Loading IOCs…

{'aliases': ['Stolen Pencil'],
 'created': '2019-02-05T17:56:55.233Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': '[Stolen Pencil](https://attack.mitre.org/groups/G0086) is a '
                'threat group likely originating from DPRK that has been '
                'active since at least May 2018. The group appears to have '
                'targeted academic institutions, but its motives remain '
                'unclear.(Citation: Netscout Stolen Pencil Dec 2018)',
 'external_references': [{'external_id': 'G0086',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G0086'},
                         {'description': '(Citation: Netscout Stolen Pencil '
                                         'Dec 2018)',
                          'source_name': 'Stolen Pencil'},
                         {'description': 'ASERT team. (2018, December 5). '
                                         'STOLEN PENCIL Campaign Targets '
                                         'Academia. Retrieved February 5, '
                                         '2019.',
                          'source_name': 'Netscout Stolen Pencil Dec 2018',
                          'url': 'https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/'}],
 'id': 'intrusion-set--7a0d4c09-dfe7-4fa2-965a-1a0e42fedd70',
 'modified': '2025-04-25T14:49:37.027Z',
 'name': 'Stolen Pencil',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': True,
 'spec_version': '2.1',
 'type': 'intrusion-set',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_deprecated': False,
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_version': '1.1'}