{ "intelligence": { "actors": [ { "confidence": 50, "evidence_id": "cf677a90-235f-49bb-bb71-7553825d0dbb", "name": "TA419", "role": "acteur lié (relation targets)", "type": "Intrusion-Set" } ], "counts": { "actors": 1, "associated_entity_contexts": 0, "deduplicated_iocs": 20, "direct_entities": 51, "direct_relationships": 50, "invalid_iocs": 0, "iocs": 20, "mentioned": 4, "mitre_associated": 0, "mitre_direct": 0, "targets": 6, "techniques": 0, "unsupported_indicators": 0, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 0, "excluded_graph_objects": 2, "graph_complete": true, "graph_objects": 51, "graph_relationships": 50, "mitre_context_complete": true, "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "status_as_of": "2026-10-08T07:51:52+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.014Z", "created_at": "2026-01-18T14:36:09.111Z", "modified": "2026-01-18T14:36:09.339Z", "updated_at": "2026-01-18T14:36:09.339Z" }, "description_available": false, "entity_type": "Region", "id": "0584d53c-836c-41a4-a732-0edcc5dea653", "is_inferred": false, "labels": [], "lang": "en", "name": "Americas", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "location--bce21a59-810c-5c81-863c-23546cb0d6a0", "type": "Region" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.647Z", "created_at": "2026-10-03T04:30:24.137Z", "modified": "2026-10-03T08:53:11.011Z", "updated_at": "2026-10-03T08:53:11.011Z" }, "description_available": false, "entity_type": "Indicator", "id": "0990242a-9937-40fb-99b2-efa127063973", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--77f6ba31-9711-5a80-af41-899cb2184a99", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:28:32.369Z", "updated_at": "2026-10-03T04:28:37.556Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "141654d3-47f6-4b08-9ff9-a3d60440072b", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--195a4715-bdc7-59c9-a241-236c42585e6e", "type": "DomainName" }, { "__typename": "Sector", "aliases": [ "Bitcoin", "Crypto", "Cryptocurrency", "Currency Exchange", "IT", "Information Security", "Software Development", "Technology", "Virtual Currency", "Vulnerability Research", "software" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.394Z", "created_at": "2026-01-18T14:35:11.762Z", "modified": "2026-03-09T09:41:22.635Z", "updated_at": "2026-03-09T09:41:22.635Z" }, "description_available": true, "entity_type": "Sector", "id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "is_inferred": false, "labels": [], "lang": "en", "name": "Technologies", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "identity--dcacaabc-1244-51fd-8e75-59f4a6fe0aad", "type": "Sector" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:28:51.978Z", "updated_at": "2026-10-03T04:28:56.326Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "27723208-1ad0-42d4-af23-634a6d4fbc88", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--2ba7b35a-858c-55a5-98c4-0a3bd099fdf6", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.665Z", "created_at": "2026-10-03T04:31:07.963Z", "modified": "2026-10-03T08:55:19.204Z", "updated_at": "2026-10-03T08:55:19.204Z" }, "description_available": false, "entity_type": "Indicator", "id": "2e4013c0-29f2-4a46-b361-bfe125e9ebaf", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--ec137829-65bb-549a-be77-aaf3ed00b7c8", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.645Z", "created_at": "2026-10-03T04:30:24.114Z", "modified": "2026-10-03T08:53:11.357Z", "updated_at": "2026-10-03T08:53:11.357Z" }, "description_available": false, "entity_type": "Indicator", "id": "2edd13cd-b78f-4ff6-b588-9b36b14df2c4", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--0ced48a6-7e35-5bad-bd9f-0f466c990805", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:29:42.786Z", "updated_at": "2026-10-03T04:29:46.637Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "306c5e0e-0ed2-4865-a6a4-24addcc394af", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--f8c84142-dffc-5377-b9a7-6ad149d020dc", "type": "DomainName" }, { "__typename": "Country", "aliases": [ "US", "USA" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.034Z", "created_at": "2026-01-18T14:36:25.804Z", "modified": "2026-01-20T20:57:15.092Z", "updated_at": "2026-01-20T20:57:15.092Z" }, "description_available": false, "entity_type": "Country", "id": "3460c7f0-1521-461b-af64-2de060664fb1", "is_inferred": false, "labels": [], "lang": "en", "name": "United States of America", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "location--e79b4cf1-a256-5efa-bc74-c94c7c7ffde0", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.032Z", "created_at": "2026-01-18T14:36:24.671Z", "modified": "2026-01-18T14:36:24.965Z", "updated_at": "2026-01-18T14:36:24.965Z" }, "description_available": false, "entity_type": "Region", "id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "is_inferred": false, "labels": [], "lang": "en", "name": "Northern America", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "location--713e5fdc-da7b-5735-958d-d7dc664efa7f", "type": "Region" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:28:33.641Z", "updated_at": "2026-10-03T04:28:37.558Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "42b54c07-bce7-4b5a-86d8-e17c16de9591", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--0f3f1095-0f1c-5073-a150-5667795e30af", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.656Z", "created_at": "2026-10-03T04:30:44.711Z", "modified": "2026-10-03T08:53:16.515Z", "updated_at": "2026-10-03T08:53:16.515Z" }, "description_available": false, "entity_type": "Indicator", "id": "47326564-9115-4476-89ec-a3a855d9c74c", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--6bada14f-05a1-5e94-955e-b28211eee9e4", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:29:07.273Z", "updated_at": "2026-10-03T04:29:12.353Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "4ad74042-613b-425c-9e4f-fbac137005cb", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--d020efd6-42eb-5c91-beba-9fd65883bbbc", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:29:26.655Z", "updated_at": "2026-10-03T04:29:35.513Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "51ba129b-495b-4c8b-957d-c1b1fa7bb840", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--bf5d8f87-96d0-5114-b626-3201e06615c9", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:29:17.730Z", "updated_at": "2026-10-03T04:29:28.208Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "5b8c0be0-6a56-4182-8438-6c8e367dc417", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--9a5c00d2-0fba-55a4-b386-bba54020dbfe", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.680Z", "created_at": "2026-10-03T04:31:23.506Z", "modified": "2026-10-03T08:55:25.909Z", "updated_at": "2026-10-03T08:55:25.909Z" }, "description_available": false, "entity_type": "Indicator", "id": "5d94da68-6e05-4dbb-a012-593f0e01ca08", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--6a0c8cbd-3823-524e-a9d1-945eb00953aa", "type": "Indicator" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.038Z", "created_at": "2026-01-18T14:36:27.648Z", "modified": "2026-01-18T14:36:28.240Z", "updated_at": "2026-01-18T14:36:28.240Z" }, "description_available": false, "entity_type": "Region", "id": "5e22af61-1616-46dc-b076-551e7f99593f", "is_inferred": false, "labels": [], "lang": "en", "name": "Eastern Asia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "location--c5a2d626-2be3-5cee-b643-773a32d19ce0", "type": "Region" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:29:33.719Z", "updated_at": "2026-10-03T04:29:35.519Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "61ca1b30-54cf-4aa5-bbcd-d7be79134e43", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--d657728e-6a88-5de1-9e66-dc1c87bd4c3c", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:28:44.107Z", "updated_at": "2026-10-03T04:28:46.537Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "68c07e88-6f37-40e5-85a1-e8e62dc3c47b", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--e2eefac4-456f-5146-b14a-e6fa34509efa", "type": "DomainName" }, { "__typename": "Country", "aliases": [ "JP", "JPN" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.040Z", "created_at": "2026-01-18T14:36:28.776Z", "modified": "2026-01-25T16:24:47.859Z", "updated_at": "2026-01-25T16:24:47.859Z" }, "description_available": false, "entity_type": "Country", "id": "7a370bce-880b-477d-b87c-2fc78164dde9", "is_inferred": false, "labels": [], "lang": "en", "name": "Japan", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "location--5c26fa61-1bce-5286-900c-9ac7d4d93276", "type": "Country" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.035Z", "created_at": "2026-01-18T14:36:26.119Z", "modified": "2026-01-18T14:36:26.275Z", "updated_at": "2026-01-18T14:36:26.275Z" }, "description_available": false, "entity_type": "Region", "id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "is_inferred": false, "labels": [], "lang": "en", "name": "Asia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "location--68241bf7-96c8-5542-b488-3b8fe8f51aff", "type": "Region" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:29:26.652Z", "updated_at": "2026-10-03T04:29:35.511Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "7fb385e9-2bb9-4fd7-bb4d-79e206c33d41", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--f4c63238-ffce-544a-9d9a-5ca9f26c9fa0", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.663Z", "created_at": "2026-10-03T04:30:58.363Z", "modified": "2026-10-03T08:55:16.826Z", "updated_at": "2026-10-03T08:55:16.826Z" }, "description_available": false, "entity_type": "Indicator", "id": "8144c731-1161-43a3-80dd-93f140d63133", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--2f5ae8f5-34b2-573b-8d31-00c601939ff5", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.632Z", "created_at": "2026-10-03T04:29:55.031Z", "modified": "2026-10-03T08:53:06.703Z", "updated_at": "2026-10-03T08:53:06.703Z" }, "description_available": false, "entity_type": "Indicator", "id": "827905bd-d884-4094-b82e-29818f637006", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--2222684f-b156-5da8-9551-dd3a5f1ad240", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:29:42.801Z", "updated_at": "2026-10-03T04:29:46.631Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "8305bb8c-3580-4da2-abf9-22a1a8b45f86", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--f0d65143-7bb6-578e-9c13-afa9139fbecc", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:28:42.390Z", "updated_at": "2026-10-03T04:28:44.694Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "833fac8b-c833-4fa0-92ba-ccc0019cc46f", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--fcec5c7c-9df8-5bc2-87e3-95975fdaf5d4", "type": "DomainName" }, { "__typename": "Sector", "aliases": [ "Defence", "National Security" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.390Z", "created_at": "2026-01-18T14:35:06.351Z", "modified": "2026-02-22T09:57:31.072Z", "updated_at": "2026-02-22T09:57:31.072Z" }, "description_available": true, "entity_type": "Sector", "id": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "is_inferred": false, "labels": [], "lang": "en", "name": "Defense", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "identity--a60aa444-a004-5549-9dcf-5798d82b34da", "type": "Sector" }, { "__typename": "Sector", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.388Z", "created_at": "2026-01-18T14:35:02.955Z", "modified": "2026-01-20T20:57:28.767Z", "updated_at": "2026-01-20T20:57:28.767Z" }, "description_available": true, "entity_type": "Sector", "id": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed", "is_inferred": false, "labels": [], "lang": "en", "name": "Education", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "identity--2b0657c7-cf11-5d30-8867-4c6d9dd99270", "type": "Sector" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.642Z", "created_at": "2026-10-03T04:30:16.146Z", "modified": "2026-10-03T08:53:10.667Z", "updated_at": "2026-10-03T08:53:10.667Z" }, "description_available": false, "entity_type": "Indicator", "id": "8f5baa8d-1abb-4c99-a62e-c23a262fd476", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--01cf5e0c-a3a1-5f87-a2d5-60ea37c4a9ba", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.635Z", "created_at": "2026-10-03T04:29:55.041Z", "modified": "2026-10-03T08:53:06.998Z", "updated_at": "2026-10-03T08:53:06.998Z" }, "description_available": false, "entity_type": "Indicator", "id": "8f73c956-ac7a-44dd-9412-bff2109847bc", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--ebaa3379-31c4-5f03-933f-838611c77c5a", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.661Z", "created_at": "2026-10-03T04:30:58.350Z", "modified": "2026-10-03T08:55:17.341Z", "updated_at": "2026-10-03T08:55:17.341Z" }, "description_available": false, "entity_type": "Indicator", "id": "906373df-4200-4910-8ff7-631604639ea3", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--bda1f3f7-c35d-5511-9b62-c7ae510777ca", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.673Z", "created_at": "2026-10-03T04:31:17.378Z", "modified": "2026-10-03T08:55:22.998Z", "updated_at": "2026-10-03T08:55:22.998Z" }, "description_available": false, "entity_type": "Indicator", "id": "9a92c92a-a766-4cf9-bc81-bc565af24438", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--c9cbb86b-796b-5b97-a841-ca478a3c45c9", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:28:54.932Z", "updated_at": "2026-10-03T04:28:58.613Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "9aa2a1b8-8608-431d-a3b4-ed4e05913e02", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--ff1149ef-e5fb-57e2-86d6-82062f4a14ba", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:29:07.272Z", "updated_at": "2026-10-03T04:29:12.350Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "9b5bfc60-c066-4dc2-95f3-f4a120d6e241", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--60e6701d-fe63-5366-a3eb-d66cc4fffdc7", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.658Z", "created_at": "2026-10-03T04:30:54.907Z", "modified": "2026-10-03T08:55:15.688Z", "updated_at": "2026-10-03T08:55:15.688Z" }, "description_available": false, "entity_type": "Indicator", "id": "b3ba9e0a-6b5d-4e2b-accf-601a2278c428", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--e984cb79-f693-5790-a736-7f9a5bbe6b3b", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.638Z", "created_at": "2026-10-03T04:30:05.158Z", "modified": "2026-10-03T08:53:07.852Z", "updated_at": "2026-10-03T08:53:07.852Z" }, "description_available": false, "entity_type": "Indicator", "id": "b6da2576-1a47-4a65-b4fd-5b86d7212f74", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--eaa5372e-7df1-5fe1-8bfd-0a0a1f2c6c9e", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:28:44.102Z", "updated_at": "2026-10-03T04:28:46.537Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "c432c829-4972-457a-9883-3d884c4330ca", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--4d445f80-33f2-51cb-add7-f458c968e30b", "type": "DomainName" }, { "__typename": "IntrusionSet", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.625Z", "created_at": "2026-10-03T04:28:14.837Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-03T04:28:26.625Z", "updated_at": "2026-10-03T04:28:26.625Z" }, "description_available": false, "entity_type": "Intrusion-Set", "id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "is_inferred": false, "labels": [], "lang": "en", "name": "TA419", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "intrusion-set--34337b66-9941-587c-93d4-129ff9f80a16", "type": "IntrusionSet" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.678Z", "created_at": "2026-10-03T04:31:17.414Z", "modified": "2026-10-03T08:55:23.483Z", "updated_at": "2026-10-03T08:55:23.483Z" }, "description_available": false, "entity_type": "Indicator", "id": "c966c7e0-9890-4a37-8193-322bdee01534", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--9ac1b44f-a201-5e38-8269-aff32e3671f0", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:29:42.776Z", "updated_at": "2026-10-03T04:29:46.625Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "cb4ea84b-f7c4-40ab-9aea-5f6919a619fb", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--dbceb6a6-4da5-5df7-a4a7-063609a4258b", "type": "DomainName" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:28:54.940Z", "updated_at": "2026-10-03T04:28:58.611Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "ce37ad7b-2ceb-4765-b854-1a91c29c070f", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--9f48c1d9-55e3-5118-bafb-2032a8c13810", "type": "DomainName" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:29:55.012Z", "updated_at": "2026-10-03T04:29:59.505Z" }, "description_available": false, "entity_type": "StixFile", "id": "d0b80cce-ad9d-43ea-b686-6c25c1b64e0b", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "file--53092aef-1416-5fc7-be30-3c83c4c209df", "type": "StixFile" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:28:32.330Z", "updated_at": "2026-10-03T04:28:37.555Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "da5d5979-6b43-4a8c-9d13-d52f2497ba76", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--15108f8d-6ca8-59a4-b2a8-7a593554a274", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.670Z", "created_at": "2026-10-03T04:31:10.837Z", "modified": "2026-10-03T08:55:19.579Z", "updated_at": "2026-10-03T08:55:19.579Z" }, "description_available": false, "entity_type": "Indicator", "id": "db029839-dedd-44d2-844f-957a1a5bc1c1", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--0c5353c3-40a2-5074-a36e-8df5f336ec54", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-10-03T04:29:07.266Z", "updated_at": "2026-10-03T04:29:11.696Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "ddfc2027-a383-4bb0-b747-58db2409a996", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "domain-name--121b25d4-5464-52ca-84f4-c53598933e42", "type": "DomainName" }, { "__typename": "Sector", "aliases": [ "Election", "Government", "Voting" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.392Z", "created_at": "2026-01-18T14:35:09.055Z", "modified": "2026-01-22T08:00:46.641Z", "updated_at": "2026-01-22T08:00:46.641Z" }, "description_available": true, "entity_type": "Sector", "id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "is_inferred": false, "labels": [], "lang": "en", "name": "Government and administrations", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "identity--9d697b63-6ae0-5ddb-ae26-e3d6e03302e1", "type": "Sector" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.675Z", "created_at": "2026-10-03T04:31:17.391Z", "modified": "2026-10-03T08:55:23.878Z", "updated_at": "2026-10-03T08:55:23.878Z" }, "description_available": false, "entity_type": "Indicator", "id": "ea942d98-d7c8-48c4-a8ab-fe4d53b83221", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--f944a42b-251a-54c7-ac8e-33c8f3e8dad7", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.650Z", "created_at": "2026-10-03T04:30:37.573Z", "modified": "2026-10-03T08:53:12.315Z", "updated_at": "2026-10-03T08:53:12.315Z" }, "description_available": false, "entity_type": "Indicator", "id": "f03e43cc-2cdd-485d-ae4a-82740ed78a5b", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--7e2ad6de-5422-590c-91fb-59269650d0e6", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.653Z", "created_at": "2026-10-03T04:30:39.638Z", "modified": "2026-10-03T08:53:13.673Z", "updated_at": "2026-10-03T08:53:13.673Z" }, "description_available": false, "entity_type": "Indicator", "id": "f465592c-0205-46c2-8901-5af003bed2fc", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--67144964-4055-5ec9-a67d-2529cfbb45a4", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.667Z", "created_at": "2026-10-03T04:31:10.836Z", "modified": "2026-10-03T08:55:19.982Z", "updated_at": "2026-10-03T08:55:19.982Z" }, "description_available": false, "entity_type": "Indicator", "id": "fd57dc42-44d9-4e41-868d-de4c51845c28", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--bfb2c089-0714-5906-95e5-e2cd98aaa1d0", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.640Z", "created_at": "2026-10-03T04:30:05.166Z", "modified": "2026-10-03T08:53:08.426Z", "updated_at": "2026-10-03T08:53:08.426Z" }, "description_available": false, "entity_type": "Indicator", "id": "fedeb06a-4160-43b6-a4cd-e811135a182d", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "indicator--d295ae9d-b6f3-5304-84ab-1d81b17ce56b", "type": "Indicator" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.685Z", "created_at": "2026-10-03T04:32:07.529Z", "modified": "2026-10-03T04:32:08.054Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:08.054Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2edd13cd-b78f-4ff6-b588-9b36b14df2c4", "from_id": "2edd13cd-b78f-4ff6-b588-9b36b14df2c4", "from_name": null, "from_type": "Indicator", "id": "0255a306-7933-4115-a3d1-85ee97ca23b7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--f52de2fb-14f6-58a3-a10f-2881e239c042", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.683Z", "created_at": "2026-10-03T04:32:02.820Z", "modified": "2026-10-03T04:32:04.801Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:04.801Z" }, "description_available": false, "entity_type": "indicates", "fromId": "827905bd-d884-4094-b82e-29818f637006", "from_id": "827905bd-d884-4094-b82e-29818f637006", "from_name": null, "from_type": "Indicator", "id": "02a7becd-67c0-46e2-b28d-a8107348e947", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--24ff70b2-5205-5431-93f9-8bafc13815d7", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.687Z", "created_at": "2026-10-03T04:32:09.466Z", "modified": "2026-10-03T04:32:11.691Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:11.691Z" }, "description_available": false, "entity_type": "indicates", "fromId": "47326564-9115-4476-89ec-a3a855d9c74c", "from_id": "47326564-9115-4476-89ec-a3a855d9c74c", "from_name": null, "from_type": "Indicator", "id": "0baaacea-f481-40a9-b726-75a03898cd0d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--b965cd9e-ff70-5e80-97e4-732261734e42", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.688Z", "created_at": "2026-10-03T04:32:13.036Z", "modified": "2026-10-03T04:32:14.342Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:14.342Z" }, "description_available": false, "entity_type": "indicates", "fromId": "906373df-4200-4910-8ff7-631604639ea3", "from_id": "906373df-4200-4910-8ff7-631604639ea3", "from_name": null, "from_type": "Indicator", "id": "107793d1-2cac-4fbb-a52e-4b3601a0536d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--dd0c5645-62ac-53b8-b098-b3c68ee10291", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.692Z", "created_at": "2026-10-03T04:32:20.823Z", "modified": "2026-10-03T04:32:22.023Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:22.023Z" }, "description_available": false, "entity_type": "indicates", "fromId": "ea942d98-d7c8-48c4-a8ab-fe4d53b83221", "from_id": "ea942d98-d7c8-48c4-a8ab-fe4d53b83221", "from_name": null, "from_type": "Indicator", "id": "11b9a2f6-1a0b-408a-b7af-903c499f5d65", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--3cc4f61c-8e08-5c16-9362-2dcb49e97971", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.690Z", "created_at": "2026-10-03T04:32:16.034Z", "modified": "2026-10-03T04:32:19.297Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:19.297Z" }, "description_available": false, "entity_type": "indicates", "fromId": "db029839-dedd-44d2-844f-957a1a5bc1c1", "from_id": "db029839-dedd-44d2-844f-957a1a5bc1c1", "from_name": null, "from_type": "Indicator", "id": "15d30ca0-5fda-497e-8db6-2fbc6db849e3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--8d50844e-da8b-51ee-813c-92c5dbe82bb7", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.631Z", "created_at": "2026-10-03T04:31:36.924Z", "modified": "2026-10-03T04:31:37.375Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:37.375Z" }, "description_available": false, "entity_type": "targets", "fromId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "from_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "from_name": "TA419", "from_type": "IntrusionSet", "id": "1681255c-0c18-467c-bd44-b938a61ff343", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--5f1807bc-a2e2-5112-b63c-54894ed98f10", "toId": "3460c7f0-1521-461b-af64-2de060664fb1", "to_id": "3460c7f0-1521-461b-af64-2de060664fb1", "to_name": "United States of America", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.662Z", "created_at": "2026-10-03T04:31:56.272Z", "modified": "2026-10-03T04:31:58.399Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:58.399Z" }, "description_available": false, "entity_type": "based-on", "fromId": "906373df-4200-4910-8ff7-631604639ea3", "from_id": "906373df-4200-4910-8ff7-631604639ea3", "from_name": null, "from_type": "Indicator", "id": "223ad55f-ad81-4435-b500-f598781766c9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--b0f8a550-438d-57a3-b352-edc2231dedbb", "toId": "4ad74042-613b-425c-9e4f-fbac137005cb", "to_id": "4ad74042-613b-425c-9e4f-fbac137005cb", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.648Z", "created_at": "2026-10-03T04:31:52.762Z", "modified": "2026-10-03T04:31:53.769Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:53.769Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0990242a-9937-40fb-99b2-efa127063973", "from_id": "0990242a-9937-40fb-99b2-efa127063973", "from_name": null, "from_type": "Indicator", "id": "25045e6b-b934-4b9a-a4d9-5fbbb0fb384b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--0c9dd68e-327e-50a3-96d9-06bba3111ffe", "toId": "27723208-1ad0-42d4-af23-634a6d4fbc88", "to_id": "27723208-1ad0-42d4-af23-634a6d4fbc88", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.628Z", "created_at": "2026-10-03T04:31:25.389Z", "modified": "2026-10-03T04:31:28.066Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:28.066Z" }, "description_available": false, "entity_type": "targets", "fromId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "from_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "from_name": "TA419", "from_type": "IntrusionSet", "id": "33b36af8-5e8a-47c2-887d-3e17ede33a48", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--20c32c3a-e104-5a85-ab55-22a6e4f9e3c9", "toId": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_id": "25243a50-06ec-4c1b-8fb2-6a96793e8404", "to_name": "Technologies", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.687Z", "created_at": "2026-10-03T04:32:09.340Z", "modified": "2026-10-03T04:32:09.934Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:09.934Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f465592c-0205-46c2-8901-5af003bed2fc", "from_id": "f465592c-0205-46c2-8901-5af003bed2fc", "from_name": null, "from_type": "Indicator", "id": "46753ce0-f1f0-495c-b465-999f60b463d1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--37693112-f659-5738-b4a5-11b555f2baf7", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.032Z", "created_at": "2026-01-18T14:38:39.061Z", "modified": "2026-01-18T14:38:39.335Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:39.335Z" }, "description_available": true, "entity_type": "located-at", "fromId": "3f84bc21-010c-46a3-bad3-432dcd70f556", "from_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "from_name": "Northern America", "from_type": "Region", "id": "4a3ffcd5-bd03-47c6-a71d-4c47c1151811", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--35fa17bc-cd76-5e88-b582-d1c577aa86ba", "toId": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_id": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_name": "Americas", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.651Z", "created_at": "2026-10-03T04:31:52.762Z", "modified": "2026-10-03T04:31:53.772Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:53.772Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f03e43cc-2cdd-485d-ae4a-82740ed78a5b", "from_id": "f03e43cc-2cdd-485d-ae4a-82740ed78a5b", "from_name": null, "from_type": "Indicator", "id": "54592c91-26d9-4822-aa2e-03c19da3230e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--767d33a8-b48e-5381-9d74-9dba2972c4c5", "toId": "9aa2a1b8-8608-431d-a3b4-ed4e05913e02", "to_id": "9aa2a1b8-8608-431d-a3b4-ed4e05913e02", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.679Z", "created_at": "2026-10-03T04:32:02.821Z", "modified": "2026-10-03T04:32:04.799Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:04.799Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c966c7e0-9890-4a37-8193-322bdee01534", "from_id": "c966c7e0-9890-4a37-8193-322bdee01534", "from_name": null, "from_type": "Indicator", "id": "58aec61c-a568-40e5-9874-e7f489477770", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--1e8c87a6-72e3-5457-b4ea-9dfcf39c9dca", "toId": "8305bb8c-3580-4da2-abf9-22a1a8b45f86", "to_id": "8305bb8c-3580-4da2-abf9-22a1a8b45f86", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.672Z", "created_at": "2026-10-03T04:32:01.066Z", "modified": "2026-10-03T04:32:01.572Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:01.572Z" }, "description_available": false, "entity_type": "based-on", "fromId": "db029839-dedd-44d2-844f-957a1a5bc1c1", "from_id": "db029839-dedd-44d2-844f-957a1a5bc1c1", "from_name": null, "from_type": "Indicator", "id": "655e5df2-d2dc-458c-9789-1a14d8efd9fa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--713f743a-38e2-5846-a217-6eaf39b1a85c", "toId": "61ca1b30-54cf-4aa5-bbcd-d7be79134e43", "to_id": "61ca1b30-54cf-4aa5-bbcd-d7be79134e43", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.685Z", "created_at": "2026-10-03T04:32:07.308Z", "modified": "2026-10-03T04:32:08.057Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:08.057Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8f5baa8d-1abb-4c99-a62e-c23a262fd476", "from_id": "8f5baa8d-1abb-4c99-a62e-c23a262fd476", "from_name": null, "from_type": "Indicator", "id": "6ac12d16-8d7f-4dc5-82b7-af254d7f1f9d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--768cffdd-c957-5d25-bf52-63eeeda1bf43", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.682Z", "created_at": "2026-10-03T04:32:02.820Z", "modified": "2026-10-03T04:32:04.805Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:04.805Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5d94da68-6e05-4dbb-a012-593f0e01ca08", "from_id": "5d94da68-6e05-4dbb-a012-593f0e01ca08", "from_name": null, "from_type": "Indicator", "id": "802d125d-6910-4606-b0b0-35443c13b934", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--ee18615b-8cdf-5acc-96be-e818026bb49c", "toId": "d0b80cce-ad9d-43ea-b686-6c25c1b64e0b", "to_id": "d0b80cce-ad9d-43ea-b686-6c25c1b64e0b", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.689Z", "created_at": "2026-10-03T04:32:15.277Z", "modified": "2026-10-03T04:32:18.464Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:18.464Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2e4013c0-29f2-4a46-b361-bfe125e9ebaf", "from_id": "2e4013c0-29f2-4a46-b361-bfe125e9ebaf", "from_name": null, "from_type": "Indicator", "id": "87579264-6925-416a-b1b8-076356570753", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--b6def120-4556-5261-913f-c0071b83d6bb", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.691Z", "created_at": "2026-10-03T04:32:20.182Z", "modified": "2026-10-03T04:32:22.021Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:22.021Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9a92c92a-a766-4cf9-bc81-bc565af24438", "from_id": "9a92c92a-a766-4cf9-bc81-bc565af24438", "from_name": null, "from_type": "Indicator", "id": "87c415a4-8985-4f85-9439-01dedc2ece25", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--2a829fa1-3b94-5e2d-8cbb-d780beb563f5", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.631Z", "created_at": "2026-10-03T04:31:40.837Z", "modified": "2026-10-03T04:31:42.776Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:42.776Z" }, "description_available": false, "entity_type": "targets", "fromId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "from_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "from_name": "TA419", "from_type": "IntrusionSet", "id": "88ab69f4-b114-4990-b811-a74aca2df8cc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--901e9315-295c-5171-94df-70dda08fe974", "toId": "7a370bce-880b-477d-b87c-2fc78164dde9", "to_id": "7a370bce-880b-477d-b87c-2fc78164dde9", "to_name": "Japan", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.038Z", "created_at": "2026-01-18T14:38:45.161Z", "modified": "2026-01-18T14:38:45.423Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:45.423Z" }, "description_available": true, "entity_type": "located-at", "fromId": "5e22af61-1616-46dc-b076-551e7f99593f", "from_id": "5e22af61-1616-46dc-b076-551e7f99593f", "from_name": "Eastern