{
  "intelligence": {
    "actors": [],
    "counts": {
      "actors": 0,
      "associated_entity_contexts": 0,
      "deduplicated_iocs": 2,
      "direct_entities": 11,
      "direct_relationships": 5,
      "invalid_iocs": 0,
      "iocs": 2,
      "mentioned": 7,
      "mitre_associated": 0,
      "mitre_direct": 0,
      "targets": 0,
      "techniques": 0,
      "unsupported_indicators": 0,
      "vulnerabilities": 0
    },
    "coverage": {
      "associated_repertoire_is_incident_evidence": false,
      "attribution_policy": "explicit-public-relationships-only",
      "descriptions_publicly_exported": false,
      "excluded_context_objects": 0,
      "excluded_graph_objects": 19,
      "graph_complete": true,
      "graph_objects": 11,
      "graph_relationships": 5,
      "mitre_context_complete": true,
      "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
      "status_as_of": "2026-10-10T05:21:21+00:00",
      "table_preview_limit": 20
    },
    "direct_entities": [
      {
        "__typename": "Region",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:37.014Z",
          "created_at": "2026-01-18T14:36:09.111Z",
          "modified": "2026-01-18T14:36:09.339Z",
          "updated_at": "2026-01-18T14:36:09.339Z"
        },
        "description_available": false,
        "entity_type": "Region",
        "id": "0584d53c-836c-41a4-a732-0edcc5dea653",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "Americas",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "location--bce21a59-810c-5c81-863c-23546cb0d6a0",
        "type": "Region"
      },
      {
        "__typename": "Sector",
        "aliases": [
          "Bitcoin",
          "Crypto",
          "Cryptocurrency",
          "Currency Exchange",
          "IT",
          "Information Security",
          "Software Development",
          "Technology",
          "Virtual Currency",
          "Vulnerability Research",
          "software"
        ],
        "attributes": {},
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:33.394Z",
          "created_at": "2026-01-18T14:35:11.762Z",
          "modified": "2026-03-09T09:41:22.635Z",
          "updated_at": "2026-03-09T09:41:22.635Z"
        },
        "description_available": true,
        "entity_type": "Sector",
        "id": "25243a50-06ec-4c1b-8fb2-6a96793e8404",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "Technologies",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "identity--dcacaabc-1244-51fd-8e75-59f4a6fe0aad",
        "type": "Sector"
      },
      {
        "__typename": "Country",
        "aliases": [
          "US",
          "USA"
        ],
        "attributes": {},
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:37.034Z",
          "created_at": "2026-01-18T14:36:25.804Z",
          "modified": "2026-01-20T20:57:15.092Z",
          "updated_at": "2026-01-20T20:57:15.092Z"
        },
        "description_available": false,
        "entity_type": "Country",
        "id": "3460c7f0-1521-461b-af64-2de060664fb1",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "United States of America",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "location--e79b4cf1-a256-5efa-bc74-c94c7c7ffde0",
        "type": "Country"
      },
      {
        "__typename": "Region",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:37.032Z",
          "created_at": "2026-01-18T14:36:24.671Z",
          "modified": "2026-01-18T14:36:24.965Z",
          "updated_at": "2026-01-18T14:36:24.965Z"
        },
        "description_available": false,
        "entity_type": "Region",
        "id": "3f84bc21-010c-46a3-bad3-432dcd70f556",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "Northern America",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "location--713e5fdc-da7b-5735-958d-d7dc664efa7f",
        "type": "Region"
      },
      {
        "__typename": "DomainName",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T06:14:48.247Z",
          "updated_at": "2026-09-26T06:14:48.862Z"
        },
        "description_available": false,
        "entity_type": "Domain-Name",
        "id": "46cdf4dc-71a0-4843-abe8-de390befa6e1",
        "is_inferred": false,
        "labels": [
          "ai-assisted attacks",
          "business email compromise",
          "financial fraud",
          "phishing campaign",
          "servicenow impersonation"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "domain-name--392acd53-d9a2-5be6-92b1-889bd75453e7",
        "type": "DomainName"
      },
      {
        "__typename": "DomainName",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T06:14:48.490Z",
          "updated_at": "2026-09-26T06:14:49.030Z"
        },
        "description_available": false,
        "entity_type": "Domain-Name",
        "id": "46dbb824-1f92-4989-8cf5-e146dcfec031",
        "is_inferred": false,
        "labels": [
          "ai-assisted attacks",
