08e-0bb6bdd7a458",
        "from_id": "df99b492-86ae-4152-a08e-0bb6bdd7a458",
        "from_name": null,
        "from_type": "Indicator",
        "id": "a601d213-4aff-4ab3-af16-92a219f621bc",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--58a3aed9-ee62-587f-a802-4863f53e83e4",
        "toId": "637f2235-e7ea-45a7-9279-87a183b6dd80",
        "to_id": "637f2235-e7ea-45a7-9279-87a183b6dd80",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.101Z",
          "created_at": "2026-09-25T11:30:29.950Z",
          "modified": "2026-09-25T11:30:30.301Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:30.301Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "ace41c62-607c-4359-9b07-c9da5a8c0e0a",
        "from_id": "ace41c62-607c-4359-9b07-c9da5a8c0e0a",
        "from_name": null,
        "from_type": "Indicator",
        "id": "a835f79e-0bb5-4ade-abf9-d53ac19a3f72",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--efacdded-2ad1-5390-bcc3-d2191226d957",
        "toId": "5271b9cb-5f30-4fb8-8149-096a0a405c2d",
        "to_id": "5271b9cb-5f30-4fb8-8149-096a0a405c2d",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.421Z",
          "created_at": "2026-09-25T11:36:52.315Z",
          "modified": "2026-09-25T11:36:53.214Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:36:53.214Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "f0965bed-f0b4-4579-a554-479225fc2260",
        "from_id": "f0965bed-f0b4-4579-a554-479225fc2260",
        "from_name": null,
        "from_type": "Indicator",
        "id": "a951deb4-14f2-47b4-a637-9ca9df3b8438",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--e0e0142c-bb33-5ff3-9fa3-3f4ccd260f27",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.290Z",
          "created_at": "2026-09-25T11:34:53.449Z",
          "modified": "2026-09-25T11:34:53.727Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:34:53.727Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "67291409-fb44-4cf3-b06f-f3a440a134cb",
        "from_id": "67291409-fb44-4cf3-b06f-f3a440a134cb",
        "from_name": null,
        "from_type": "Indicator",
        "id": "aa40ddd4-87a3-4b11-a91a-e9d153e135e7",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--62a12a41-a6a6-522e-9a0f-4563807b9a43",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.241Z",
          "created_at": "2026-09-25T11:34:34.250Z",
          "modified": "2026-09-25T11:34:34.862Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:34:34.862Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "030563bd-95e2-4178-a888-2a75f885d47e",
        "from_id": "030563bd-95e2-4178-a888-2a75f885d47e",
        "from_name": null,
        "from_type": "Indicator",
        "id": "aa4961ee-89d7-4d76-a14d-7505099a67f0",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--543c5bb6-9c73-5a3f-83fa-a72a8e52bbea",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.162Z",
          "created_at": "2026-09-25T11:31:41.570Z",
          "modified": "2026-09-25T11:31:41.881Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:31:41.881Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "e710f05a-d70b-49f6-8a6a-64855677b7c1",
        "from_id": "e710f05a-d70b-49f6-8a6a-64855677b7c1",
        "from_name": null,
        "from_type": "Indicator",
        "id": "abcc9608-60d2-4160-9116-3fbe0a78b73e",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--49e5c437-009d-5321-af82-3b465e92d122",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.484Z",
          "created_at": "2026-09-25T11:37:53.695Z",
          "modified": "2026-09-25T11:37:53.959Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:37:53.959Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "ddb31a53-2e5a-4074-87e5-437ff450d235",
        "from_id": "ddb31a53-2e5a-4074-87e5-437ff450d235",
        "from_name": null,
        "from_type": "Indicator",
        "id": "ae2a72f3-aafe-4935-867f-a7a7aca23d41",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--9cab87c5-ca56-5bb7-8f9b-d034669c7aac",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.920Z",
          "created_at": "2026-09-25T11:28:57.544Z",
          "modified": "2026-09-25T11:28:57.839Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:57.839Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_name": "Glutton",
        "from_type": "Malware",
        "id": "afba6a28-8ac1-45e6-a92b-8bad449aed4d",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--c4d1223e-8dc9-59f1-9ebf-8cf6f2cf3f89",
        "toId": "e6a2db30-d198-49d9-8ba2-9d861062bf46",
        "to_id": "e6a2db30-d198-49d9-8ba2-9d861062bf46",
        "to_name": "CVE-2022-22965",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.432Z",
          "created_at": "2026-09-25T11:37:01.442Z",
          "modified": "2026-09-25T11:37:01.641Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:37:01.641Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "0f574f6c-99d0-4113-a3c8-d42c090c5ff6",
        "from_id": "0f574f6c-99d0-4113-a3c8-d42c090c5ff6",
        "from_name": null,
        "from_type": "Indicator",
        "id": "b26adbb1-001a-4d84-945c-4b33d6a91941",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--8ce26930-1e6f-51fd-ab66-65f973a322b6",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.919Z",
          "created_at": "2026-09-25T11:28:52.507Z",
          "modified": "2026-09-25T11:28:52.762Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:52.762Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_name": "Glutton",
        "from_type": "Malware",
        "id": "b4f97c4c-fb50-48e9-a2f4-37d5ea2198cc",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--db0b03e8-3971-5f7c-99c6-468a55fa8a17",
        "toId": "cfa8b53b-4289-4e4d-b499-82ccb28f496e",
        "to_id": "cfa8b53b-4289-4e4d-b499-82ccb28f496e",
        "to_name": "CVE-2021-43798",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.908Z",
          "created_at": "2026-09-25T11:28:45.492Z",
          "modified": "2026-09-25T11:28:45.942Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:45.942Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_name": "SecBox",
        "from_type": "Malware",
        "id": "b67674df-f9dc-43fb-bfd0-f006de6c60ee",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--56a8db76-e6d4-5f00-affb-b8daad093e54",
        "toId": "752a1bdd-3da2-4925-829b-63ddd793e841",
        "to_id": "752a1bdd-3da2-4925-829b-63ddd793e841",
        "to_name": "CVE-2016-4437",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.090Z",
          "created_at": "2026-09-25T11:30:26.699Z",
          "modified": "2026-09-25T11:30:28.308Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:28.308Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "db29312e-6d9d-4932-8850-bffeda8b932b",
        "from_id": "db29312e-6d9d-4932-8850-bffeda8b932b",
        "from_name": null,
        "from_type": "Indicator",
        "id": "b6ae65bd-3f08-41a2-88e0-34a480da5458",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--23b2bf1a-f6cc-5eac-bc16-248f93347820",
        "toId": "a7b202db-a12c-446b-b6cd-c3cf1a192cd0",
        "to_id": "a7b202db-a12c-446b-b6cd-c3cf1a192cd0",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.171Z",
          "created_at": "2026-09-25T11:31:50.777Z",
          "modified": "2026-09-25T11:31:51.089Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:31:51.089Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "86440ebf-51f9-4c87-be4d-dae12ee7c2e1",
        "from_id": "86440ebf-51f9-4c87-be4d-dae12ee7c2e1",
        "from_name": null,
        "from_type": "Indicator",
        "id": "b6fd717a-d771-47eb-b001-85f0ac4ea987",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--ef43c04b-09c2-581d-9cd9-bcfefda38131",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.343Z",
          "created_at": "2026-09-25T11:35:52.919Z",
          "modified": "2026-09-25T11:35:53.167Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:35:53.167Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "8eea5d36-230b-478b-858d-59f6f4a55c3b",
        "from_id": "8eea5d36-230b-478b-858d-59f6f4a55c3b",
        "from_name": null,
        "from_type": "Indicator",
        "id": "b98ac005-2b51-42d9-b8df-238ea215423c",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--106a7a1d-06f2-5caf-8d28-ad0c9e650a99",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.375Z",
          "created_at": "2026-09-25T11:36:25.722Z",
          "modified": "2026-09-25T11:36:26.495Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:36:26.495Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "8fda0fcb-ae48-43fd-948d-652290dc22a5",
        "from_id": "8fda0fcb-ae48-43fd-948d-652290dc22a5",
        "from_name": null,
        "from_type": "Indicator",
        "id": "bb01d181-47b8-427b-b2d1-dad74bb4f077",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--b1d80a61-9fe1-57e4-a0c9-db7c6cbae19d",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.240Z",
          "created_at": "2026-09-25T11:34:31.869Z",
          "modified": "2026-09-25T11:34:32.078Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:34:32.078Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "030563bd-95e2-4178-a888-2a75f885d47e",
        "from_id": "030563bd-95e2-4178-a888-2a75f885d47e",
        "from_name": null,
        "from_type": "Indicator",
        "id": "bb44c167-04b7-49ba-b903-6141dd5dcde0",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--4083f28b-c72f-52b5-8097-f017a145f184",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.921Z",
          "created_at": "2026-09-25T11:28:53.662Z",