Asia", "from_type": "Region", "id": "91530847-808e-41e5-ba46-b862b581cb23", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--272b6dd8-e726-5eb2-9db7-c27916944d0f", "toId": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "to_name": "Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.688Z", "created_at": "2026-10-03T04:32:13.022Z", "modified": "2026-10-03T04:32:14.340Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:14.340Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b3ba9e0a-6b5d-4e2b-accf-601a2278c428", "from_id": "b3ba9e0a-6b5d-4e2b-accf-601a2278c428", "from_name": null, "from_type": "Indicator", "id": "958d00c5-4428-404f-a0cc-97e80bedada1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--a4371e72-ee44-5929-94bf-a4175d63b1d0", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.664Z", "created_at": "2026-10-03T04:31:59.366Z", "modified": "2026-10-03T04:31:59.970Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:59.970Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8144c731-1161-43a3-80dd-93f140d63133", "from_id": "8144c731-1161-43a3-80dd-93f140d63133", "from_name": null, "from_type": "Indicator", "id": "98a2a82c-517a-435f-86ec-4c5dad577040", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--437f9221-d4bc-5081-b119-4a9091df8e93", "toId": "5b8c0be0-6a56-4182-8438-6c8e367dc417", "to_id": "5b8c0be0-6a56-4182-8438-6c8e367dc417", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.627Z", "created_at": "2026-10-03T04:31:23.469Z", "modified": "2026-10-03T04:31:24.451Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:24.451Z" }, "description_available": false, "entity_type": "targets", "fromId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "from_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "from_name": "TA419", "from_type": "IntrusionSet", "id": "9c76af92-b9a8-4ffd-970d-766e9ee0a5c1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--28d52042-3c1b-5345-9e4b-f7c35aace90a", "toId": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed", "to_id": "8aadeb6e-a39e-4ee2-8ce1-4725c806eeed", "to_name": "Education", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.689Z", "created_at": "2026-10-03T04:32:13.647Z", "modified": "2026-10-03T04:32:14.822Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:14.822Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8144c731-1161-43a3-80dd-93f140d63133", "from_id": "8144c731-1161-43a3-80dd-93f140d63133", "from_name": null, "from_type": "Indicator", "id": "a2db35c0-38c9-45a1-8d73-3c1eb8d64450", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--3f844e3b-0144-50e7-856e-fae26f1493d3", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.629Z", "created_at": "2026-10-03T04:31:38.366Z", "modified": "2026-10-03T04:31:39.428Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:39.428Z" }, "description_available": false, "entity_type": "targets", "fromId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "from_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "from_name": "TA419", "from_type": "IntrusionSet", "id": "a4f64bcc-10ca-4188-9d79-257883466016", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--967ac392-b04a-5f7b-9a89-5d4d3ed4b74e", "toId": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_id": "86dceb6c-5d18-4956-8792-cf2d15d37ae5", "to_name": "Defense", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.677Z", "created_at": "2026-10-03T04:32:01.071Z", "modified": "2026-10-03T04:32:01.578Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:01.578Z" }, "description_available": false, "entity_type": "based-on", "fromId": "ea942d98-d7c8-48c4-a8ab-fe4d53b83221", "from_id": "ea942d98-d7c8-48c4-a8ab-fe4d53b83221", "from_name": null, "from_type": "Indicator", "id": "a6348d25-0d5d-4e6d-818d-e4eb622f9134", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--c5def5eb-f22d-599a-9f1b-b38f66200f64", "toId": "306c5e0e-0ed2-4865-a6a4-24addcc394af", "to_id": "306c5e0e-0ed2-4865-a6a4-24addcc394af", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.683Z", "created_at": "2026-10-03T04:32:05.727Z", "modified": "2026-10-03T04:32:06.707Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:06.707Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8f73c956-ac7a-44dd-9412-bff2109847bc", "from_id": "8f73c956-ac7a-44dd-9412-bff2109847bc", "from_name": null, "from_type": "Indicator", "id": "aaed00a4-fc81-4ba6-bbf1-e33b06fc2e93", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--ea1f8ebc-8bbb-54c9-881d-bf5d5a6df7a7", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.694Z", "created_at": "2026-10-03T04:32:23.893Z", "modified": "2026-10-03T04:32:25.549Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:25.549Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5d94da68-6e05-4dbb-a012-593f0e01ca08", "from_id": "5d94da68-6e05-4dbb-a012-593f0e01ca08", "from_name": null, "from_type": "Indicator", "id": "b69d591b-2019-48cf-82ca-05db7d417bd1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--f8172d6d-1988-5297-9ca4-cd9ee9cc3adc", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.040Z", "created_at": "2026-01-18T14:38:50.870Z", "modified": "2026-01-18T14:38:52.213Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:52.213Z" }, "description_available": true, "entity_type": "located-at", "fromId": "7a370bce-880b-477d-b87c-2fc78164dde9", "from_id": "7a370bce-880b-477d-b87c-2fc78164dde9", "from_name": "Japan", "from_type": "Country", "id": "ba1c989f-7204-4e06-b9e2-1365d405256b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--0cf338f5-2612-5a1e-adb0-c70b50991dca", "toId": "5e22af61-1616-46dc-b076-551e7f99593f", "to_id": "5e22af61-1616-46dc-b076-551e7f99593f", "to_name": "Eastern Asia", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.634Z", "created_at": "2026-10-03T04:31:38.294Z", "modified": "2026-10-03T04:31:38.977Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:38.977Z" }, "description_available": false, "entity_type": "based-on", "fromId": "827905bd-d884-4094-b82e-29818f637006", "from_id": "827905bd-d884-4094-b82e-29818f637006", "from_name": null, "from_type": "Indicator", "id": "bb1eb5ff-c379-4de7-b84d-ad4a081934ff", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--28edfc68-6840-5ae5-b747-20cb949ddb34", "toId": "141654d3-47f6-4b08-9ff9-a3d60440072b", "to_id": "141654d3-47f6-4b08-9ff9-a3d60440072b", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.639Z", "created_at": "2026-10-03T04:31:40.932Z", "modified": "2026-10-03T04:31:43.139Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:43.139Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b6da2576-1a47-4a65-b4fd-5b86d7212f74", "from_id": "b6da2576-1a47-4a65-b4fd-5b86d7212f74", "from_name": null, "from_type": "Indicator", "id": "bb7704af-fb6d-4c41-af57-72672ea031b8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--abc73a8d-5025-5a0f-af0c-ca6a978e2e4b", "toId": "42b54c07-bce7-4b5a-86d8-e17c16de9591", "to_id": "42b54c07-bce7-4b5a-86d8-e17c16de9591", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.686Z", "created_at": "2026-10-03T04:32:09.145Z", "modified": "2026-10-03T04:32:09.634Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:09.634Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f03e43cc-2cdd-485d-ae4a-82740ed78a5b", "from_id": "f03e43cc-2cdd-485d-ae4a-82740ed78a5b", "from_name": null, "from_type": "Indicator", "id": "bbcbd245-3551-4b97-bf6d-66e5109f9e70", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--69735ad7-f851-5f72-b22d-1a45e9e0ae19", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.669Z", "created_at": "2026-10-03T04:31:59.357Z", "modified": "2026-10-03T04:31:59.969Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:59.969Z" }, "description_available": false, "entity_type": "based-on", "fromId": "fd57dc42-44d9-4e41-868d-de4c51845c28", "from_id": "fd57dc42-44d9-4e41-868d-de4c51845c28", "from_name": null, "from_type": "Indicator", "id": "bcfe9032-619a-4cc8-8c0a-bdf60e11c312", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--ee9a3fc8-4cff-588c-842b-a536e3f01c36", "toId": "51ba129b-495b-4c8b-957d-c1b1fa7bb840", "to_id": "51ba129b-495b-4c8b-957d-c1b1fa7bb840", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.646Z", "created_at": "2026-10-03T04:31:48.755Z", "modified": "2026-10-03T04:31:51.222Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:51.222Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2edd13cd-b78f-4ff6-b588-9b36b14df2c4", "from_id": "2edd13cd-b78f-4ff6-b588-9b36b14df2c4", "from_name": null, "from_type": "Indicator", "id": "bdf96d49-d9c4-4f09-93bb-0ddc612f6619", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--ed822eb3-a22f-52df-a871-0698481b5085", "toId": "68c07e88-6f37-40e5-85a1-e8e62dc3c47b", "to_id": "68c07e88-6f37-40e5-85a1-e8e62dc3c47b", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.655Z", "created_at": "2026-10-03T04:31:52.752Z", "modified": "2026-10-03T04:31:53.173Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:53.173Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f465592c-0205-46c2-8901-5af003bed2fc", "from_id": "f465592c-0205-46c2-8901-5af003bed2fc", "from_name": null, "from_type": "Indicator", "id": "bee21917-67e8-4900-a2c6-ef99eee986fd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--bd73260e-afac-5a8b-ba94-b46650759ce2", "toId": "ce37ad7b-2ceb-4765-b854-1a91c29c070f", "to_id": "ce37ad7b-2ceb-4765-b854-1a91c29c070f", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.667Z", "created_at": "2026-10-03T04:31:59.366Z", "modified": "2026-10-03T04:31:59.972Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:59.972Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2e4013c0-29f2-4a46-b361-bfe125e9ebaf", "from_id": "2e4013c0-29f2-4a46-b361-bfe125e9ebaf", "from_name": null, "from_type": "Indicator", "id": "bf4f7157-cecf-475f-99d2-0652f21e6ab8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--561814b0-35bb-50c6-9295-0a23e71df80f", "toId": "7fb385e9-2bb9-4fd7-bb4d-79e206c33d41", "to_id": "7fb385e9-2bb9-4fd7-bb4d-79e206c33d41", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.684Z", "created_at": "2026-10-03T04:32:06.392Z", "modified": "2026-10-03T04:32:06.840Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:06.840Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fedeb06a-4160-43b6-a4cd-e811135a182d", "from_id": "fedeb06a-4160-43b6-a4cd-e811135a182d", "from_name": null, "from_type": "Indicator", "id": "bfb0ea20-3c85-49ad-850a-e3592ce995ee", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--cfe475e8-6384-5d07-9f7d-a93223e4229c", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.690Z", "created_at": "2026-10-03T04:32:15.285Z", "modified": "2026-10-03T04:32:18.462Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:18.462Z" }, "description_available": false, "entity_type": "indicates", "fromId": "fd57dc42-44d9-4e41-868d-de4c51845c28", "from_id": "fd57dc42-44d9-4e41-868d-de4c51845c28", "from_name": null, "from_type": "Indicator", "id": "ca9046a0-10e2-40df-9b0c-7da7abc8c16e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--13f9ee2c-2425-5fd8-8550-0fbbbd94329b", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.628Z", "created_at": "2026-10-03T04:31:31.057Z", "modified": "2026-10-03T04:31:32.321Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:32.321Z" }, "description_available": false, "entity_type": "targets", "fromId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "from_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "from_name": "TA419", "from_type": "IntrusionSet", "id": "cf677a90-235f-49bb-bb71-7553825d0dbb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--1b1ce6f5-c25d-5f6d-bcaa-bb62453bd51a", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.035Z", "created_at": "2026-01-18T14:38:41.111Z", "modified": "2026-01-18T14:38:41.841Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:41.841Z" }, "description_available": true, "entity_type": "located-at", "fromId": "3460c7f0-1521-461b-af64-2de060664fb1", "from_id": "3460c7f0-1521-461b-af64-2de060664fb1", "from_name": "United States of America", "from_type": "Country", "id": "daee60ed-495b-4626-8967-6a667c789917", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--98d1ce2f-0759-5c90-a6e9-100a3a2299a7", "toId": "3f84bc21-010c-46a3-bad3-432dcd70f556", "to_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "to_name": "Northern America", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.684Z", "created_at": "2026-10-03T04:32:06.392Z", "modified": "2026-10-03T04:32:06.922Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:06.922Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b6da2576-1a47-4a65-b4fd-5b86d7212f74", "from_id": "b6da2576-1a47-4a65-b4fd-5b86d7212f74", "from_name": null, "from_type": "Indicator", "id": "dd6d0ab5-1198-4876-9604-1b72f267fc5d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--84c810cd-5883-5f5a-a9cb-3bb425dff965", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.636Z", "created_at": "2026-10-03T04:31:40.932Z", "modified": "2026-10-03T04:31:43.142Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:43.142Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8f73c956-ac7a-44dd-9412-bff2109847bc", "from_id": "8f73c956-ac7a-44dd-9412-bff2109847bc", "from_name": null, "from_type": "Indicator", "id": "df29cf74-c29c-4a4d-ab64-d55da65d0481", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--a9c27eca-32f0-52e0-8b69-d7f3bcdb7003", "toId": "da5d5979-6b43-4a8c-9d13-d52f2497ba76", "to_id": "da5d5979-6b43-4a8c-9d13-d52f2497ba76", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.657Z", "created_at": "2026-10-03T04:31:56.267Z", "modified": "2026-10-03T04:31:58.400Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:58.400Z" }, "description_available": false, "entity_type": "based-on", "fromId": "47326564-9115-4476-89ec-a3a855d9c74c", "from_id": "47326564-9115-4476-89ec-a3a855d9c74c", "from_name": null, "from_type": "Indicator", "id": "efd84e90-7f2b-4551-a505-5ee926745934", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--6fbd81b3-41c6-5e18-a938-4d196a446de6", "toId": "ddfc2027-a383-4bb0-b747-58db2409a996", "to_id": "ddfc2027-a383-4bb0-b747-58db2409a996", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.660Z", "created_at": "2026-10-03T04:31:56.267Z", "modified": "2026-10-03T04:31:58.407Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:58.407Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b3ba9e0a-6b5d-4e2b-accf-601a2278c428", "from_id": "b3ba9e0a-6b5d-4e2b-accf-601a2278c428", "from_name": null, "from_type": "Indicator", "id": "f34f707a-9b35-425f-8a29-1b278cbe4711", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--04f9973d-1185-5312-bc51-7b5ba7d942ed", "toId": "9b5bfc60-c066-4dc2-95f3-f4a120d6e241", "to_id": "9b5bfc60-c066-4dc2-95f3-f4a120d6e241", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.693Z", "created_at": "2026-10-03T04:32:20.827Z", "modified": "2026-10-03T04:32:22.027Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:22.027Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c966c7e0-9890-4a37-8193-322bdee01534", "from_id": "c966c7e0-9890-4a37-8193-322bdee01534", "from_name": null, "from_type": "Indicator", "id": "f364c430-1d03-45c5-8056-96da9a20e30e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--5d91a787-4671-53f3-8aad-1e50d0dfd233", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.641Z", "created_at": "2026-10-03T04:31:43.785Z", "modified": "2026-10-03T04:31:51.201Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:51.201Z" }, "description_available": false, "entity_type": "based-on", "fromId": "fedeb06a-4160-43b6-a4cd-e811135a182d", "from_id": "fedeb06a-4160-43b6-a4cd-e811135a182d", "from_name": null, "from_type": "Indicator", "id": "f4f05b27-1af9-4bc5-846c-13f39a2ba1cd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--3daa3e4d-3d9a-57ab-ac5a-8f8bf47fbe78", "toId": "833fac8b-c833-4fa0-92ba-ccc0019cc46f", "to_id": "833fac8b-c833-4fa0-92ba-ccc0019cc46f", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.643Z", "created_at": "2026-10-03T04:31:47.825Z", "modified": "2026-10-03T04:31:51.202Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:31:51.202Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8f5baa8d-1abb-4c99-a62e-c23a262fd476", "from_id": "8f5baa8d-1abb-4c99-a62e-c23a262fd476", "from_name": null, "from_type": "Indicator", "id": "fc861487-85a2-4ffb-825d-c330fbbb309e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--7242d051-6db3-583e-90a6-acf1990266f6", "toId": "c432c829-4972-457a-9883-3d884c4330ca", "to_id": "c432c829-4972-457a-9883-3d884c4330ca", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.686Z", "created_at": "2026-10-03T04:32:07.843Z", "modified": "2026-10-03T04:32:08.501Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:08.501Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0990242a-9937-40fb-99b2-efa127063973", "from_id": "0990242a-9937-40fb-99b2-efa127063973", "from_name": null, "from_type": "Indicator", "id": "fecdb69a-ca3d-483c-9a0e-4e5c9d4a0d32", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--da31f095-8943-5182-b9bf-f0b909dbf7d1", "toId": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_id": "c44b020b-caba-4e52-abdc-fc56b06de95b", "to_name": "TA419", "to_type": "IntrusionSet" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-03T00:52:32.674Z", "created_at": "2026-10-03T04:32:01.058Z", "modified": "2026-10-03T04:32:01.574Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T04:32:01.574Z" }, "description_available": false, "entity_type": "based-on", "fromId": "9a92c92a-a766-4cf9-bc81-bc565af24438", "from_id": "9a92c92a-a766-4cf9-bc81-bc565af24438", "from_name": null, "from_type": "Indicator", "id": "ff5b0a02-f303-432e-a42b-e3cff851d1cb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "standard_id": "relationship--4b152c3a-e5d0-545e-a8d8-2320bc0fcf18", "toId": "cb4ea84b-f7c4-40ab-9aea-5f6919a619fb", "to_id": "cb4ea84b-f7c4-40ab-9aea-5f6919a619fb", "to_name": null, "to_type": "DomainName" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "cirrushare[.]co", "description_available": false, "object_id": "2edd13cd-b78f-4ff6-b588-9b36b14df2c4", "object_ids": [ "2edd13cd-b78f-4ff6-b588-9b36b14df2c4", "68c07e88-6f37-40e5-85a1-e8e62dc3c47b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2edd13cd-b78f-4ff6-b588-9b36b14df2c4", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "cirrushare.co" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "68c07e88-6f37-40e5-85a1-e8e62dc3c47b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "cirrushare.co" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "cirrushare.co" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "cloudsyncpulse[.]com", "description_available": false, "object_id": "47326564-9115-4476-89ec-a3a855d9c74c", "object_ids": [ "47326564-9115-4476-89ec-a3a855d9c74c", "ddfc2027-a383-4bb0-b747-58db2409a996" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "47326564-9115-4476-89ec-a3a855d9c74c", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "cloudsyncpulse.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "ddfc2027-a383-4bb0-b747-58db2409a996", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "cloudsyncpulse.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "cloudsyncpulse.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "driftshare[.]co", "description_available": false, "object_id": "8f73c956-ac7a-44dd-9412-bff2109847bc", "object_ids": [ "8f73c956-ac7a-44dd-9412-bff2109847bc", "da5d5979-6b43-4a8c-9d13-d52f2497ba76" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "8f73c956-ac7a-44dd-9412-bff2109847bc", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "driftshare.co" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "da5d5979-6b43-4a8c-9d13-d52f2497ba76", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "driftshare.co" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "driftshare.co" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "fileswiftonline[.]cloud", "description_available": false, "object_id": "fd57dc42-44d9-4e41-868d-de4c51845c28", "object_ids": [ "51ba129b-495b-4c8b-957d-c1b1fa7bb840", "fd57dc42-44d9-4e41-868d-de4c51845c28" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "fd57dc42-44d9-4e41-868d-de4c51845c28", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "fileswiftonline.cloud" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "51ba129b-495b-4c8b-957d-c1b1fa7bb840", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "fileswiftonline.cloud" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "fileswiftonline.cloud" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "globalfileshareplatform[.]com", "description_available": false, "object_id": "b6da2576-1a47-4a65-b4fd-5b86d7212f74", "object_ids": [ "42b54c07-bce7-4b5a-86d8-e17c16de9591", "b6da2576-1a47-4a65-b4fd-5b86d7212f74" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b6da2576-1a47-4a65-b4fd-5b86d7212f74", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "globalfileshareplatform.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "42b54c07-bce7-4b5a-86d8-e17c16de9591", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "globalfileshareplatform.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "globalfileshareplatform.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "goshshare[.]online", "description_available": false, "object_id": "f03e43cc-2cdd-485d-ae4a-82740ed78a5b", "object_ids": [ "9aa2a1b8-8608-431d-a3b4-ed4e05913e02", "f03e43cc-2cdd-485d-ae4a-82740ed78a5b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f03e43cc-2cdd-485d-ae4a-82740ed78a5b", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "goshshare.online" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "9aa2a1b8-8608-431d-a3b4-ed4e05913e02", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "goshshare.online" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "goshshare.online" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "heritiage[.]org", "description_available": false, "object_id": "ea942d98-d7c8-48c4-a8ab-fe4d53b83221", "object_ids": [ "306c5e0e-0ed2-4865-a6a4-24addcc394af", "ea942d98-d7c8-48c4-a8ab-fe4d53b83221" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "ea942d98-d7c8-48c4-a8ab-fe4d53b83221", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "heritiage.org" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "306c5e0e-0ed2-4865-a6a4-24addcc394af", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "heritiage.org" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "heritiage.org" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "heritiages[.]org", "description_available": false, "object_id": "9a92c92a-a766-4cf9-bc81-bc565af24438", "object_ids": [ "9a92c92a-a766-4cf9-bc81-bc565af24438", "cb4ea84b-f7c4-40ab-9aea-5f6919a619fb" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "9a92c92a-a766-4cf9-bc81-bc565af24438", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "heritiages.org" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "cb4ea84b-f7c4-40ab-9aea-5f6919a619fb", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "heritiages.org" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "heritiages.org" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "msfile[.]online", "description_available": false, "object_id": "906373df-4200-4910-8ff7-631604639ea3", "object_ids": [ "4ad74042-613b-425c-9e4f-fbac137005cb", "906373df-4200-4910-8ff7-631604639ea3" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "906373df-4200-4910-8ff7-631604639ea3", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "msfile.online" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "4ad74042-613b-425c-9e4f-fbac137005cb", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "msfile.online" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "msfile.online" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "mypublicshare[.]com", "description_available": false, "object_id": "0990242a-9937-40fb-99b2-efa127063973", "object_ids": [ "0990242a-9937-40fb-99b2-efa127063973", "27723208-1ad0-42d4-af23-634a6d4fbc88" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "0990242a-9937-40fb-99b2-efa127063973", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "mypublicshare.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "27723208-1ad0-42d4-af23-634a6d4fbc88", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "mypublicshare.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "mypublicshare.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "onecloudfilesync[.]com", "description_available": false, "object_id": "b3ba9e0a-6b5d-4e2b-accf-601a2278c428", "object_ids": [ "9b5bfc60-c066-4dc2-95f3-f4a120d6e241", "b3ba9e0a-6b5d-4e2b-accf-601a2278c428" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "b3ba9e0a-6b5d-4e2b-accf-601a2278c428", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "onecloudfilesync.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "9b5bfc60-c066-4dc2-95f3-f4a120d6e241", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "onecloudfilesync.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "onecloudfilesync.