{
  "type": "bundle",
  "id": "bundle--b70bbe4d-e76b-5ef4-848d-221d79008dd8",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--8c2de9d4-4aa8-5984-842b-a30814869182",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "org:8254a22b-7e1e-43eb-94da-ce6f88bc3eb3",
      "name": "Al Jazeera Media Network",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--037850c3-0c62-5d90-88f2-f73c6dbf4d4a",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "brh:d608bc52-4722-4ab7-91d6-dd168a5fcdd6",
      "name": "Al Jazeera AdFection spyware infections"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--58d93205-3fe2-5e30-8466-a4b75e602c95",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "inc:d239d21c-2f16-4133-a11a-75e6ac6dd334",
      "name": "Al Jazeera AdFection spyware infections"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--2651f9ce-20b6-5c83-80cb-8cf055db64fc",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "clm:9f23f763-943b-408b-a04a-a3b7dc773306",
      "relationship_type": "used-malware",
      "source_ref": "incident--58d93205-3fe2-5e30-8466-a4b75e602c95",
      "target_ref": "x-ally-malware--e2460b54-aeb3-5ab4-84ba-41602329c7b9",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Citizen Lab",
          "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/",
          "external_id": "cit:ffcca04e-c73d-45c3-805c-b6f64c92013c",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7698d0ad312aeda6c5620889857d0bf38c7343e32034a9e4b49e6979358cc3e8"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--432d6d77-fcd1-5b21-87b9-843ed81f33d2",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "clm:06c97ff2-fcf8-44e7-84d4-cd3da241e25f",
      "relationship_type": "affected-organization",
      "source_ref": "incident--58d93205-3fe2-5e30-8466-a4b75e602c95",
      "target_ref": "identity--8c2de9d4-4aa8-5984-842b-a30814869182",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Citizen Lab",
          "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/",
          "external_id": "cit:8bc73a31-c074-43f9-aea9-3710c5e3df9c",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7698d0ad312aeda6c5620889857d0bf38c7343e32034a9e4b49e6979358cc3e8"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--51fa00c4-3aa5-5bd9-8443-fa6df62122b2",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "clm:43c430aa-4b91-4df8-895e-d43bad6306a9",
      "relationship_type": "resulted-in",
      "source_ref": "incident--58d93205-3fe2-5e30-8466-a4b75e602c95",
      "target_ref": "x-ally-event--29106220-e25b-55c0-8b27-73d7beeac9f7",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Citizen Lab",
          "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/",
          "external_id": "cit:db44ff75-d373-47af-a1dc-31a7a71675d6",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7698d0ad312aeda6c5620889857d0bf38c7343e32034a9e4b49e6979358cc3e8"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--54410ba9-81c9-56d3-88bd-29accda1098c",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "clm:6b20612d-09a2-4294-ac59-6033b108daa9",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Citizen Lab",
          "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/",
          "external_id": "cit:fd87ea07-d3b8-4c49-bc99-e6c669d8cd78",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7698d0ad312aeda6c5620889857d0bf38c7343e32034a9e4b49e6979358cc3e8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-15"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--656992eb-c91f-58dd-864a-d616a9363adc",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "clm:4d6c96ad-3b8f-48e2-86bd-f77ebae7669c",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1189/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--8562f4dc-085a-5717-83a8-8c9da0c074df",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "clm:08c3b12c-0edb-4159-b084-9f0c5b50b11e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Citizen Lab",
          "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/",
          "external_id": "cit:a86ba5b8-1d93-45af-9233-fec59d0ff62e",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7698d0ad312aeda6c5620889857d0bf38c7343e32034a9e4b49e6979358cc3e8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Citizen Lab published its direct technical findings."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--9ac9b265-bb86-571a-81fe-10321ae0cf46",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "clm:0569e7d4-aa77-4bcb-a988-a089fd68515b",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Citizen Lab",
          "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/",