          "modified": "2026-09-25T11:28:53.980Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:53.980Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_name": "Glutton",
        "from_type": "Malware",
        "id": "bb9cbfe0-eff4-4d40-a1ed-35781c91d3d4",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--81b7d3a8-b9c2-514b-bddd-73fba85afd80",
        "toId": "647f8a4a-1a25-456b-b2ab-f1675d2014e1",
        "to_id": "647f8a4a-1a25-456b-b2ab-f1675d2014e1",
        "to_name": "CVE-2024-4956",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.422Z",
          "created_at": "2026-09-25T11:36:53.834Z",
          "modified": "2026-09-25T11:36:54.131Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:36:54.131Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "f0965bed-f0b4-4579-a554-479225fc2260",
        "from_id": "f0965bed-f0b4-4579-a554-479225fc2260",
        "from_name": null,
        "from_type": "Indicator",
        "id": "c0c46143-7ea4-4c8f-8d13-d785b34eed3b",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--718216f1-9888-5b47-aba6-11e725b45f28",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.335Z",
          "created_at": "2026-09-25T11:35:43.138Z",
          "modified": "2026-09-25T11:35:43.726Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:35:43.726Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "23121d85-6f9a-45f7-aa0d-ffcbc19df175",
        "from_id": "23121d85-6f9a-45f7-aa0d-ffcbc19df175",
        "from_name": null,
        "from_type": "Indicator",
        "id": "c0fb0ad8-c097-41e8-859d-582a4088cb38",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--84fa37d1-6fcb-5397-a897-0e0f9238ff3b",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.476Z",
          "created_at": "2026-09-25T11:37:42.247Z",
          "modified": "2026-09-25T11:37:42.490Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:37:42.490Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "db29312e-6d9d-4932-8850-bffeda8b932b",
        "from_id": "db29312e-6d9d-4932-8850-bffeda8b932b",
        "from_name": null,
        "from_type": "Indicator",
        "id": "c3507ace-4cdb-4acc-9283-3370168417f4",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--391262d0-877e-5bf6-93f2-ba9cb9deb9a5",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.013Z",
          "created_at": "2026-09-25T11:30:07.977Z",
          "modified": "2026-09-25T11:30:08.850Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:08.850Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "f962693e-2f34-4d4c-b299-3afeb96987aa",
        "from_id": "f962693e-2f34-4d4c-b299-3afeb96987aa",
        "from_name": null,
        "from_type": "Indicator",
        "id": "c5e71c9b-8d01-41ec-9696-d046111b949e",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--da18a04d-41c7-5a11-bd4b-c38b325f956c",
        "toId": "740c6048-9b47-4a64-b58c-098f97e39392",
        "to_id": "740c6048-9b47-4a64-b58c-098f97e39392",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.063Z",
          "created_at": "2026-09-25T11:30:19.817Z",
          "modified": "2026-09-25T11:30:20.156Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:20.156Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "6e99d3f0-8adc-4bcd-845f-8a5116482e69",
        "from_id": "6e99d3f0-8adc-4bcd-845f-8a5116482e69",
        "from_name": null,
        "from_type": "Indicator",
        "id": "c5fdaf9b-5bd4-49bd-8b49-32923efa0358",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--33c50a4a-3413-5320-a145-dccaf59d0fac",
        "toId": "1a7685ee-b6f6-4532-a5e7-5e28e1a41e02",
        "to_id": "1a7685ee-b6f6-4532-a5e7-5e28e1a41e02",
        "to_name": null,
        "to_type": "IPv4Addr"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.909Z",
          "created_at": "2026-09-25T11:28:46.520Z",
          "modified": "2026-09-25T11:28:47.022Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:47.022Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_name": "SecBox",
        "from_type": "Malware",
        "id": "c6227fb7-6fb9-4327-9483-6b8a79703b81",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--e1c61ea3-ce9c-5a10-b270-30380665ae68",
        "toId": "98d3b7c9-4b06-44f1-8b1d-5c459f95abb7",
        "to_id": "98d3b7c9-4b06-44f1-8b1d-5c459f95abb7",
        "to_name": "CVE-2021-29441",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.376Z",
          "created_at": "2026-09-25T11:36:26.907Z",
          "modified": "2026-09-25T11:36:28.298Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:36:28.298Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "8fda0fcb-ae48-43fd-948d-652290dc22a5",
        "from_id": "8fda0fcb-ae48-43fd-948d-652290dc22a5",
        "from_name": null,
        "from_type": "Indicator",
        "id": "c72b86e9-367a-467b-9ef1-d1806c212845",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--2a74726b-6533-576f-81ab-9feef2143946",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.500Z",
          "created_at": "2026-09-25T11:38:14.433Z",
          "modified": "2026-09-25T11:38:14.774Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:38:14.774Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "f556fb44-b049-4bc7-9cea-ad80a92657a9",
        "from_id": "f556fb44-b049-4bc7-9cea-ad80a92657a9",
        "from_name": null,
        "from_type": "Indicator",
        "id": "c7c3d0f9-bcfe-497b-ac16-648e03223a46",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--2e3efdd4-d766-5f20-9cef-1a7f75bb0994",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.391Z",
          "created_at": "2026-09-25T11:36:35.440Z",
          "modified": "2026-09-25T11:36:36.627Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:36:36.627Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "98a9f866-a8f3-4067-8b17-38825d31b5b0",
        "from_id": "98a9f866-a8f3-4067-8b17-38825d31b5b0",
        "from_name": null,
        "from_type": "Indicator",
        "id": "cb59079d-c18f-46c7-9219-5fa14737d5f9",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--acee5c2f-4258-5f0b-971f-03d93c6e50d4",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.999Z",
          "created_at": "2026-09-25T11:30:05.327Z",
          "modified": "2026-09-25T11:30:06.506Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:06.506Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "e7b61757-a84d-4be3-aed4-c249b08d198c",
        "from_id": "e7b61757-a84d-4be3-aed4-c249b08d198c",
        "from_name": null,
        "from_type": "Indicator",
        "id": "ce032d14-e848-4d07-beab-ac1cf53c7b3d",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--2188af07-0536-5b1a-a70c-59288838e379",
        "toId": "65402ba6-da16-4a00-a0fe-9712ee7b5208",
        "to_id": "65402ba6-da16-4a00-a0fe-9712ee7b5208",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.360Z",
          "created_at": "2026-09-25T11:36:12.029Z",
          "modified": "2026-09-25T11:36:12.198Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:36:12.198Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "db984156-b205-4da0-805a-43a90b53458d",
        "from_id": "db984156-b205-4da0-805a-43a90b53458d",
        "from_name": null,
        "from_type": "Indicator",
        "id": "cfa5ba42-b57e-4cdf-9c39-1d9345e69709",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--ae8697fc-3300-5a0f-87c8-ece2af8c23cb",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.900Z",
          "created_at": "2026-09-25T11:28:19.917Z",
          "modified": "2026-09-25T11:28:21.548Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:21.548Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_name": "Glutton",
        "from_type": "Malware",
        "id": "d014a1f7-e862-4cda-8e5c-857d649ed00b",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--d0b51a04-85e9-5736-b5e0-be210e60316c",
        "toId": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed",
        "to_id": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed",
        "to_name": "Education",
        "to_type": "Sector"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.057Z",
          "created_at": "2026-09-25T11:30:19.169Z",
          "modified": "2026-09-25T11:30:19.697Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:19.697Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "ac5b7942-fed5-4b20-8a97-bd9787a47e89",
        "from_id": "ac5b7942-fed5-4b20-8a97-bd9787a47e89",
        "from_name": null,
        "from_type": "Indicator",
        "id": "d0c97ed7-d768-4703-bd46-4c1d46825972",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--20842b79-a7ae-5339-bcab-b899792ce1ea",
        "toId": "50da2c1c-5373-496f-a499-8f02bd56e2ad",
        "to_id": "50da2c1c-5373-496f-a499-8f02bd56e2ad",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.229Z",
          "created_at": "2026-09-25T11:34:22.418Z",
          "modified": "2026-09-25T11:34:23.185Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:34:23.185Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "04c11238-b4ec-4972-a7d6-27acf52a7bdb",
        "from_id": "04c11238-b4ec-4972-a7d6-27acf52a7bdb",
        "from_name": null,
        "from_type": "Indicator",
        "id": "d169b886-e732-4275-b32d-32f0ead41847",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--9e287a6a-453d-51e7-8d89-3d0bbbb92a4d",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.034Z",
          "created_at": "2026-09-25T11:30:14.635Z",
          "modified": "2026-09-25T11:30:15.006Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:15.006Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "1ea86536-3685-4d0b-8beb-78f3c6aba369",
        "from_id": "1ea86536-3685-4d0b-8beb-78f3c6aba369",
        "from_name": null,
        "from_type": "Indicator",