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "publicsharefile[.]cloud", "description_available": false, "object_id": "2e4013c0-29f2-4a46-b361-bfe125e9ebaf", "object_ids": [ "2e4013c0-29f2-4a46-b361-bfe125e9ebaf", "7fb385e9-2bb9-4fd7-bb4d-79e206c33d41" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2e4013c0-29f2-4a46-b361-bfe125e9ebaf", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "publicsharefile.cloud" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "7fb385e9-2bb9-4fd7-bb4d-79e206c33d41", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "publicsharefile.cloud" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "publicsharefile.cloud" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "quickfly[.]online", "description_available": false, "object_id": "fedeb06a-4160-43b6-a4cd-e811135a182d", "object_ids": [ "833fac8b-c833-4fa0-92ba-ccc0019cc46f", "fedeb06a-4160-43b6-a4cd-e811135a182d" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "fedeb06a-4160-43b6-a4cd-e811135a182d", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "quickfly.online" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "833fac8b-c833-4fa0-92ba-ccc0019cc46f", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "quickfly.online" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "quickfly.online" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "sharehub[.]space", "description_available": false, "object_id": "827905bd-d884-4094-b82e-29818f637006", "object_ids": [ "141654d3-47f6-4b08-9ff9-a3d60440072b", "827905bd-d884-4094-b82e-29818f637006" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "827905bd-d884-4094-b82e-29818f637006", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "sharehub.space" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "141654d3-47f6-4b08-9ff9-a3d60440072b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "sharehub.space" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "sharehub.space" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "shinjirou[.]info", "description_available": false, "object_id": "c966c7e0-9890-4a37-8193-322bdee01534", "object_ids": [ "8305bb8c-3580-4da2-abf9-22a1a8b45f86", "c966c7e0-9890-4a37-8193-322bdee01534" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c966c7e0-9890-4a37-8193-322bdee01534", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "shinjirou.info" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "8305bb8c-3580-4da2-abf9-22a1a8b45f86", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "shinjirou.info" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "shinjirou.info" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "smartsyncbox[.]com", "description_available": false, "object_id": "8f5baa8d-1abb-4c99-a62e-c23a262fd476", "object_ids": [ "8f5baa8d-1abb-4c99-a62e-c23a262fd476", "c432c829-4972-457a-9883-3d884c4330ca" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "8f5baa8d-1abb-4c99-a62e-c23a262fd476", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "smartsyncbox.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "c432c829-4972-457a-9883-3d884c4330ca", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "smartsyncbox.com" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "smartsyncbox.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "synchvault[.]co", "description_available": false, "object_id": "f465592c-0205-46c2-8901-5af003bed2fc", "object_ids": [ "ce37ad7b-2ceb-4765-b854-1a91c29c070f", "f465592c-0205-46c2-8901-5af003bed2fc" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f465592c-0205-46c2-8901-5af003bed2fc", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "synchvault.co" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "ce37ad7b-2ceb-4765-b854-1a91c29c070f", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "synchvault.co" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "synchvault.co" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "tw-koryu[.]org", "description_available": false, "object_id": "db029839-dedd-44d2-844f-957a1a5bc1c1", "object_ids": [ "61ca1b30-54cf-4aa5-bbcd-d7be79134e43", "db029839-dedd-44d2-844f-957a1a5bc1c1" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "db029839-dedd-44d2-844f-957a1a5bc1c1", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "tw-koryu.org" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "61ca1b30-54cf-4aa5-bbcd-d7be79134e43", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "tw-koryu.org" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "tw-koryu.org" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "winsync[.]cloud", "description_available": false, "object_id": "8144c731-1161-43a3-80dd-93f140d63133", "object_ids": [ "5b8c0be0-6a56-4182-8438-6c8e367dc417", "8144c731-1161-43a3-80dd-93f140d63133" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "8144c731-1161-43a3-80dd-93f140d63133", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "winsync.cloud" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "5b8c0be0-6a56-4182-8438-6c8e367dc417", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "winsync.cloud" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "domain", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-01-12T01:38:56.260Z", "validity_status": "active", "value": "winsync.cloud" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "b314a1499cd728ca3e54b7150661fd0c7d2279065fe3f570f0f66c395d744460", "description_available": false, "object_id": "5d94da68-6e05-4dbb-a012-593f0e01ca08", "object_ids": [ "5d94da68-6e05-4dbb-a012-593f0e01ca08", "d0b80cce-ad9d-43ea-b686-6c25c1b64e0b" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "5d94da68-6e05-4dbb-a012-593f0e01ca08", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-07-18T21:53:32.557Z", "validity_status": "active", "value": "b314a1499cd728ca3e54b7150661fd0c7d2279065fe3f570f0f66c395d744460" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "d0b80cce-ad9d-43ea-b686-6c25c1b64e0b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "b314a1499cd728ca3e54b7150661fd0c7d2279065fe3f570f0f66c395d744460" } ], "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy", "type": "sha256", "valid_from": "2026-10-01T10:43:48.000Z", "valid_until": "2027-07-18T21:53:32.557Z", "validity_status": "active", "value": "b314a1499cd728ca3e54b7150661fd0c7d2279065fe3f570f0f66c395d744460" } ], "mentioned": [ { "confidence": 100, "evidence_id": "0584d53c-836c-41a4-a732-0edcc5dea653", "name": "Americas", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "7c9ef5be-db62-491e-9cb1-037e2c6fd417", "name": "Asia", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "5e22af61-1616-46dc-b076-551e7f99593f", "name": "Eastern Asia", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "3f84bc21-010c-46a3-bad3-432dcd70f556", "name": "Northern America", "role": "mentionné", "type": "Region" } ], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-10-01T10:43:47.400Z", "created_at": "2026-10-03T04:32:29.772Z", "modified": "2026-10-03T04:33:04.277Z", "published": "2026-10-01T10:43:47.400Z", "updated_at": "2026-10-03T04:33:04.277Z" }, "description_available": true, "id": "67de93ff-a12c-48b1-82ba-4dc24f20d9c1", "is_inferred": false, "labels": [ "ai policy", "aitm", "browser-in-the-browser", "china-aligned", "credential phishing", "espionage", "frameless bitb", "impersonation", "ta419", "think tanks" ], "lang": "en", "name": "Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-10-01T10:43:47.400Z", "references": [ { "external_id": null, "id": "13bc1800-30b3-4ba1-988b-2c1b18f10003", "source_name": "alien-vault", "url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy" }, { "external_id": "6abe39636551c6c071894d2b", "id": "693b755f-a7c5-495c-b309-f7452cdf6d54", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6abe39636551c6c071894d2b" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy" }, "targets": [ { "confidence": 50, "evidence_id": "a4f64bcc-10ca-4188-9d79-257883466016", "name": "Defense", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "9c76af92-b9a8-4ffd-970d-766e9ee0a5c1", "name": "Education", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "cf677a90-235f-49bb-bb71-7553825d0dbb", "name": "Government and administrations", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "88ab69f4-b114-4990-b811-a74aca2df8cc", "name": "Japan", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "33b36af8-5e8a-47c2-887d-3e17ede33a48", "name": "Technologies", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "1681255c-0c18-467c-bd44-b938a61ff343", "name": "United States of America", "role": "cible déclarée (relation targets)", "type": "Country" } ], "techniques": [], "vulnerabilities": [] }, "report_id": "67de93ff-a12c-48b1-82ba-4dc24f20d9c1", "schema_version": 1, "selected_date": "2026-10-01", "source_url": "https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy" }