{
  "type": "bundle",
  "id": "bundle--453cba0b-404d-4cac-9bd0-0fe7f9465003",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "created": "2024-01-01T00:00:00.000Z",
      "modified": "2024-01-01T00:00:00.000Z",
      "name": "TI Mindmap HUB",
      "identity_class": "organization"
    },
    {
      "type": "report",
      "id": "report--381d0c0c-6982-4594-a5b2-188f55127e86",
      "spec_version": "2.1",
      "created": "2026-06-20T00:00:00.000Z",
      "modified": "2026-06-20T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "FortiBleed — Massive Fortinet Credential Compromise Campaign",
      "description": "Cross-source analysis of the FortiBleed campaign exposing 73,000+ Fortinet FortiGate firewall credentials via brute-force, hash cracking, and configuration exfiltration across 194 countries.",
      "report_types": [
        "threat-report"
      ],
      "published": "2026-06-20T00:00:00.000Z",
      "object_refs": [
        "indicator--5662d92c-1ac0-4898-aeff-dc674b331751",
        "indicator--e60ac738-5e52-4dc6-98e6-6c17ee87ca79",
        "indicator--0a92f1d5-a9c2-4b8e-a8c7-9dfbeb7f24db",
        "indicator--009cc3a7-1920-4908-9ef2-8e0453e0bca9",
        "indicator--a72e9e73-ac17-4ddc-a683-0b6893b08517",
        "indicator--d350df70-8b15-4e7a-bf8e-f450900298e5",
        "indicator--96c5ab97-9e25-4580-83a5-56f47f1c9d56",
        "indicator--3688ecde-b35f-400f-8166-4ee76700d090"
      ],
      "external_references": [
        {
          "source_name": "TI Mindmap HUB",
          "url": "https://ti-mindmap-hub.com/analytics/fortibleed-fortinet-credential-compromise-cross-source-analysis"
        }
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--5662d92c-1ac0-4898-aeff-dc674b331751",
      "spec_version": "2.1",
      "created": "2026-06-20T00:00:00.000Z",
      "modified": "2026-06-20T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 85.11.187[.]8",
      "description": "IPv4 | Hashtopolis coordination server / primary C2 (AS211486, HTTP port 9999, SSH/VNC/RDP attacks) | HIGH",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '85.11.187.8']",
      "pattern_type": "stix",
      "valid_from": "2026-06-20T00:00:00.000Z",
      "labels": [
        "Network Indicators — Attacker Infrastructure"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--e60ac738-5e52-4dc6-98e6-6c17ee87ca79",
      "spec_version": "2.1",
      "created": "2026-06-20T00:00:00.000Z",
      "modified": "2026-06-20T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 85.11.187[.]28",
      "description": "IPv4 | Credential harvesting server (FortiGate credential collection & management) | HIGH",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '85.11.187.28']",
      "pattern_type": "stix",
      "valid_from": "2026-06-20T00:00:00.000Z",
      "labels": [
        "Network Indicators — Attacker Infrastructure"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--0a92f1d5-a9c2-4b8e-a8c7-9dfbeb7f24db",
      "spec_version": "2.1",
      "created": "2026-06-20T00:00:00.000Z",
      "modified": "2026-06-20T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 193.8.187[.]2",
      "description": "IPv4 | Jump box — staging server for relay into compromised networks | HIGH",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '193.8.187.2']",
      "pattern_type": "stix",
      "valid_from": "2026-06-20T00:00:00.000Z",
      "labels": [
        "Network Indicators — Attacker Infrastructure"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--009cc3a7-1920-4908-9ef2-8e0453e0bca9",
      "spec_version": "2.1",
      "created": "2026-06-20T00:00:00.000Z",
      "modified": "2026-06-20T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 185.229.26[.]83",
      "description": "IPv4 | Hashtopolis GPU worker instance (distributed hash cracking) | HIGH",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '185.229.26.83']",
      "pattern_type": "stix",
      "valid_from": "2026-06-20T00:00:00.000Z",
      "labels": [
        "Network Indicators — Attacker Infrastructure"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--a72e9e73-ac17-4ddc-a683-0b6893b08517",
      "spec_version": "2.1",
      "created": "2026-06-20T00:00:00.000Z",
      "modified": "2026-06-20T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 213.169.49[.]142",
      "description": "IPv4 | Hashtopolis GPU worker instance (distributed hash cracking) | HIGH",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '213.169.49.142']",
      "pattern_type": "stix",
      "valid_from": "2026-06-20T00:00:00.000Z",
      "labels": [
        "Network Indicators — Attacker Infrastructure"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--d350df70-8b15-4e7a-bf8e-f450900298e5",
      "spec_version": "2.1",
      "created": "2026-06-20T00:00:00.000Z",
      "modified": "2026-06-20T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 38.117.87[.]37",
      "description": "IPv4 | Hashtopolis GPU worker instance (distributed hash cracking) | HIGH",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '38.117.87.37']",
      "pattern_type": "stix",
      "valid_from": "2026-06-20T00:00:00.000Z",
      "labels": [
        "Network Indicators — Attacker Infrastructure"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--96c5ab97-9e25-4580-83a5-56f47f1c9d56",
      "spec_version": "2.1",
      "created": "2026-06-20T00:00:00.000Z",
      "modified": "2026-06-20T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 198.53.64[.]194",
      "description": "IPv4 | Hashtopolis GPU worker instance (distributed hash cracking) | HIGH",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '198.53.64.194']",
      "pattern_type": "stix",
      "valid_from": "2026-06-20T00:00:00.000Z",
      "labels": [
        "Network Indicators — Attacker Infrastructure"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--3688ecde-b35f-400f-8166-4ee76700d090",
      "spec_version": "2.1",
      "created": "2026-06-20T00:00:00.000Z",
      "modified": "2026-06-20T00:00:00.000Z",
      "created_by_ref": "identity--5fd918e7-338e-49da-b313-1de96527fdee",
      "object_marking_refs": [
        "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
      ],
      "name": "ipv4: 175.155.64[.]221",
      "description": "IPv4 | Hashtopolis GPU worker instance (distributed hash cracking) | HIGH",
      "indicator_types": [
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '175.155.64.221']",
      "pattern_type": "stix",
      "valid_from": "2026-06-20T00:00:00.000Z",
      "labels": [
        "Network Indicators — Attacker Infrastructure"
      ]
    }
  ]
}