        "id": "d28feae9-db08-4dab-85dc-3a9ea1bf435c",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--c1166679-99c9-5390-8d0f-652a09103ba1",
        "toId": "3538cd43-e839-49fe-837b-8b61ac7bec3c",
        "to_id": "3538cd43-e839-49fe-837b-8b61ac7bec3c",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.230Z",
          "created_at": "2026-09-25T11:34:26.956Z",
          "modified": "2026-09-25T11:34:27.167Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:34:27.167Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "04c11238-b4ec-4972-a7d6-27acf52a7bdb",
        "from_id": "04c11238-b4ec-4972-a7d6-27acf52a7bdb",
        "from_name": null,
        "from_type": "Indicator",
        "id": "d3229ef9-11e1-4759-a619-012f7ce92102",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--da3f76f4-5208-5d7d-ada0-581c53ea93d5",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.015Z",
          "created_at": "2026-09-25T11:30:09.163Z",
          "modified": "2026-09-25T11:30:11.062Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:11.062Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "9c4691bb-a528-4946-93a4-a57229725d5d",
        "from_id": "9c4691bb-a528-4946-93a4-a57229725d5d",
        "from_name": null,
        "from_type": "Indicator",
        "id": "d3bc10f7-c1ef-4960-ad23-aaa098eb796b",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--227ce7d7-0511-50b2-a8c1-d11b547f920b",
        "toId": "ddc7e2c9-1e50-4c61-aa65-e897de0377dc",
        "to_id": "ddc7e2c9-1e50-4c61-aa65-e897de0377dc",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.216Z",
          "created_at": "2026-09-25T11:34:14.161Z",
          "modified": "2026-09-25T11:34:15.777Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:34:15.777Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "b1da6e8a-6e08-41f1-913b-7b932284fca0",
        "from_id": "b1da6e8a-6e08-41f1-913b-7b932284fca0",
        "from_name": null,
        "from_type": "Indicator",
        "id": "d53fa301-0bbe-4dc9-8c42-09d1f039854f",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--b8f58f3b-8b00-5b52-884c-e3c2db3eb65e",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.910Z",
          "created_at": "2026-09-25T11:28:48.538Z",
          "modified": "2026-09-25T11:28:48.869Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:48.869Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "from_name": "SecBox",
        "from_type": "Malware",
        "id": "d59f9474-cfaf-4d21-b71c-30688e5bf913",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--df29ca96-9012-545e-8a06-da4da80d1488",
        "toId": "cfa8b53b-4289-4e4d-b499-82ccb28f496e",
        "to_id": "cfa8b53b-4289-4e4d-b499-82ccb28f496e",
        "to_name": "CVE-2021-43798",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.018Z",
          "created_at": "2026-09-25T11:30:11.003Z",
          "modified": "2026-09-25T11:30:12.038Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:12.038Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "99bbc016-0fcb-4a55-aa06-e4103f4b66a4",
        "from_id": "99bbc016-0fcb-4a55-aa06-e4103f4b66a4",
        "from_name": null,
        "from_type": "Indicator",
        "id": "d6e292d4-9856-476c-a5a6-c4248b2dff91",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--ced69c60-4b34-5834-8a89-79ac4cb1672d",
        "toId": "44f63798-0e3c-42b2-9a1f-ea2b5e9d2d2d",
        "to_id": "44f63798-0e3c-42b2-9a1f-ea2b5e9d2d2d",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.901Z",
          "created_at": "2026-09-25T11:28:22.252Z",
          "modified": "2026-09-25T11:28:22.776Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:22.776Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_name": "Glutton",
        "from_type": "Malware",
        "id": "d7878b29-353d-465b-b086-51c189d979bc",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--2870bef9-b3c3-565b-9517-387394a47a27",
        "toId": "08257c10-e1ae-4471-bc3f-251792c1126c",
        "to_id": "08257c10-e1ae-4471-bc3f-251792c1126c",
        "to_name": "Telecommunications",
        "to_type": "Sector"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.290Z",
          "created_at": "2026-09-25T11:34:54.582Z",
          "modified": "2026-09-25T11:34:54.741Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:34:54.741Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "67291409-fb44-4cf3-b06f-f3a440a134cb",
        "from_id": "67291409-fb44-4cf3-b06f-f3a440a134cb",
        "from_name": null,
        "from_type": "Indicator",
        "id": "dc072391-4709-4585-9282-17c35b56b579",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--5e7f3f1b-6175-509b-90ac-e8f346b7cd3f",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.021Z",
          "created_at": "2026-09-25T11:30:11.256Z",
          "modified": "2026-09-25T11:30:12.446Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:12.446Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "9e65265b-6197-486f-b057-ee5af4142031",
        "from_id": "9e65265b-6197-486f-b057-ee5af4142031",
        "from_name": null,
        "from_type": "Indicator",
        "id": "dc7f86ca-c05e-4df5-9f08-ae7744305c0a",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--e8e01e94-8ae0-5384-a089-858ebd5123ca",
        "toId": "8d3e9ce5-2c6f-4e7a-a23c-f76b1b5eb578",
        "to_id": "8d3e9ce5-2c6f-4e7a-a23c-f76b1b5eb578",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.060Z",
          "created_at": "2026-09-25T11:30:19.385Z",
          "modified": "2026-09-25T11:30:19.957Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:19.957Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "db984156-b205-4da0-805a-43a90b53458d",
        "from_id": "db984156-b205-4da0-805a-43a90b53458d",
        "from_name": null,
        "from_type": "Indicator",
        "id": "e278f851-2bf1-4eb7-bdee-611a7a89ad1f",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--11a0abb5-cd9f-58d9-8fab-418514033574",
        "toId": "2e7dcb76-0539-40f2-83d1-e64425a87424",
        "to_id": "2e7dcb76-0539-40f2-83d1-e64425a87424",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-01-19T16:27:14.407Z",
          "created_at": "2026-02-07T16:07:55.703Z",
          "modified": "2026-02-07T16:07:57.179Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-02-07T16:07:57.179Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "89f87c30-38eb-490d-bf32-0ba45a62701f",
        "from_id": "89f87c30-38eb-490d-bf32-0ba45a62701f",
        "from_name": null,
        "from_type": "Indicator",
        "id": "e475f90d-c37a-4c15-9124-02809c9db371",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--3dd91c90-421e-524b-8bee-cfed3d94b8e9",
        "toId": "0f68b5b1-564b-4f15-84c9-3e40b4590c9d",
        "to_id": "0f68b5b1-564b-4f15-84c9-3e40b4590c9d",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.468Z",
          "created_at": "2026-09-25T11:37:33.355Z",
          "modified": "2026-09-25T11:37:33.556Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:37:33.556Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "0bd5ecc2-d486-4f52-966b-58518a2ff6c1",
        "from_id": "0bd5ecc2-d486-4f52-966b-58518a2ff6c1",
        "from_name": null,
        "from_type": "Indicator",
        "id": "e5a929cf-9d9a-45dd-919a-a3967b6e1c33",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--21b147cd-fb14-56cc-90ba-1f56aca5113b",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.001Z",
          "created_at": "2026-09-25T11:30:06.084Z",
          "modified": "2026-09-25T11:30:07.139Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:07.139Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "16c395d5-bc9f-440b-9ffd-6bfeef0799bf",
        "from_id": "16c395d5-bc9f-440b-9ffd-6bfeef0799bf",
        "from_name": null,
        "from_type": "Indicator",
        "id": "e68fb930-6ff2-4ae0-9c66-d64e317f1124",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--00dcd3e9-c232-57a2-81c8-e25b007e91d3",
        "toId": "531975f1-adc0-498d-ac0e-51c91ec0eac4",
        "to_id": "531975f1-adc0-498d-ac0e-51c91ec0eac4",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.918Z",
          "created_at": "2026-09-25T11:28:51.700Z",
          "modified": "2026-09-25T11:28:52.152Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:52.152Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_name": "Glutton",
        "from_type": "Malware",
        "id": "e8539586-45da-44e2-8cd7-750dd6e1bf1a",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--51ce01ac-6329-57ba-9777-061e6aee4b07",
        "toId": "98d3b7c9-4b06-44f1-8b1d-5c459f95abb7",
        "to_id": "98d3b7c9-4b06-44f1-8b1d-5c459f95abb7",
        "to_name": "CVE-2021-29441",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.139Z",
          "created_at": "2026-09-25T11:31:08.693Z",
          "modified": "2026-09-25T11:31:08.915Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:31:08.915Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "e7b61757-a84d-4be3-aed4-c249b08d198c",
        "from_id": "e7b61757-a84d-4be3-aed4-c249b08d198c",
        "from_name": null,
        "from_type": "Indicator",
        "id": "e86bcdd7-834c-47e2-939c-cbb81b5352c1",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--17d1d587-2ea1-51f1-ab6a-2da5ad156c61",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.327Z",
          "created_at": "2026-09-25T11:35:33.875Z",
          "modified": "2026-09-25T11:35:34.294Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:35:34.294Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "0487a567-5c15-46f1-ac79-9a55cabe1e46",
        "from_id": "0487a567-5c15-46f1-ac79-9a55cabe1e46",
        "from_name": null,
        "from_type": "Indicator",
        "id": "e8e99c38-2f52-47f9-96a7-b8c047cc52a8",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--67f04727-5efc-5ac9-9bc2-a1592e3e1dbd",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.517Z",
          "created_at": "2026-09-25T11:38:35.938Z",
          "modified": "2026-09-25T11:38:36.534Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:38:36.534Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "55582c90-ef77-43d4-81d9-244d1a5b1df7",
        "from_id": "55582c90-ef77-43d4-81d9-244d1a5b1df7",
        "from_name": null,
        "from_type": "Indicator",
        "id": "ea53764c-731b-4c88-996b-f40eedb19537",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--b2f361a8-ebdf-551d-a890-24f9c479a989",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.352Z",
          "created_at": "2026-09-25T11:36:04.139Z",
          "modified": "2026-09-25T11:36:04.471Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:36:04.471Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "ac5b7942-fed5-4b20-8a97-bd9787a47e89",
        "from_id": "ac5b7942-fed5-4b20-8a97-bd9787a47e89",
        "from_name": null,
        "from_type": "Indicator",
        "id": "eac4de81-4e24-4787-bf01-9a0c35a979d6",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--58accd9d-7d84-5fce-ad8f-38e9347898ac",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.109Z",
          "created_at": "2026-09-25T11:30:37.221Z",
          "modified": "2026-09-25T11:30:37.429Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:37.429Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "89f87c30-38eb-490d-bf32-0ba45a62701f",
        "from_id": "89f87c30-38eb-490d-bf32-0ba45a62701f",
        "from_name": null,
        "from_type": "Indicator",
        "id": "ee2f7b0f-cf81-48af-85cf-c23275b1d82d",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--de10575a-8671-5acf-953e-07e9a94da31f",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.139Z",
          "created_at": "2026-09-25T11:31:10.310Z",
          "modified": "2026-09-25T11:31:10.684Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:31:10.684Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "e7b61757-a84d-4be3-aed4-c249b08d198c",
        "from_id": "e7b61757-a84d-4be3-aed4-c249b08d198c",
        "from_name": null,
        "from_type": "Indicator",
        "id": "efe24c33-64ae-4987-84aa-c0daca3708dc",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--cf4f0616-38d8-588d-af96-51de8cb2199e",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.916Z",
          "created_at": "2026-09-25T11:28:54.279Z",
          "modified": "2026-09-25T11:28:54.847Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:54.847Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_name": "Glutton",
        "from_type": "Malware",
        "id": "f04909eb-dd77-4e5b-b37a-1861d5710e74",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--8b916555-5e2c-508c-bd15-cbc133de85f4",
        "toId": "ea11a4cc-e594-4e18-b6c3-c9138cebabf3",
        "to_id": "ea11a4cc-e594-4e18-b6c3-c9138cebabf3",
        "to_name": "CVE-2020-1938",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:19.915Z",
          "created_at": "2026-09-25T11:28:50.946Z",
          "modified": "2026-09-25T11:28:51.302Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:28:51.302Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_name": "Glutton",
        "from_type": "Malware",
        "id": "f1cda8d7-d760-4cc6-9039-664c088f71d9",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--fb2e2966-0e39-5164-9260-73f6183a073d",
        "toId": "752a1bdd-3da2-4925-829b-63ddd793e841",
        "to_id": "752a1bdd-3da2-4925-829b-63ddd793e841",
        "to_name": "CVE-2016-4437",
        "to_type": "Vulnerability"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.010Z",
          "created_at": "2026-09-25T11:30:07.983Z",
          "modified": "2026-09-25T11:30:08.847Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:08.847Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "86440ebf-51f9-4c87-be4d-dae12ee7c2e1",
        "from_id": "86440ebf-51f9-4c87-be4d-dae12ee7c2e1",
        "from_name": null,
        "from_type": "Indicator",
        "id": "f3ce5462-8f06-46b3-87dd-3eeee8282bc8",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--74123451-04e8-5be2-803d-2114d4687add",
        "toId": "042a0aa4-f669-42bb-9484-a1caca264589",
        "to_id": "042a0aa4-f669-42bb-9484-a1caca264589",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.507Z",
          "created_at": "2026-09-25T11:38:24.059Z",
          "modified": "2026-09-25T11:38:24.682Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:38:24.682Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "ace41c62-607c-4359-9b07-c9da5a8c0e0a",
        "from_id": "ace41c62-607c-4359-9b07-c9da5a8c0e0a",
        "from_name": null,
        "from_type": "Indicator",
        "id": "f5a732f2-13f2-43e5-a4a9-f5ba88a7dd61",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--b715aa70-c029-5aa9-b931-92692854c2df",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.076Z",
          "created_at": "2026-09-25T11:30:24.535Z",
          "modified": "2026-09-25T11:30:25.542Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:25.542Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "0f574f6c-99d0-4113-a3c8-d42c090c5ff6",
        "from_id": "0f574f6c-99d0-4113-a3c8-d42c090c5ff6",
        "from_name": null,
        "from_type": "Indicator",
        "id": "f5f7c4a4-4263-4899-87ef-02573177fea7",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--3914e883-d47a-5374-af82-65c256c1e4a8",
        "toId": "94563d94-7c0e-43b9-8698-4cfda56fd47a",
        "to_id": "94563d94-7c0e-43b9-8698-4cfda56fd47a",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.029Z",
          "created_at": "2026-09-25T11:30:13.628Z",
          "modified": "2026-09-25T11:30:14.067Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:14.067Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "030563bd-95e2-4178-a888-2a75f885d47e",
        "from_id": "030563bd-95e2-4178-a888-2a75f885d47e",
        "from_name": null,
        "from_type": "Indicator",
        "id": "f71bf150-603c-4885-83cf-def2fc50a1dc",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--175b8adf-9ec8-5e9c-81bf-f835a2f6526d",
        "toId": "65c55cc2-d509-4e22-9849-30459e79fb87",
        "to_id": "65c55cc2-d509-4e22-9849-30459e79fb87",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.344Z",
          "created_at": "2026-09-25T11:35:53.667Z",
          "modified": "2026-09-25T11:35:54.709Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:35:54.709Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "8eea5d36-230b-478b-858d-59f6f4a55c3b",
        "from_id": "8eea5d36-230b-478b-858d-59f6f4a55c3b",
        "from_name": null,
        "from_type": "Indicator",
        "id": "f786422d-905a-4cad-8ea3-b9b5473192f0",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--46c64345-b8c3-55d9-9149-d48636cc8759",
        "toId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "to_name": "Glutton",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.092Z",
          "created_at": "2026-09-25T11:30:28.852Z",
          "modified": "2026-09-25T11:30:29.336Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:29.336Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "ddb31a53-2e5a-4074-87e5-437ff450d235",
        "from_id": "ddb31a53-2e5a-4074-87e5-437ff450d235",
        "from_name": null,
        "from_type": "Indicator",
        "id": "f86b0716-fc02-4ada-abfc-b3aeeebac55d",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--0398371f-010b-5e5b-a5f0-149d46803dff",
        "toId": "9e4d5da0-bc7d-4267-800e-7bdccbf6ae69",
        "to_id": "9e4d5da0-bc7d-4267-800e-7bdccbf6ae69",
        "to_name": null,
        "to_type": "Hostname"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.069Z",
          "created_at": "2026-09-25T11:30:20.444Z",
          "modified": "2026-09-25T11:30:21.092Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:21.092Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "98a9f866-a8f3-4067-8b17-38825d31b5b0",
        "from_id": "98a9f866-a8f3-4067-8b17-38825d31b5b0",
        "from_name": null,
        "from_type": "Indicator",
        "id": "f985d15e-53c6-4497-a4be-df85ddc6790b",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--e8cc185f-38b6-5789-bcf3-12ce10e660c0",
        "toId": "130ecd19-0fd7-429c-ba5e-0f0062d69898",
        "to_id": "130ecd19-0fd7-429c-ba5e-0f0062d69898",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-01-19T20:14:20.975Z",
          "created_at": "2026-03-20T10:34:33.052Z",
          "modified": "2026-03-20T10:34:33.414Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-03-20T10:34:33.414Z"
        },
        "description_available": false,
        "entity_type": "targets",
        "fromId": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "from_name": "Glutton",
        "from_type": "Malware",
        "id": "f9e2967d-25a6-4353-ac9a-1bf810a16026",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "targets",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--b748a9e9-7fab-5ff3-9261-719178cd5b4a",
        "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a",
        "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a",
        "to_name": "Government and administrations",
        "to_type": "Sector"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.050Z",
          "created_at": "2026-09-25T11:30:18.382Z",
          "modified": "2026-09-25T11:30:19.056Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:19.056Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "23121d85-6f9a-45f7-aa0d-ffcbc19df175",