          "business email compromise",
          "financial fraud",
          "phishing campaign",
          "servicenow impersonation"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "domain-name--e483a32f-6dd1-522f-bbd1-73ec18d24454",
        "type": "DomainName"
      },
      {
        "__typename": "Sector",
        "aliases": [
          "Financial",
          "Financial Industry (FI)",
          "Financial Services",
          "Financial-Services"
        ],
        "attributes": {},
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:33.391Z",
          "created_at": "2026-01-18T14:35:07.063Z",
          "modified": "2026-01-22T20:49:24.280Z",
          "updated_at": "2026-01-22T20:49:24.280Z"
        },
        "description_available": true,
        "entity_type": "Sector",
        "id": "6839ec2a-a1ec-4851-b89f-8923c0d36135",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "Finance",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "identity--283d4ea0-b6f1-5421-bdab-117a33fdb2b7",
        "type": "Sector"
      },
      {
        "__typename": "Sector",
        "aliases": [
          "ICS",
          "Industrial Control Systems",
          "Utilities",
          "industrial"
        ],
        "attributes": {},
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:33.395Z",
          "created_at": "2026-01-18T14:35:12.982Z",
          "modified": "2026-02-05T15:16:55.400Z",
          "updated_at": "2026-02-05T15:16:55.400Z"
        },
        "description_available": true,
        "entity_type": "Sector",
        "id": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "Manufacturing",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "identity--3b7bc57f-b0b6-5dc2-a816-6406ae1d6da1",
        "type": "Sector"
      },
      {
        "__typename": "Sector",
        "aliases": [
          "Commercial",
          "Distribution",
          "Ecommerce",
          "Retail",
          "Wholesale",
          "commerce",
          "e-commerce"
        ],
        "attributes": {},
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:33.395Z",
          "created_at": "2026-01-18T14:35:13.667Z",
          "modified": "2026-03-24T16:46:51.749Z",
          "updated_at": "2026-03-24T16:46:51.749Z"
        },
        "description_available": true,
        "entity_type": "Sector",
        "id": "91056407-714a-47ac-b73f-5d9d01d4a220",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "Retail (distribution)",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "identity--a3a1e23d-8249-575e-86d4-2d691b08802d",
        "type": "Sector"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Domain-Name",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:36.498Z",
          "created_at": "2026-09-26T06:14:49.063Z",
          "modified": "2026-09-26T06:14:54.104Z",
          "updated_at": "2026-09-26T06:14:54.104Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "b7c3f15e-baa8-4288-a87c-b3b58b330bd4",
        "is_inferred": false,
        "labels": [
          "ai-assisted attacks",
          "business email compromise",
          "financial fraud",
          "phishing campaign",
          "servicenow impersonation"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "indicator--9729fafc-8c2a-5185-9641-3b348720051a",
        "type": "Indicator"
      },
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "Domain-Name",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:36.501Z",
          "created_at": "2026-09-26T06:14:50.211Z",
          "modified": "2026-09-26T06:14:56.808Z",
          "updated_at": "2026-09-26T06:14:56.808Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "d96e4544-07c8-4308-a830-001d170717d7",
        "is_inferred": false,
        "labels": [
          "ai-assisted attacks",
          "business email compromise",
          "financial fraud",
          "phishing campaign",
          "servicenow impersonation"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "indicator--cd502c20-e15e-5c9c-8fed-ebaf6e1916f0",
        "type": "Indicator"
      }
    ],
    "direct_relationships": [
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:36.503Z",
          "created_at": "2026-09-26T06:14:50.802Z",
          "modified": "2026-09-26T06:14:52.636Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:14:52.636Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "d96e4544-07c8-4308-a830-001d170717d7",
        "from_id": "d96e4544-07c8-4308-a830-001d170717d7",
        "from_name": null,
        "from_type": "Indicator",
        "id": "439f3b48-dbc6-4c68-8581-5693672217c7",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "relationship--ff0b4a8b-6d8f-5130-9628-4f0a7cbd2371",
        "toId": "46dbb824-1f92-4989-8cf5-e146dcfec031",
        "to_id": "46dbb824-1f92-4989-8cf5-e146dcfec031",
        "to_name": null,
        "to_type": "DomainName"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:37.032Z",