          "external_id": "cit:86972606-10ea-4191-96a1-a9e114cc5b68",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7698d0ad312aeda6c5620889857d0bf38c7343e32034a9e4b49e6979358cc3e8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Citizen Lab reported at least 45 targeted devices at Al Jazeera; this is not an exact count of infected devices or people."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--a1d70038-1455-52f8-8a75-35be73c2a83a",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "clm:c3f4eca5-a473-49c4-b152-ae0cd900e648",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Citizen Lab",
          "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/",
          "external_id": "cit:f0bc5d37-562c-4ece-bec2-bb87f3e9d3a6",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7698d0ad312aeda6c5620889857d0bf38c7343e32034a9e4b49e6979358cc3e8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Citizen Lab attributed the recovered Windows implant to the Candiru spyware family with high confidence based on distinctive persistence, obfuscation and connectivity behavior."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b4ff549b-0098-5080-85d0-bc4c2f157eb9",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "clm:2dcc3c0c-4ee5-4d43-b9e2-2f2de362d449",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Citizen Lab",
          "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/",
          "external_id": "cit:d490bf52-2ed3-439d-a650-fa2cdcc4d894",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7698d0ad312aeda6c5620889857d0bf38c7343e32034a9e4b49e6979358cc3e8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Logs from infected devices showed contact with Discover-Tech ad infrastructure, then a spyware validator, and finally command-and-control infrastructure."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--b949d201-facd-5614-8739-b03c8de810b5",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "clm:b60c6e19-8da1-4831-8fe9-e237f32d489d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Citizen Lab",
          "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/",
          "external_id": "cit:8ed7383e-8422-4468-b440-22eae9924d23",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7698d0ad312aeda6c5620889857d0bf38c7343e32034a9e4b49e6979358cc3e8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Citizen Lab found that Al Jazeera devices were targeted in 2024 and 2025 and confirmed spyware infections using network logs supplied by the organization and a sample recovered from a compromised device."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c01b41df-7aa2-56ab-8133-d77f6a36ba55",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "clm:f4c061f9-0658-454e-ac99-63e58e070d8d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Citizen Lab",
          "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/",
          "external_id": "cit:b9ccf4da-5273-4dc5-8112-9faca56a9b1a",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7698d0ad312aeda6c5620889857d0bf38c7343e32034a9e4b49e6979358cc3e8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Malicious advertisements from Discover-Tech delivered the infection chain when rendered, without requiring a user click."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--c889b44d-254d-551b-8a88-09070c1c69b0",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "clm:f9dc43d4-8fa9-4669-b02e-49357181c914",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Citizen Lab",
          "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/",
          "external_id": "cit:9de877cd-82eb-432f-aab9-ad9e17791074",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7698d0ad312aeda6c5620889857d0bf38c7343e32034a9e4b49e6979358cc3e8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Citizen Lab reported that Google and IAB Europe removed Discover-Tech from vendor registries in early October 2026; Google terminated its exchange access, Beeswax removed it, Vungle paused access, and Eskimi blocked its accounts and domains."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--e9018aea-bbc5-5680-89bd-37494975b798",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "clm:42087163-1ff5-4596-b7b9-b08e9b4db745",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "The Citizen Lab",
          "url": "https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/",
          "external_id": "cit:b0d02583-ba4e-4f2a-9acf-be35e96e964d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:7698d0ad312aeda6c5620889857d0bf38c7343e32034a9e4b49e6979358cc3e8"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-10-15"
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--29106220-e25b-55c0-8b27-73d7beeac9f7",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "evt:ff385d7e-8d6f-42b7-8752-2ef40e282ffd",
      "name": "Technical findings published"
    },
    {
      "type": "x-ally-malware",
      "spec_version": "2.1",
      "id": "x-ally-malware--e2460b54-aeb3-5ab4-84ba-41602329c7b9",
      "created": "2026-10-17T14:12:14.448783+00:00",
      "modified": "2026-10-17T14:12:14.448783+00:00",
      "x_ally_original_id": "mal:018bc101-fee1-4dda-a26b-4bc1440ba996",
      "name": "Candiru spyware"
    }
  ]
}