{
  "type": "bundle",
  "id": "bundle--be492b5f-df6b-5d58-8409-a4e226aa8b07",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--b8b28d14-1c96-5d14-84a4-80f64d16f500",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "org:36dcfe59-033a-4ccf-a44b-8722dd267366",
      "name": "Beget",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--6804b6f5-fae2-5561-8ba7-db34b50ec70d",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "inc:fc8248d2-8809-42c0-8267-5f362ccc8d19",
      "name": "Beget destructive hosting attack"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--93113b24-ad33-58fa-8fde-d212e042c5e6",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "brh:a7cb6460-bb16-4684-b4b6-95990eaaf20e",
      "name": "Beget destructive hosting attack"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--0e35a895-f62e-5d1f-8a6d-ad66daa67414",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:747fbd8c-e917-46cf-9757-e34f55f5986a",
      "relationship_type": "resulted-in",
      "source_ref": "incident--6804b6f5-fae2-5561-8ba7-db34b50ec70d",
      "target_ref": "x-ally-event--04abb8d9-390b-55cc-879b-373eea510e7b",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Beget",
          "url": "https://beget.com/en/security",
          "external_id": "cit:f31c8151-6767-4c05-ab95-6bd5aa873716",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2a82154392ff33092b8cc2882d3940dbc638f9590205ce04b4bb1a7d63af8416"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--346c4d76-13bd-5de5-8927-208802a0424b",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:108e28bb-b165-45bb-9e2f-0f386b0e4683",
      "relationship_type": "resulted-in",
      "source_ref": "incident--6804b6f5-fae2-5561-8ba7-db34b50ec70d",
      "target_ref": "x-ally-event--00b36a8b-fff5-5d36-88bb-86b8e930ec96",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Beget",
          "url": "https://beget.com/en/security",
          "external_id": "cit:77b70414-d1db-49e2-a420-a8e6f6f418b1",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2a82154392ff33092b8cc2882d3940dbc638f9590205ce04b4bb1a7d63af8416"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--82cc077c-6fd9-5de7-82ca-5ab7a5eec063",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:ba21d9f7-a88f-4416-9928-5e2234495564",
      "relationship_type": "resulted-in",
      "source_ref": "incident--6804b6f5-fae2-5561-8ba7-db34b50ec70d",
      "target_ref": "x-ally-event--19a2e120-1228-5055-87a8-716a49146c63",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Beget",
          "url": "https://beget.com/en/security",
          "external_id": "cit:e6d68c18-e6f0-4464-8592-1106b8cb3d97",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2a82154392ff33092b8cc2882d3940dbc638f9590205ce04b4bb1a7d63af8416"
        }
      ]
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--d80e19aa-bb89-5ded-843a-21fd8cf95e06",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:8dffff3e-1f54-4bb4-9219-3f33a555399e",
      "relationship_type": "affected-organization",
      "source_ref": "incident--6804b6f5-fae2-5561-8ba7-db34b50ec70d",
      "target_ref": "identity--b8b28d14-1c96-5d14-84a4-80f64d16f500",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Beget",
          "url": "https://beget.com/en/security",
          "external_id": "cit:fa80731b-c5a9-4745-930e-53d0a2af1091",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2a82154392ff33092b8cc2882d3940dbc638f9590205ce04b4bb1a7d63af8416"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--03362107-cc60-57fe-8c17-f5aa9b1b9595",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:41a1a162-5ccc-4a72-821c-a074aea1028d",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Beget",
          "url": "https://beget.com/en/security",
          "external_id": "cit:96d2e216-85e6-4bb7-a045-8f74ecb1b0bd",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2a82154392ff33092b8cc2882d3940dbc638f9590205ce04b4bb1a7d63af8416"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-05"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--1172ca86-75b0-5d5a-8bb2-be6fe1d5832e",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:56f93364-62e4-4153-9501-79ce94dd8e31",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Beget",
          "url": "https://beget.com/en/security",
