{
  "type": "bundle",
  "id": "bundle--d3983e34-5804-4e30-a51c-53b4d35e5100",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "created": "2024-01-01T00:00:00.000Z",
      "modified": "2024-01-01T00:00:00.000Z",
      "name": "TI Mindmap HUB",
      "identity_class": "organization"
    },
    {
      "type": "report",
      "id": "report--84684332-61d0-4f82-bf0a-6666d0a0cadc",
      "spec_version": "2.1",
      "created": "2026-05-03T00:00:00.000Z",
      "modified": "2026-05-03T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "Copy Fail (CVE-2026-31431) Linux Kernel Privilege Escalation",
      "description": "Cross-source analysis of CVE-2026-31431 Copy Fail Linux kernel LPE enabling root access via page cache corruption across all major distributions.",
      "report_types": [
        "threat-report"
      ],
      "published": "2026-05-03T00:00:00.000Z",
      "object_refs": [
        "indicator--9c29d544-4480-4bb3-8c18-670f855243b2",
        "indicator--97287e04-95e2-4b7d-bc79-5c65a5e0e7da",
        "indicator--f702aa09-ad5c-4c9a-a0d6-40f5782b84d9"
      ],
      "external_references": [
        {
          "source_name": "TI Mindmap HUB",
          "url": "https://ti-mindmap-hub.com/analytics/copyfail-cve-2026-31431-cross-source-analysis"
        }
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--9c29d544-4480-4bb3-8c18-670f855243b2",
      "spec_version": "2.1",
      "created": "2026-05-03T00:00:00.000Z",
      "modified": "2026-05-03T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "sha256: a567d09b15f6e4440e70c9f2aa8edec8ed59f53301952df05c719aa3911687f9",
      "description": "PoC Exploit Hash | SHA-256 | HIGH (90%)",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[file:hashes.'SHA-256' = 'a567d09b15f6e4440e70c9f2aa8edec8ed59f53301952df05c719aa3911687f9']",
      "pattern_type": "stix",
      "valid_from": "2026-05-03T00:00:00.000Z",
      "labels": [
        "Network / File-Based IoCs"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--97287e04-95e2-4b7d-bc79-5c65a5e0e7da",
      "spec_version": "2.1",
      "created": "2026-05-03T00:00:00.000Z",
      "modified": "2026-05-03T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "url: hxxps://copy[.]fail/exp",
      "description": "PoC Hosting URL | URL | HIGH (90%)",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[url:value = 'https://copy.fail/exp']",
      "pattern_type": "stix",
      "valid_from": "2026-05-03T00:00:00.000Z",
      "labels": [
        "Network / File-Based IoCs"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--f702aa09-ad5c-4c9a-a0d6-40f5782b84d9",
      "spec_version": "2.1",
      "created": "2026-05-03T00:00:00.000Z",
      "modified": "2026-05-03T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "domain: copy[.]fail",
      "description": "PoC Hosting Domain | Domain | MEDIUM",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'copy.fail']",
      "pattern_type": "stix",
      "valid_from": "2026-05-03T00:00:00.000Z",
      "labels": [
        "Network / File-Based IoCs"
      ]
    }
  ]
}