6a192e1ac095630ef4d5d60f

106bc56415ee087c8a432b2f0f90aa2d

FileHash-MD5

Typosquatted npm packages used to steal cloud and CI/CD secrets

A supply chain attack targeting the npm ecosystem was identified involving 14 malicious packages published under the alias vpmdhaj. These packages typosquat well-known OpenSearch, ElasticSearch, and DevOps libraries, executing malicious payloads through npm lifecycle hooks during installation. The attack deploys a two-stage credential harvesting operation that targets AWS credentials, HashiCorp Vault tokens, GitHub Actions secrets, and npm publish tokens. The malware queries AWS Instance Metadata Service, ECS task metadata, and enumerates AWS Secrets Manager across multiple regions. Two stager variants were observed: an HTTP-based C2 beacon and a stealthier version abusing the legitimate Bun runtime. The stolen credentials enable cloud lateral movement and downstream supply chain attacks through compromised npm maintainer identities, specifically targeting developers working with cloud and CI/CD infrastructure.

2026-05-29 06:11:38.477000+03:00

2026-05-29 10:39:23.904000+03:00

['typosquatting', 'elasticsearch', 'supply-chain-attack', 'opensearch', 'npm']

[]

['https://www.microsoft.com/en-us/security/blog/2026/05/28/typosquatted-npm-packages-used-steal-cloud-ci-cd-secrets/']

{'pulse_id': '6a192e1ac095630ef4d5d60f', 'indicators': [{'id': 4383581613, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-29T06:11:39', 'indicator': '106bc56415ee087c8a432b2f0f90aa2d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383581614, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-29T06:11:39', 'indicator': 'ddd329f1e009abbab39199d6362d2b340c96e41a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383581615, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-29T06:11:39', 'indicator': '638788afc4f1b5860a328312caf5895abd5f5632d28a4f2a85b09076e270d15d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383581616, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-29T06:11:39', 'indicator': '77d92efe7af3547f71fd41d4a884872d66b1be9499eaa637e91eac866911694d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383581617, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-29T06:11:39', 'indicator': 'bfa149694ec6411c23936311a999163ade54d6f38e2f4b0e3cfb8cb67bd7cfaa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383581618, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-29T06:11:39', 'indicator': 'http://aab.sportsontheweb.net/x.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383581619, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-29T06:11:39', 'indicator': 'aab.sportsontheweb.net', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 7}

3c5cbb79c00a2efd28112e78720ac74bafc7d6fb09a5df8af4ade54ae41239a4

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69f3a95eda9a5492f5d1b6f4

CVE-2021-26858

CVE

Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia

A China-aligned threat group designated SHADOW-EARTH-053 has been conducting cyberespionage operations against government entities and critical infrastructure across at least eight countries in South, East, and Southeast Asia, plus one NATO member state, since December 2024. The group exploits unpatched Microsoft Exchange vulnerabilities, particularly the ProxyLogon chain, to gain initial access and deploys GODZILLA web shells for persistence. ShadowPad implants are staged via DLL sideloading of legitimate signed executables. Nearly half of the compromised environments showed overlap with another intrusion set, SHADOW-EARTH-054, sharing identical tooling including Evil-CreateDump and IOX proxy. The attackers conduct extensive Active Directory reconnaissance, credential harvesting, and mailbox exfiltration targeting high-profile government officials and defense contractors. Multiple tunneling tools including GOST and Wstunnel establish covert command-and-control channels, while lateral movement leverages WM...

2026-04-30 19:11:26.525000+03:00

2026-05-30 19:00:26.349000+03:00

['vshell', 'proxylogon exploitation', 'godzilla', 'exchange server compromise', 'ringq', 'godzilla webshell', 'shadowpad', 'noodlerat']

['GODZILLA', 'ShadowPad - S0596', 'POISONPLUG.SHADOW', 'NOODLERAT', 'RingQ', 'IOX', 'VShell']

['https://www.trendmicro.com/en_us/research/26/d/inside-shadow-earth-053.html']