        "from_id": "23121d85-6f9a-45f7-aa0d-ffcbc19df175",
        "from_name": null,
        "from_type": "Indicator",
        "id": "fba0981b-e161-4356-8e21-2a6fbc0d11c3",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--097b345a-4d47-5729-ae2e-4535e487c2b0",
        "toId": "419df831-4a4f-4e98-a297-bae3a7bb53bb",
        "to_id": "419df831-4a4f-4e98-a297-bae3a7bb53bb",
        "to_name": null,
        "to_type": "StixFile"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.517Z",
          "created_at": "2026-09-25T11:38:33.621Z",
          "modified": "2026-09-25T11:38:35.254Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:38:35.254Z"
        },
        "description_available": false,
        "entity_type": "indicates",
        "fromId": "55582c90-ef77-43d4-81d9-244d1a5b1df7",
        "from_id": "55582c90-ef77-43d4-81d9-244d1a5b1df7",
        "from_name": null,
        "from_type": "Indicator",
        "id": "fdbf7617-f6da-42ca-8b95-9d9d8a4bd1a9",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "indicates",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--d6181c25-e9bd-5b62-a882-7ed894b661c9",
        "toId": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "to_name": "SecBox",
        "to_type": "Malware"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.079Z",
          "created_at": "2026-09-25T11:30:24.530Z",
          "modified": "2026-09-25T11:30:25.541Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:25.541Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "78df0f58-436e-4889-90d8-1c2685bb68ae",
        "from_id": "78df0f58-436e-4889-90d8-1c2685bb68ae",
        "from_name": null,
        "from_type": "Indicator",
        "id": "fdc609da-7d41-418e-921c-ffc6bbf442b7",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--00e4bf5f-6081-5210-b7eb-799d0d68dd38",
        "toId": "0e8efb60-4556-4db5-90c0-021f57d8d269",
        "to_id": "0e8efb60-4556-4db5-90c0-021f57d8d269",
        "to_name": null,
        "to_type": "Url"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:48:20.084Z",
          "created_at": "2026-09-25T11:30:26.026Z",
          "modified": "2026-09-25T11:30:26.696Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-25T11:30:26.696Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "7a4b611c-7cb7-43b5-b257-5114cb6aef9f",
        "from_id": "7a4b611c-7cb7-43b5-b257-5114cb6aef9f",
        "from_name": null,
        "from_type": "Indicator",
        "id": "ff28172b-48d4-49d2-850e-e49c4037bbaf",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "standard_id": "relationship--38cad497-8882-5147-89b5-b113f6d16278",
        "toId": "304545c7-be38-41d9-8532-e9857b2fb2ab",
        "to_id": "304545c7-be38-41d9-8532-e9857b2fb2ab",
        "to_name": null,
        "to_type": "Url"
      }
    ],
    "iocs": [
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "103[.]45[.]65[.]93",
        "description_available": false,
        "object_id": "6e99d3f0-8adc-4bcd-845f-8a5116482e69",
        "object_ids": [
          "1a7685ee-b6f6-4532-a5e7-5e28e1a41e02",
          "6e99d3f0-8adc-4bcd-845f-8a5116482e69"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "6e99d3f0-8adc-4bcd-845f-8a5116482e69",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2026-09-23T23:01:01.434Z",
            "validity_status": "revoked",
            "value": "103.45.65.93"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet IPv4Addr explicitement associé au rapport source.",
            "object_id": "1a7685ee-b6f6-4532-a5e7-5e28e1a41e02",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "103.45.65.93"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "ipv4",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2026-09-23T23:01:01.434Z",
        "validity_status": "revoked",
        "value": "103.45.65.93"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "00759d29178baabcbe9682a953c64e179fd24d86dac0d6abdc8e5070216923f2",
        "description_available": false,
        "object_id": "4ac1f979-42e9-4928-a7be-ea9f98bbc29e",
        "object_ids": [
          "3494c909-cd93-4813-a248-91f0623d82c1",
          "4ac1f979-42e9-4928-a7be-ea9f98bbc29e"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "4ac1f979-42e9-4928-a7be-ea9f98bbc29e",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "00759d29178baabcbe9682a953c64e179fd24d86dac0d6abdc8e5070216923f2"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "3494c909-cd93-4813-a248-91f0623d82c1",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "00759d29178baabcbe9682a953c64e179fd24d86dac0d6abdc8e5070216923f2"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "00759d29178baabcbe9682a953c64e179fd24d86dac0d6abdc8e5070216923f2"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "053c8dfb147262aaedf0d9cdce631ad73cfd5b1a808114c12bbe5adfe4796302",
        "description_available": false,
        "object_id": "6886e013-939f-4410-9dc1-cc1f81de1964",
        "object_ids": [
          "6886e013-939f-4410-9dc1-cc1f81de1964",
          "7505178f-5612-4e63-8e8a-a1c4258086c5"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "6886e013-939f-4410-9dc1-cc1f81de1964",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "053c8dfb147262aaedf0d9cdce631ad73cfd5b1a808114c12bbe5adfe4796302"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "7505178f-5612-4e63-8e8a-a1c4258086c5",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "053c8dfb147262aaedf0d9cdce631ad73cfd5b1a808114c12bbe5adfe4796302"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "053c8dfb147262aaedf0d9cdce631ad73cfd5b1a808114c12bbe5adfe4796302"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "0b3d76cf1ac6648d4cfbe39c8fea67c6b28a361ea6de86a92cc7d54a0181cc9e",
        "description_available": false,
        "object_id": "e7b61757-a84d-4be3-aed4-c249b08d198c",
        "object_ids": [
          "65402ba6-da16-4a00-a0fe-9712ee7b5208",
          "e7b61757-a84d-4be3-aed4-c249b08d198c"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "e7b61757-a84d-4be3-aed4-c249b08d198c",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "0b3d76cf1ac6648d4cfbe39c8fea67c6b28a361ea6de86a92cc7d54a0181cc9e"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "65402ba6-da16-4a00-a0fe-9712ee7b5208",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "0b3d76cf1ac6648d4cfbe39c8fea67c6b28a361ea6de86a92cc7d54a0181cc9e"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "0b3d76cf1ac6648d4cfbe39c8fea67c6b28a361ea6de86a92cc7d54a0181cc9e"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "135b33b289d481d60fa2527aeae5882d33adcb6756df89ea7684f4af3567b141",
        "description_available": false,
        "object_id": "16c395d5-bc9f-440b-9ffd-6bfeef0799bf",
        "object_ids": [
          "16c395d5-bc9f-440b-9ffd-6bfeef0799bf",
          "531975f1-adc0-498d-ac0e-51c91ec0eac4"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "16c395d5-bc9f-440b-9ffd-6bfeef0799bf",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "135b33b289d481d60fa2527aeae5882d33adcb6756df89ea7684f4af3567b141"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "531975f1-adc0-498d-ac0e-51c91ec0eac4",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "135b33b289d481d60fa2527aeae5882d33adcb6756df89ea7684f4af3567b141"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "135b33b289d481d60fa2527aeae5882d33adcb6756df89ea7684f4af3567b141"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "1c00ce5354c91a9db878e2b4db750c2a74140e0d15aeac9b8cecf4599598b736",
        "description_available": false,
        "object_id": "813df622-c624-4d52-80db-5e35fb4cb1b9",
        "object_ids": [
          "813df622-c624-4d52-80db-5e35fb4cb1b9",
          "915aff68-0fa0-4907-b057-c12ef2573cb6"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "813df622-c624-4d52-80db-5e35fb4cb1b9",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "1c00ce5354c91a9db878e2b4db750c2a74140e0d15aeac9b8cecf4599598b736"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "915aff68-0fa0-4907-b057-c12ef2573cb6",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "1c00ce5354c91a9db878e2b4db750c2a74140e0d15aeac9b8cecf4599598b736"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "1c00ce5354c91a9db878e2b4db750c2a74140e0d15aeac9b8cecf4599598b736"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "20a8ed7d235cf6419e2d4b1e439595ef96961adaecf3c990c5cd507eb4a74ca4",
        "description_available": false,
        "object_id": "e710f05a-d70b-49f6-8a6a-64855677b7c1",
        "object_ids": [
          "942e517e-5ef8-4a4f-9a8e-2721d9f40e68",
          "e710f05a-d70b-49f6-8a6a-64855677b7c1"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "e710f05a-d70b-49f6-8a6a-64855677b7c1",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "20a8ed7d235cf6419e2d4b1e439595ef96961adaecf3c990c5cd507eb4a74ca4"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "942e517e-5ef8-4a4f-9a8e-2721d9f40e68",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "20a8ed7d235cf6419e2d4b1e439595ef96961adaecf3c990c5cd507eb4a74ca4"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "20a8ed7d235cf6419e2d4b1e439595ef96961adaecf3c990c5cd507eb4a74ca4"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "218d8508c2035c78b49d33e087e33643f4f906af5694be68cf939f17fa4b5ffd",
        "description_available": false,
        "object_id": "86440ebf-51f9-4c87-be4d-dae12ee7c2e1",
        "object_ids": [
          "042a0aa4-f669-42bb-9484-a1caca264589",