          "created_at": "2026-01-18T14:38:39.061Z",
          "modified": "2026-01-18T14:38:39.335Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-01-18T14:38:39.335Z"
        },
        "description_available": true,
        "entity_type": "located-at",
        "fromId": "3f84bc21-010c-46a3-bad3-432dcd70f556",
        "from_id": "3f84bc21-010c-46a3-bad3-432dcd70f556",
        "from_name": "Northern America",
        "from_type": "Region",
        "id": "4a3ffcd5-bd03-47c6-a71d-4c47c1151811",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "located-at",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "relationship--35fa17bc-cd76-5e88-b582-d1c577aa86ba",
        "toId": "0584d53c-836c-41a4-a732-0edcc5dea653",
        "to_id": "0584d53c-836c-41a4-a732-0edcc5dea653",
        "to_name": "Americas",
        "to_type": "Region"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:54:36.500Z",
          "created_at": "2026-09-26T06:14:50.187Z",
          "modified": "2026-09-26T06:14:50.489Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T06:14:50.489Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "b7c3f15e-baa8-4288-a87c-b3b58b330bd4",
        "from_id": "b7c3f15e-baa8-4288-a87c-b3b58b330bd4",
        "from_name": null,
        "from_type": "Indicator",
        "id": "777b7a21-51ac-4a56-9df9-ba8223d1f0ef",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "relationship--6a76cf8e-8f1e-53a8-9e8d-03bdf17e1785",
        "toId": "46cdf4dc-71a0-4843-abe8-de390befa6e1",
        "to_id": "46cdf4dc-71a0-4843-abe8-de390befa6e1",
        "to_name": null,
        "to_type": "DomainName"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:33.395Z",
          "created_at": "2026-01-18T14:35:34.859Z",
          "modified": "2026-01-18T14:35:35.083Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-01-18T14:35:35.083Z"
        },
        "description_available": true,
        "entity_type": "part-of",
        "fromId": "91056407-714a-47ac-b73f-5d9d01d4a220",
        "from_id": "91056407-714a-47ac-b73f-5d9d01d4a220",
        "from_name": "Retail (distribution)",
        "from_type": "Sector",
        "id": "ba52f2c9-5233-440f-bef8-6a15d290bc38",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "part-of",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "relationship--5fc33e30-9815-5b29-bce2-05c44ca9155f",
        "toId": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8",
        "to_id": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8",
        "to_name": "Manufacturing",
        "to_type": "Sector"
      },
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 100,
        "created_by": {
          "authorized_members": [],
          "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038",
          "is_inferred": false,
          "name": "Filigran",
          "objectMarking": [
            {
              "definition": "TLP:CLEAR",
              "definition_type": "TLP"
            }
          ],
          "objectOrganization": [],
          "restrict_access": false,
          "type": "Organization"
        },
        "dates": {
          "created": "2023-11-19T00:56:37.035Z",
          "created_at": "2026-01-18T14:38:41.111Z",
          "modified": "2026-01-18T14:38:41.841Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-01-18T14:38:41.841Z"
        },
        "description_available": true,
        "entity_type": "located-at",
        "fromId": "3460c7f0-1521-461b-af64-2de060664fb1",
        "from_id": "3460c7f0-1521-461b-af64-2de060664fb1",
        "from_name": "United States of America",
        "from_type": "Country",
        "id": "daee60ed-495b-4626-8967-6a667c789917",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "located-at",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "standard_id": "relationship--98d1ce2f-0759-5c90-a6e9-100a3a2299a7",
        "toId": "3f84bc21-010c-46a3-bad3-432dcd70f556",
        "to_id": "3f84bc21-010c-46a3-bad3-432dcd70f556",
        "to_name": "Northern America",
        "to_type": "Region"
      }
    ],
    "iocs": [
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "domainlify[.]net",
        "description_available": false,
        "object_id": "b7c3f15e-baa8-4288-a87c-b3b58b330bd4",
        "object_ids": [
          "46cdf4dc-71a0-4843-abe8-de390befa6e1",
          "b7c3f15e-baa8-4288-a87c-b3b58b330bd4"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "b7c3f15e-baa8-4288-a87c-b3b58b330bd4",
            "valid_from": "2026-09-10T22:24:24.000Z",
            "valid_until": "2026-12-22T13:19:32.260Z",
            "validity_status": "active",
            "value": "domainlify.net"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet DomainName explicitement associé au rapport source.",
            "object_id": "46cdf4dc-71a0-4843-abe8-de390befa6e1",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "domainlify.net"
