{
  "id": "bundle--7b82aacc-f846-58f1-8991-b48e70abfdce",
  "objects": [
    {
      "confidence": 100,
      "created": "2026-10-09T18:15:38.906Z",
      "id": "identity--ebdc18c2-918d-5144-b677-f87c2c47f67a",
      "identity_class": "organization",
      "lang": "en",
      "modified": "2026-10-09T18:15:38.906Z",
      "name": "knownexploited",
      "revoked": false,
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-10-11T14:51:27.094Z",
      "definition_type": "PAP",
      "id": "marking-definition--a6f20d4d-0360-59b6-ba22-3b48707828b1",
      "modified": "2026-10-11T14:51:27.094Z",
      "name": "PAP:AMBER",
      "spec_version": "2.1",
      "type": "marking-definition"
    },
    {
      "created": "2026-10-23T17:27:19.376Z",
      "created_by_ref": "identity--ebdc18c2-918d-5144-b677-f87c2c47f67a",
      "description": "ARMORY CASTLE, from Known Exploited. Every layer of this pack in one bundle.",
      "external_references": [
        {
          "source_name": "Known Exploited",
          "url": "https://knownexploited.com/actors/armory-castle/"
        }
      ],
      "id": "report--915e5e65-2aec-5d22-bf9d-2785ed550f32",
      "modified": "2026-10-23T18:01:35.933Z",
      "name": "ARMORY CASTLE pack",
      "object_marking_refs": [
        "marking-definition--a6f20d4d-0360-59b6-ba22-3b48707828b1"
      ],
      "object_refs": [
        "threat-actor--1ac58d70-12c2-58d9-9e13-c6e3955233ad"
      ],
      "published": "2026-10-23T18:01:35.933Z",
      "report_types": [
        "threat-actor"
      ],
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "aliases": [
        "UNC5221",
        "WARP PANDA",
        "UTA0178",
        "Red Dev 61",
        "Magnet Goblin"
      ],
      "confidence": 100,
      "created": "2026-10-23T17:27:19.376Z",
      "created_by_ref": "identity--ebdc18c2-918d-5144-b677-f87c2c47f67a",
      "description": "ARMORY CASTLE (formerly tracked as UNC5221) is a highly sophisticated, suspected China-nexus cyber-espionage threat group known for targeting enterprise edge infrastructure and virtualized network appliances.\nThe group specializes in zero-day exploitation and \"Living-off-the-Land\" (LoTL) techniques to bypass traditional security visibility. By deploying advanced, self-healing backdoors (like BRICKSTORM) on infrastructure lacking endpoint detection and response (EDR) agents, they maintain long-term, undetected persistence to steal sensitive intellectual property, source code, and strategic data. Their primary targets include global government, defense, energy, and technology manufacturing organizations.\nWould you like more details on their specific malware tools (such as BRICKSTORM or SAWFLY), or do you need a list of remediation strategies for their recent appliance exploits?",
      "extensions": {
        "extension-definition--ea279b3e-5c71-4632-ac08-831c66a786ba": {
          "extension_type": "property-extension",
          "score": 10
        }
      },
      "first_seen": "2023-09-30T22:00:00.000Z",
      "goals": [
        "Exfiltrate proprietary data and sensitive source code.",
        "Maintain long-term, stealthy persistence on edge infrastructure.",
        "Compromise high-value virtualized networking appliances."
      ],
      "id": "threat-actor--1ac58d70-12c2-58d9-9e13-c6e3955233ad",
      "lang": "en",
      "last_seen": "2026-09-30T22:00:00.000Z",
      "modified": "2026-10-23T18:01:35.933Z",
      "name": "ARMORY CASTLE",
      "object_marking_refs": [
        "marking-definition--a6f20d4d-0360-59b6-ba22-3b48707828b1"
      ],
      "primary_motivation": "Cyber-espionage",
      "resource_level": "government",
      "revoked": false,
      "roles": [
        "agent"
      ],
      "secondary_motivations": [
        "state-coerced-theft"
      ],
      "sophistication": "advanced",
      "spec_version": "2.1",
      "threat_actor_types": [
        "nation-state"
      ],
      "type": "threat-actor"
    }
  ],
  "type": "bundle"
}