          "86440ebf-51f9-4c87-be4d-dae12ee7c2e1"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "86440ebf-51f9-4c87-be4d-dae12ee7c2e1",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "218d8508c2035c78b49d33e087e33643f4f906af5694be68cf939f17fa4b5ffd"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "042a0aa4-f669-42bb-9484-a1caca264589",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "218d8508c2035c78b49d33e087e33643f4f906af5694be68cf939f17fa4b5ffd"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "218d8508c2035c78b49d33e087e33643f4f906af5694be68cf939f17fa4b5ffd"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "27fae1b7be68b0c27c5dad33aaed9de5b38406fb20b971757b6be386e3ffc7a6",
        "description_available": false,
        "object_id": "f962693e-2f34-4d4c-b299-3afeb96987aa",
        "object_ids": [
          "740c6048-9b47-4a64-b58c-098f97e39392",
          "f962693e-2f34-4d4c-b299-3afeb96987aa"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "f962693e-2f34-4d4c-b299-3afeb96987aa",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "27fae1b7be68b0c27c5dad33aaed9de5b38406fb20b971757b6be386e3ffc7a6"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "740c6048-9b47-4a64-b58c-098f97e39392",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "27fae1b7be68b0c27c5dad33aaed9de5b38406fb20b971757b6be386e3ffc7a6"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "27fae1b7be68b0c27c5dad33aaed9de5b38406fb20b971757b6be386e3ffc7a6"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "2deac4ab60f6cb1bb65fa4df5dbd9dcf7b7bc27e16bea55c3ddbe47154720277",
        "description_available": false,
        "object_id": "9c4691bb-a528-4946-93a4-a57229725d5d",
        "object_ids": [
          "9c4691bb-a528-4946-93a4-a57229725d5d",
          "ddc7e2c9-1e50-4c61-aa65-e897de0377dc"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "9c4691bb-a528-4946-93a4-a57229725d5d",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "2deac4ab60f6cb1bb65fa4df5dbd9dcf7b7bc27e16bea55c3ddbe47154720277"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "ddc7e2c9-1e50-4c61-aa65-e897de0377dc",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "2deac4ab60f6cb1bb65fa4df5dbd9dcf7b7bc27e16bea55c3ddbe47154720277"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "2deac4ab60f6cb1bb65fa4df5dbd9dcf7b7bc27e16bea55c3ddbe47154720277"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "3c9b2ec423f91642d2d09031d47e50d7ebe77a8b12ec5e393405f85da11a0f6a",
        "description_available": false,
        "object_id": "99bbc016-0fcb-4a55-aa06-e4103f4b66a4",
        "object_ids": [
          "44f63798-0e3c-42b2-9a1f-ea2b5e9d2d2d",
          "99bbc016-0fcb-4a55-aa06-e4103f4b66a4"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "99bbc016-0fcb-4a55-aa06-e4103f4b66a4",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "3c9b2ec423f91642d2d09031d47e50d7ebe77a8b12ec5e393405f85da11a0f6a"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "44f63798-0e3c-42b2-9a1f-ea2b5e9d2d2d",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "3c9b2ec423f91642d2d09031d47e50d7ebe77a8b12ec5e393405f85da11a0f6a"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "3c9b2ec423f91642d2d09031d47e50d7ebe77a8b12ec5e393405f85da11a0f6a"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "4ecbdaedf9040dbbb33ce7a96ad961dce0f3ffb2c41285606a27a7c5ab3d2273",
        "description_available": false,
        "object_id": "9e65265b-6197-486f-b057-ee5af4142031",
        "object_ids": [
          "8d3e9ce5-2c6f-4e7a-a23c-f76b1b5eb578",
          "9e65265b-6197-486f-b057-ee5af4142031"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "9e65265b-6197-486f-b057-ee5af4142031",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "4ecbdaedf9040dbbb33ce7a96ad961dce0f3ffb2c41285606a27a7c5ab3d2273"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "8d3e9ce5-2c6f-4e7a-a23c-f76b1b5eb578",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "4ecbdaedf9040dbbb33ce7a96ad961dce0f3ffb2c41285606a27a7c5ab3d2273"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "4ecbdaedf9040dbbb33ce7a96ad961dce0f3ffb2c41285606a27a7c5ab3d2273"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "548df87041ea2cbe99fc519fd89c5b7cdfe935d87a803a80a5f747aa9f076091",
        "description_available": false,
        "object_id": "b1da6e8a-6e08-41f1-913b-7b932284fca0",
        "object_ids": [
          "28d269ea-ee81-4290-95bc-b28fac9b157d",
          "b1da6e8a-6e08-41f1-913b-7b932284fca0"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "b1da6e8a-6e08-41f1-913b-7b932284fca0",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "548df87041ea2cbe99fc519fd89c5b7cdfe935d87a803a80a5f747aa9f076091"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "28d269ea-ee81-4290-95bc-b28fac9b157d",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "548df87041ea2cbe99fc519fd89c5b7cdfe935d87a803a80a5f747aa9f076091"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "548df87041ea2cbe99fc519fd89c5b7cdfe935d87a803a80a5f747aa9f076091"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "77f5b5321e2f5c18b3c610e50084b98201fb6214e13665cc49da5afbf3f49611",
        "description_available": false,
        "object_id": "04c11238-b4ec-4972-a7d6-27acf52a7bdb",
        "object_ids": [
          "04c11238-b4ec-4972-a7d6-27acf52a7bdb",
          "4555c7d4-fc02-4904-8e9b-c1416a5a1273"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "04c11238-b4ec-4972-a7d6-27acf52a7bdb",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "77f5b5321e2f5c18b3c610e50084b98201fb6214e13665cc49da5afbf3f49611"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "4555c7d4-fc02-4904-8e9b-c1416a5a1273",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "77f5b5321e2f5c18b3c610e50084b98201fb6214e13665cc49da5afbf3f49611"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "77f5b5321e2f5c18b3c610e50084b98201fb6214e13665cc49da5afbf3f49611"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "797676d3becc124bb6705ebd76189e8decedae3abf978434d730459133351064",
        "description_available": false,
        "object_id": "030563bd-95e2-4178-a888-2a75f885d47e",
        "object_ids": [
          "030563bd-95e2-4178-a888-2a75f885d47e",
          "65c55cc2-d509-4e22-9849-30459e79fb87"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "030563bd-95e2-4178-a888-2a75f885d47e",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "797676d3becc124bb6705ebd76189e8decedae3abf978434d730459133351064"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "65c55cc2-d509-4e22-9849-30459e79fb87",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "797676d3becc124bb6705ebd76189e8decedae3abf978434d730459133351064"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "797676d3becc124bb6705ebd76189e8decedae3abf978434d730459133351064"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "79cc5855375b5c840bae8263dc3dc5a9fd9cbd7920ab4ed65d407fd830d3eda1",
        "description_available": false,
        "object_id": "d127fb55-e610-4fc7-bbf9-f6ebf159de49",
        "object_ids": [
          "46756e4f-2682-4d50-ac50-98f618fd4f39",
          "d127fb55-e610-4fc7-bbf9-f6ebf159de49"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "d127fb55-e610-4fc7-bbf9-f6ebf159de49",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "79cc5855375b5c840bae8263dc3dc5a9fd9cbd7920ab4ed65d407fd830d3eda1"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "46756e4f-2682-4d50-ac50-98f618fd4f39",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "79cc5855375b5c840bae8263dc3dc5a9fd9cbd7920ab4ed65d407fd830d3eda1"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "79cc5855375b5c840bae8263dc3dc5a9fd9cbd7920ab4ed65d407fd830d3eda1"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "80d778c9d9e44896f08b1a196254527e39da4e8ce5edebf8d296b7dec6b7b3e0",
        "description_available": false,
        "object_id": "1ea86536-3685-4d0b-8beb-78f3c6aba369",
        "object_ids": [
          "1ea86536-3685-4d0b-8beb-78f3c6aba369",
          "3538cd43-e839-49fe-837b-8b61ac7bec3c"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "1ea86536-3685-4d0b-8beb-78f3c6aba369",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "80d778c9d9e44896f08b1a196254527e39da4e8ce5edebf8d296b7dec6b7b3e0"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "3538cd43-e839-49fe-837b-8b61ac7bec3c",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "80d778c9d9e44896f08b1a196254527e39da4e8ce5edebf8d296b7dec6b7b3e0"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "80d778c9d9e44896f08b1a196254527e39da4e8ce5edebf8d296b7dec6b7b3e0"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "853222ffdcc74dd606f6ff79ff353ce3626d50e54e9aa1a87fb03e2121e82aaf",
        "description_available": false,
        "object_id": "67291409-fb44-4cf3-b06f-f3a440a134cb",
        "object_ids": [
          "235fb1f3-9cfb-4e55-90f6-6cdcb0ac66f1",
          "67291409-fb44-4cf3-b06f-f3a440a134cb"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "67291409-fb44-4cf3-b06f-f3a440a134cb",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "853222ffdcc74dd606f6ff79ff353ce3626d50e54e9aa1a87fb03e2121e82aaf"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "235fb1f3-9cfb-4e55-90f6-6cdcb0ac66f1",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "853222ffdcc74dd606f6ff79ff353ce3626d50e54e9aa1a87fb03e2121e82aaf"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "853222ffdcc74dd606f6ff79ff353ce3626d50e54e9aa1a87fb03e2121e82aaf"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "9ef85857ed2b53a23eb41ce5769b4fb5b8b2225404b227a776520771df86706e",
        "description_available": false,
        "object_id": "80d53d58-6a2c-4dfa-9e8d-542acc144bc8",
        "object_ids": [
          "4fa47aea-54e6-4343-8a8d-69135f159209",