          "external_id": "cit:fb53c900-189c-4bab-b88d-79afeeb05d49",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2a82154392ff33092b8cc2882d3940dbc638f9590205ce04b4bb1a7d63af8416"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The notice describes destructive malware but does not establish the initial entry method or a named attacker."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--13f39c90-c9d2-5847-88ce-4af7e7198349",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:84acc407-709c-4c8e-b698-2e68cf1fdac5",
      "confidence": 100,
      "external_references": [],
      "x_ally_claim_object": {
        "kind": "iri",
        "value": "https://attack.mitre.org/techniques/T1485/"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--35e23e47-32a1-59cd-879f-2516f176dc87",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:ef20a5c2-723b-4622-8421-0887c6760dbf",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Beget",
          "url": "https://beget.com/en/security",
          "external_id": "cit:4b07a130-80f9-4bec-adee-9ae88a1de860",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2a82154392ff33092b8cc2882d3940dbc638f9590205ce04b4bb1a7d63af8416"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Unmanaged dedicated servers and name servers returned on November 2. More than 80% of mail infrastructure and webmail returned November 3; shared-hosting websites began returning November 4."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--3a471c35-237c-57df-8c41-23e651cc4a6b",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:2c41eaa1-de08-414c-ae9d-449a6b99cb9a",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Beget",
          "url": "https://beget.com/en/security",
          "external_id": "cit:5298de78-b9ab-42a3-9d83-d06c54c57328",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2a82154392ff33092b8cc2882d3940dbc638f9590205ce04b4bb1a7d63af8416"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-03"
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--45129e89-a8d9-5dbe-8a4f-43c8c323fd39",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:51b5f3eb-97ab-404b-ac5f-c676cf218ce0",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Beget",
          "url": "https://beget.com/en/security",
          "external_id": "cit:ba85b8cf-1037-48ea-b00c-769ba7df468d",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2a82154392ff33092b8cc2882d3940dbc638f9590205ce04b4bb1a7d63af8416"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Beget reported that attackers reached management servers and launched data-deleting malware on November 2, 2026, Moscow time. It disconnected all servers to contain the attack."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--bfe0bd7f-5d91-5e4b-82ed-a09f8fc05dab",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:81fc531b-d08b-4e7a-bdde-fd923cf67e1f",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Beget",
          "url": "https://beget.com/en/security",
          "external_id": "cit:1b224c05-15f9-4675-9941-3949ac08b386",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2a82154392ff33092b8cc2882d3940dbc638f9590205ce04b4bb1a7d63af8416"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "By November 5 at 15:00 MSK, Beget reported 60% of shared hosting and 40% of its managed dedicated servers restored."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--f570beae-a5ad-5ef2-84de-84efbfa3b2ca",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "clm:defd5768-1edc-4269-b154-cc07a3d2e977",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Beget",
          "url": "https://beget.com/en/security",
          "external_id": "cit:c617b51c-fe73-470d-a739-765fe58f9a64",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:2a82154392ff33092b8cc2882d3940dbc638f9590205ce04b4bb1a7d63af8416"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2026-11-02"
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--00b36a8b-fff5-5d36-88bb-86b8e930ec96",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "evt:abc133ac-6436-44a0-aebe-ddd9644ec718",
      "name": "Attack detected and servers disconnected (MSK)"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--04abb8d9-390b-55cc-879b-373eea510e7b",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "evt:1c67ceff-6d02-41cd-be87-21dbd2c12a11",
      "name": "Mail services partly restored (MSK)"
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--19a2e120-1228-5055-87a8-716a49146c63",
      "created": "2026-11-05T14:19:24.167580+00:00",
      "modified": "2026-11-05T14:19:24.167580+00:00",
      "x_ally_original_id": "evt:4b7c119d-f4ee-47ec-8ba2-06fbcdbb1682",
      "name": "Recovery percentages updated (MSK)"
    }
  ]
}