          }
        ],
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "type": "domain",
        "valid_from": "2026-09-10T22:24:24.000Z",
        "valid_until": "2026-12-22T13:19:32.260Z",
        "validity_status": "active",
        "value": "domainlify.net"
      },
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "service-nowinc[.]com",
        "description_available": false,
        "object_id": "d96e4544-07c8-4308-a830-001d170717d7",
        "object_ids": [
          "46dbb824-1f92-4989-8cf5-e146dcfec031",
          "d96e4544-07c8-4308-a830-001d170717d7"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "d96e4544-07c8-4308-a830-001d170717d7",
            "valid_from": "2026-09-10T22:24:24.000Z",
            "valid_until": "2026-12-22T13:19:32.260Z",
            "validity_status": "active",
            "value": "service-nowinc.com"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet DomainName explicitement associé au rapport source.",
            "object_id": "46dbb824-1f92-4989-8cf5-e146dcfec031",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "service-nowinc.com"
          }
        ],
        "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/",
        "type": "domain",
        "valid_from": "2026-09-10T22:24:24.000Z",
        "valid_until": "2026-12-22T13:19:32.260Z",
        "validity_status": "active",
        "value": "service-nowinc.com"
      }
    ],
    "mentioned": [
      {
        "confidence": 100,
        "evidence_id": "3460c7f0-1521-461b-af64-2de060664fb1",
        "name": "United States of America",
        "role": "mentionné",
        "type": "Country"
      },
      {
        "confidence": 100,
        "evidence_id": "0584d53c-836c-41a4-a732-0edcc5dea653",
        "name": "Americas",
        "role": "mentionné",
        "type": "Region"
      },
      {
        "confidence": 100,
        "evidence_id": "3f84bc21-010c-46a3-bad3-432dcd70f556",
        "name": "Northern America",
        "role": "mentionné",
        "type": "Region"
      },
      {
        "confidence": 100,
        "evidence_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135",
        "name": "Finance",
        "role": "mentionné",
        "type": "Sector"
      },
      {
        "confidence": 100,
        "evidence_id": "81046c4a-e720-4ab0-aa35-7ef2df50d1a8",
        "name": "Manufacturing",
        "role": "mentionné",
        "type": "Sector"
      },
      {
        "confidence": 100,
        "evidence_id": "91056407-714a-47ac-b73f-5d9d01d4a220",
        "name": "Retail (distribution)",
        "role": "mentionné",
        "type": "Sector"
      },
      {
        "confidence": 100,
        "evidence_id": "25243a50-06ec-4c1b-8fb2-6a96793e8404",
        "name": "Technologies",
        "role": "mentionné",
        "type": "Sector"
      }
    ],
    "mitre": {
      "associated_repertoire": [],
      "direct_techniques": []
    },
    "report_metadata": {
      "authorized_members": [],
      "confidence": 50,
      "created_by": null,
      "dates": {
        "created": "2026-09-10T22:24:24.274Z",
        "created_at": "2026-09-26T06:15:07.740Z",
        "modified": "2026-09-26T06:15:20.717Z",
        "published": "2026-09-10T22:24:24.274Z",
        "updated_at": "2026-09-26T06:15:20.717Z"
      },
      "description_available": true,
      "id": "7cab450b-abf1-4e0d-8e8f-78b6a7a9a6e8",
      "is_inferred": false,
      "labels": [
        "ai-assisted attacks",
        "business email compromise",
        "financial fraud",
        "phishing campaign",
        "servicenow impersonation"
      ],
      "lang": "en",
      "name": "Protecting organizations from AI-assisted executive impersonation and invoice fraud",
      "objectMarking": [
        {
          "definition": "TLP:CLEAR",
          "definition_type": "TLP"
        }
      ],
      "objectOrganization": [],
      "published": "2026-09-10T22:24:24.274Z",
      "references": [
        {
          "external_id": null,
          "id": "92131bcf-1cda-4191-8491-31ed98c33088",
          "source_name": "alien-vault",
          "url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/"
        },
        {
          "external_id": "6aa32e18e05f67823c9c16ad",
          "id": "2f8bbd04-060d-44a2-ba68-c16761840781",
          "source_name": "alien-vault",
          "url": "https://otx.alienvault.com/pulse/6aa32e18e05f67823c9c16ad"
        }
      ],
      "report_types": [
        "threat-report"
      ],
      "restrict_access": false,
      "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/"
    },
    "targets": [],
    "techniques": [],
    "vulnerabilities": []
  },
  "report_id": "7cab450b-abf1-4e0d-8e8f-78b6a7a9a6e8",
  "schema_version": 1,
  "selected_date": "2026-09-11",
  "source_url": "https://www.microsoft.com/en-us/security/blog/2026/09/10/protecting-organizations-ai-assisted-executive-impersonation-invoice-fraud/"
}