          "80d53d58-6a2c-4dfa-9e8d-542acc144bc8"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "80d53d58-6a2c-4dfa-9e8d-542acc144bc8",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "9ef85857ed2b53a23eb41ce5769b4fb5b8b2225404b227a776520771df86706e"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "4fa47aea-54e6-4343-8a8d-69135f159209",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "9ef85857ed2b53a23eb41ce5769b4fb5b8b2225404b227a776520771df86706e"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "9ef85857ed2b53a23eb41ce5769b4fb5b8b2225404b227a776520771df86706e"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "a407f540f4eb0c8fae5cd83fa6e210df6c4ed7fca6aedb6ebc5efbf031989ac4",
        "description_available": false,
        "object_id": "be82d031-8282-4109-92bc-98f208b855e5",
        "object_ids": [
          "44695416-e20e-49ca-bad7-84aeaa41f0b3",
          "be82d031-8282-4109-92bc-98f208b855e5"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "be82d031-8282-4109-92bc-98f208b855e5",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "a407f540f4eb0c8fae5cd83fa6e210df6c4ed7fca6aedb6ebc5efbf031989ac4"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "44695416-e20e-49ca-bad7-84aeaa41f0b3",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "a407f540f4eb0c8fae5cd83fa6e210df6c4ed7fca6aedb6ebc5efbf031989ac4"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "a407f540f4eb0c8fae5cd83fa6e210df6c4ed7fca6aedb6ebc5efbf031989ac4"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "af6404a125d1e4eb67425ec17f2abeec7242fb6f7377de739e47cb7f5d147eee",
        "description_available": false,
        "object_id": "99c10a57-16a9-47ef-95dd-5d9e568b6fdd",
        "object_ids": [
          "7bd77322-0405-4d8c-966d-c1e948645afd",
          "99c10a57-16a9-47ef-95dd-5d9e568b6fdd"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "99c10a57-16a9-47ef-95dd-5d9e568b6fdd",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "af6404a125d1e4eb67425ec17f2abeec7242fb6f7377de739e47cb7f5d147eee"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "7bd77322-0405-4d8c-966d-c1e948645afd",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "af6404a125d1e4eb67425ec17f2abeec7242fb6f7377de739e47cb7f5d147eee"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "af6404a125d1e4eb67425ec17f2abeec7242fb6f7377de739e47cb7f5d147eee"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "dcd59349bd6cc29e59da5105f2f08f606ece8dfac4e369e052eca1786450f541",
        "description_available": false,
        "object_id": "0487a567-5c15-46f1-ac79-9a55cabe1e46",
        "object_ids": [
          "0487a567-5c15-46f1-ac79-9a55cabe1e46",
          "ebdeab82-dc9a-442e-9caa-bf06d6241549"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "0487a567-5c15-46f1-ac79-9a55cabe1e46",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "dcd59349bd6cc29e59da5105f2f08f606ece8dfac4e369e052eca1786450f541"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "ebdeab82-dc9a-442e-9caa-bf06d6241549",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "dcd59349bd6cc29e59da5105f2f08f606ece8dfac4e369e052eca1786450f541"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "dcd59349bd6cc29e59da5105f2f08f606ece8dfac4e369e052eca1786450f541"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "e6ee24c6775867714d1e4b586d75c0168e61ba49b36e0a29b73cbc925df6ae47",
        "description_available": false,
        "object_id": "23121d85-6f9a-45f7-aa0d-ffcbc19df175",
        "object_ids": [
          "23121d85-6f9a-45f7-aa0d-ffcbc19df175",
          "419df831-4a4f-4e98-a297-bae3a7bb53bb"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "23121d85-6f9a-45f7-aa0d-ffcbc19df175",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "e6ee24c6775867714d1e4b586d75c0168e61ba49b36e0a29b73cbc925df6ae47"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "419df831-4a4f-4e98-a297-bae3a7bb53bb",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "e6ee24c6775867714d1e4b586d75c0168e61ba49b36e0a29b73cbc925df6ae47"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "e6ee24c6775867714d1e4b586d75c0168e61ba49b36e0a29b73cbc925df6ae47"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "eef30bb6834bf349d1b1f4401aa0b8e73631ea632a884c6498a5b3a9e069d412",
        "description_available": false,
        "object_id": "8eea5d36-230b-478b-858d-59f6f4a55c3b",
        "object_ids": [
          "8eea5d36-230b-478b-858d-59f6f4a55c3b",
          "d9b5409e-5a97-485c-929e-0a7a7350cf52"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "8eea5d36-230b-478b-858d-59f6f4a55c3b",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "eef30bb6834bf349d1b1f4401aa0b8e73631ea632a884c6498a5b3a9e069d412"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "d9b5409e-5a97-485c-929e-0a7a7350cf52",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "eef30bb6834bf349d1b1f4401aa0b8e73631ea632a884c6498a5b3a9e069d412"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "eef30bb6834bf349d1b1f4401aa0b8e73631ea632a884c6498a5b3a9e069d412"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "f51ab15a89155ce4d3bcd0a65cf6a3ccf62115f502e0863c19baf93d11c57acc",
        "description_available": false,
        "object_id": "ac5b7942-fed5-4b20-8a97-bd9787a47e89",
        "object_ids": [
          "50da2c1c-5373-496f-a499-8f02bd56e2ad",
          "ac5b7942-fed5-4b20-8a97-bd9787a47e89"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "ac5b7942-fed5-4b20-8a97-bd9787a47e89",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "f51ab15a89155ce4d3bcd0a65cf6a3ccf62115f502e0863c19baf93d11c57acc"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "50da2c1c-5373-496f-a499-8f02bd56e2ad",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "f51ab15a89155ce4d3bcd0a65cf6a3ccf62115f502e0863c19baf93d11c57acc"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "f51ab15a89155ce4d3bcd0a65cf6a3ccf62115f502e0863c19baf93d11c57acc"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "f7c233df3423912296a4e78dd1fa7a1f6412606177336be0762961c93e8fae3c",
        "description_available": false,
        "object_id": "db984156-b205-4da0-805a-43a90b53458d",
        "object_ids": [
          "2e7dcb76-0539-40f2-83d1-e64425a87424",
          "db984156-b205-4da0-805a-43a90b53458d"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "db984156-b205-4da0-805a-43a90b53458d",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2027-06-21T04:36:06.557Z",
            "validity_status": "active",
            "value": "f7c233df3423912296a4e78dd1fa7a1f6412606177336be0762961c93e8fae3c"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "2e7dcb76-0539-40f2-83d1-e64425a87424",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "f7c233df3423912296a4e78dd1fa7a1f6412606177336be0762961c93e8fae3c"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "sha256",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2027-06-21T04:36:06.557Z",
        "validity_status": "active",
        "value": "f7c233df3423912296a4e78dd1fa7a1f6412606177336be0762961c93e8fae3c"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxp[:]//imported-concerns-listening-typing[.]trycloudflare[.]com[:]443",
        "description_available": false,
        "object_id": "98a9f866-a8f3-4067-8b17-38825d31b5b0",
        "object_ids": [
          "130ecd19-0fd7-429c-ba5e-0f0062d69898",
          "98a9f866-a8f3-4067-8b17-38825d31b5b0"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "98a9f866-a8f3-4067-8b17-38825d31b5b0",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2026-09-23T23:01:01.434Z",
            "validity_status": "revoked",
            "value": "http://imported-concerns-listening-typing.trycloudflare.com:443"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "130ecd19-0fd7-429c-ba5e-0f0062d69898",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "http://imported-concerns-listening-typing.trycloudflare.com:443"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "url",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2026-09-23T23:01:01.434Z",
        "validity_status": "revoked",
        "value": "http://imported-concerns-listening-typing.trycloudflare.com:443"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxp[:]//marriage-step-wave-heavy[.]trycloudflare[.]com[:]443",
        "description_available": false,
        "object_id": "df99b492-86ae-4152-a08e-0bb6bdd7a458",
        "object_ids": [
          "637f2235-e7ea-45a7-9279-87a183b6dd80",
          "df99b492-86ae-4152-a08e-0bb6bdd7a458"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "df99b492-86ae-4152-a08e-0bb6bdd7a458",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2026-09-23T23:01:01.434Z",
            "validity_status": "revoked",
            "value": "http://marriage-step-wave-heavy.trycloudflare.com:443"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "637f2235-e7ea-45a7-9279-87a183b6dd80",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "http://marriage-step-wave-heavy.trycloudflare.com:443"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "url",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2026-09-23T23:01:01.434Z",
        "validity_status": "revoked",
        "value": "http://marriage-step-wave-heavy.trycloudflare.com:443"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxp[:]//wins-say-charm-social[.]trycloudflare[.]com/c2",
        "description_available": false,
        "object_id": "f0965bed-f0b4-4579-a554-479225fc2260",
        "object_ids": [
          "729ae26c-7838-4385-89c3-d6f6c1dc2547",
          "f0965bed-f0b4-4579-a554-479225fc2260"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "f0965bed-f0b4-4579-a554-479225fc2260",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2026-09-23T23:01:01.434Z",
            "validity_status": "revoked",
            "value": "http://wins-say-charm-social.trycloudflare.com/c2"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "729ae26c-7838-4385-89c3-d6f6c1dc2547",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "http://wins-say-charm-social.trycloudflare.com/c2"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "url",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2026-09-23T23:01:01.434Z",
        "validity_status": "revoked",
        "value": "http://wins-say-charm-social.trycloudflare.com/c2"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxps[:]//claude[.]niestools[.]com",
        "description_available": false,
        "object_id": "0f574f6c-99d0-4113-a3c8-d42c090c5ff6",
        "object_ids": [
          "0f574f6c-99d0-4113-a3c8-d42c090c5ff6",
          "94563d94-7c0e-43b9-8698-4cfda56fd47a"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "0f574f6c-99d0-4113-a3c8-d42c090c5ff6",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2026-09-23T23:01:01.434Z",
            "validity_status": "revoked",
            "value": "https://claude.niestools.com"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "94563d94-7c0e-43b9-8698-4cfda56fd47a",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "https://claude.niestools.com"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "url",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2026-09-23T23:01:01.434Z",
        "validity_status": "revoked",
        "value": "https://claude.niestools.com"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxps[:]//deepseek[.]niestools[.]com/anthropic",
        "description_available": false,
        "object_id": "78df0f58-436e-4889-90d8-1c2685bb68ae",
        "object_ids": [
          "0e8efb60-4556-4db5-90c0-021f57d8d269",
          "78df0f58-436e-4889-90d8-1c2685bb68ae"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "78df0f58-436e-4889-90d8-1c2685bb68ae",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2026-09-23T23:01:01.434Z",
            "validity_status": "revoked",
            "value": "https://deepseek.niestools.com/anthropic"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "0e8efb60-4556-4db5-90c0-021f57d8d269",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "https://deepseek.niestools.com/anthropic"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "url",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2026-09-23T23:01:01.434Z",
        "validity_status": "revoked",
        "value": "https://deepseek.niestools.com/anthropic"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxps[:]//deepseek[.]niestools[.]com/v1",
        "description_available": false,
        "object_id": "8652a66a-1bbb-4aeb-96b0-00dddbcba7d3",
        "object_ids": [
          "8652a66a-1bbb-4aeb-96b0-00dddbcba7d3",
          "f1e52e35-ce7d-4bb2-9d2d-9e05d7fc0855"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "8652a66a-1bbb-4aeb-96b0-00dddbcba7d3",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2026-09-23T23:01:01.434Z",
            "validity_status": "revoked",
            "value": "https://deepseek.niestools.com/v1"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "f1e52e35-ce7d-4bb2-9d2d-9e05d7fc0855",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "https://deepseek.niestools.com/v1"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "url",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2026-09-23T23:01:01.434Z",
        "validity_status": "revoked",
        "value": "https://deepseek.niestools.com/v1"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "hxxps[:]//glutton[.]niestools[.]com",
        "description_available": false,
        "object_id": "7a4b611c-7cb7-43b5-b257-5114cb6aef9f",
        "object_ids": [
          "304545c7-be38-41d9-8532-e9857b2fb2ab",
          "7a4b611c-7cb7-43b5-b257-5114cb6aef9f"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "7a4b611c-7cb7-43b5-b257-5114cb6aef9f",
            "valid_from": "2026-09-03T17:26:22.000Z",
            "valid_until": "2026-09-23T23:01:01.434Z",
            "validity_status": "revoked",
            "value": "https://glutton.niestools.com"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet Url explicitement associé au rapport source.",
            "object_id": "304545c7-be38-41d9-8532-e9857b2fb2ab",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "https://glutton.niestools.com"
          }
        ],
        "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia",
        "type": "url",
        "valid_from": "2026-09-03T17:26:22.000Z",
        "valid_until": "2026-09-23T23:01:01.434Z",
        "validity_status": "revoked",
        "value": "https://glutton.niestools.com"
      }
    ],
    "mentioned": [
      {
        "confidence": 50,
        "evidence_id": "2fce65dd-35cd-4551-b4a5-06a544f817d3",
        "name": "Glutton",
        "role": "mentionné",
        "type": "Malware"
      },
      {
        "confidence": 50,
        "evidence_id": "9ab4ca19-4789-450a-bd01-6c0a09cd894d",
        "name": "SecBox",
        "role": "mentionné",
        "type": "Malware"
      },
      {
        "confidence": 80,
        "evidence_id": "44543676-564d-428f-93d4-412969169a8d",
        "name": "CVE-2014-6271",
        "role": "mentionné",
        "type": "Vulnerability"
      },
      {
        "confidence": 80,
        "evidence_id": "752a1bdd-3da2-4925-829b-63ddd793e841",
        "name": "CVE-2016-4437",
        "role": "mentionné",
        "type": "Vulnerability"
      },
      {
        "confidence": 80,
        "evidence_id": "ea11a4cc-e594-4e18-b6c3-c9138cebabf3",
        "name": "CVE-2020-1938",
        "role": "mentionné",
        "type": "Vulnerability"
      },
      {
        "confidence": 50,
        "evidence_id": "98d3b7c9-4b06-44f1-8b1d-5c459f95abb7",
        "name": "CVE-2021-29441",
        "role": "mentionné",
        "type": "Vulnerability"
      },
      {
        "confidence": 80,
        "evidence_id": "cfa8b53b-4289-4e4d-b499-82ccb28f496e",
        "name": "CVE-2021-43798",
        "role": "mentionné",
        "type": "Vulnerability"
      },
      {
        "confidence": 80,
        "evidence_id": "ebcc7e47-61c4-43a6-8605-4a202598eada",
        "name": "CVE-2021-44228",
        "role": "mentionné",
        "type": "Vulnerability"
      },
      {
        "confidence": 80,
        "evidence_id": "e6a2db30-d198-49d9-8ba2-9d861062bf46",
        "name": "CVE-2022-22965",
        "role": "mentionné",
        "type": "Vulnerability"
      },
      {
        "confidence": 50,
        "evidence_id": "647f8a4a-1a25-456b-b2ab-f1675d2014e1",
        "name": "CVE-2024-4956",
        "role": "mentionné",
        "type": "Vulnerability"
      }
    ],
    "mitre": {
      "associated_repertoire": [],
      "direct_techniques": []
    },
    "report_metadata": {
      "authorized_members": [],
      "confidence": 50,
      "created_by": null,
      "dates": {
        "created": "2026-09-03T17:26:22.072Z",
        "created_at": "2026-09-25T11:40:08.888Z",
        "modified": "2026-09-25T11:40:10.895Z",
        "published": "2026-09-03T17:26:22.072Z",
        "updated_at": "2026-09-25T11:40:10.895Z"
      },
      "description_available": true,
      "id": "290ccb6d-e76a-406d-a880-a07d47e3e647",
      "is_inferred": false,
      "labels": [
        "ai-assisted intrusions",
        "fengtai government",
        "glutton",
        "glutton webshells",
        "secbox",
        "secflow framework",
        "steganographic payloads"
      ],
      "lang": "en",
      "name": "Chinese-Speaking Operator Uses AI Agents to Target Government and Education Systems Across Asia",
      "objectMarking": [
        {
          "definition": "TLP:CLEAR",
          "definition_type": "TLP"
        }
      ],
      "objectOrganization": [],
      "published": "2026-09-03T17:26:22.072Z",
      "references": [
        {
          "external_id": null,
          "id": "1646ac2a-3139-4c76-984d-87ebd82824e7",
          "source_name": "alien-vault",
          "url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia"
        },
        {
          "external_id": "6a99adbec32d94dc6cd05ee1",
          "id": "52f2b835-822d-4700-a599-5a6d4dd73c6f",
          "source_name": "alien-vault",
          "url": "https://otx.alienvault.com/pulse/6a99adbec32d94dc6cd05ee1"
        }
      ],
      "report_types": [
        "threat-report"
      ],
      "restrict_access": false,
      "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia"
    },
    "targets": [
      {
        "confidence": 50,
        "evidence_id": "d014a1f7-e862-4cda-8e5c-857d649ed00b",
        "name": "Education",
        "role": "cible déclarée (relation targets)",
        "type": "Sector"
      },
      {
        "confidence": 50,
        "evidence_id": "f9e2967d-25a6-4353-ac9a-1bf810a16026",
        "name": "Government and administrations",
        "role": "cible déclarée (relation targets)",
        "type": "Sector"
      },
      {
        "confidence": 50,
        "evidence_id": "d7878b29-353d-465b-b086-51c189d979bc",
        "name": "Telecommunications",
        "role": "cible déclarée (relation targets)",
        "type": "Sector"
      }
    ],
    "techniques": [],
    "vulnerabilities": [
      "CVE-2014-6271",
      "CVE-2016-4437",
      "CVE-2020-1938",
      "CVE-2021-29441",
      "CVE-2021-43798",
      "CVE-2021-44228",
      "CVE-2022-22965",
      "CVE-2024-4956"
    ]
  },
  "report_id": "290ccb6d-e76a-406d-a880-a07d47e3e647",
  "schema_version": 1,
  "selected_date": "2026-09-03",
  "source_url": "https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia"
}