{'pulse_id': '69f3a95eda9a5492f5d1b6f4', 'indicators': [{'id': 2881717445, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': 'CVE-2021-26858', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2881717446, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': 'CVE-2021-26855', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2881717447, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': 'CVE-2021-27065', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2881717448, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': 'CVE-2021-26857', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3989678070, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '2616e7ec2d6c4b86a7fa1f4a762ae918', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3989678096, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': 'e1bcf36ed2f7a60dd0dde52abf11c942e2657e31', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3989678103, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '23c2ebc8f9bac96b2fbbb9b00b457c48d65a9f66ec24fbfba339eeefd0539ad7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4041185515, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': 'zimbra-beta.info', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4157551390, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': 'CVE-2025-55182', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4160394006, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': 'check.office365-update.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4237413818, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '0c63857269205f6505c259a56ea53b23b2bf7432aabb8647d59b321232ca7e36', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4275699032, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': 'nslookup.dnserver.life', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4275699035, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': 'router.dnserver.life', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935395, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '0933fbd16c7a8b70199f5612e147a22c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935396, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '531da3715b1e4fc9baeaa034888ac419', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935397, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': 'a85459a1ec90a52b5c1f2f5a12bb2d10', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935398, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '128f3ad395f86be6569ef2a957d42902a910de6c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935399, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '211e1fc502152ea272edb5a81a5b4405a28c48f9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935400, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '2dc1ad07b7529af3ba5c11a58519681909971a81', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935401, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '2dd614427b80cdd38e8bbe0ace24a484671c0da2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935402, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '31b3dd9ee46805b0ed6e6dd6a5ee17facadfd2ff', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935403, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '3229ba46dd54802093c81e6e2123fd1520faf960', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935404, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '35cc0b684b0906aed9d672a1a8635510fe91aa67', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935405, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '36061be6ccd17e87e3d1ef15f8e7058f279439d1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935406, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '3f858c007d4d49dd7fa260bcc786c34d4f78dbf5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935407, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '4541e55b70ca12ae4a79e38c0b4c31f067eb5cdc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935408, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '579bc9a640ac939b1f75eda852815f063cebd332', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935409, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '824f13f758ce278f72a4aeaf1e15a703d5107dd7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935410, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '861a686461ad830b268977808ba56730616c7684', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935411, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '8a5ac2682d70eacff7eb554e242227c82e2baa94', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935412, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '9244cd99a27a8741a78e0b449cea063fdcfb0090', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935413, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '95015643ecb3ba321b8cff8eca2907e5356e8659', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935414, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '9a83466f6c34e588ba3e99d6cbfac0102e173cdd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935415, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': 'ac7ffce58c70fb9f837e11a44d655d6c28e276f5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935416, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': 'b8d586d376b342b08b3dd8a77c788480e025ad12', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935417, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': 'ebfd92291714e6d7e57cf4830aa8f87950b796bb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935418, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': 'ec38a56f9368eac67106a4ad61538e12053f03d1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935419, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '03a89ea5a8604e8bc09a4249211e20404a2c7047adda65a57deeb46abb1fb116', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935420, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '0c8c562ed7343d28c76d93a88bd0534440d0e71292ebcee66314d6d5c2f34403', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935421, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '0eb72c1f1605d999488d903021d82a9ff4b937e6c1a1da50c55440f018e83ad9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935422, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '0eda83335334d3c877578326a5843d3e2a3b745834de27eac00b694262e2b1ed', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935423, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '0fff684fa209cb79ab1104da3cfbbf4c950078e14e54c2564d130abbd4e464a9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935424, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '165cc3a9a40e04c469e5c818943920f38dc48db2c2365f1a71bb52c9582f0ea9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935425, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '188c72b101cd8ad96ef971e8943bddb3acd9dc45fe1d8719217d171e600a29aa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935426, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '1a5da90175ff7b55ddafcdb816adf574b92a112604019b219d82adab820fb3a2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935427, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '26f4c7f37448911310adf20e6e74aac60e92b97591f4ac9e5e21cc503be8da16', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935428, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '2dd93edc8cc64747a7ca94b6827dc4e5b1e385d493ed4450272dd1dfc52a6255', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935429, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '3dffbfcb825a70e477474e88b18679557ef467de37fc26e45ddbe572f520c52a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935430, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '3f6382418d0137f6ecbef23bfd981938bb86a935b27203f5b053e3710e835f97', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4336935431, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T19:11:27', 'indicator': '4173c218efe31a6b36df714cf4e1073696f3acbe7edd1b7fcba01e4a2d923a27', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 92}

96b581e23df375a00a738cc31e16cf47e188d267ba6ad54caffc1201f0a230d2

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

63ac10d2a4d29d94a7766d7a

offerings.cloud

domain

BlueNoroff introduces new methods bypassing MoTW

The Kaspersky security firm has identified and identified the BlueNoroff group as one of the world’s most prolific cyberattack groups, which has been targeting Japanese banks and venture capital companies.

2022-12-28 09:48:02.037000+03:00

2025-06-17 12:08:20.968000+03:00

['bluenoroff', 'apt']

['BlueNoroff']

['https://securelist.com/bluenoroff-methods-bypass-motw/108383/']

{'pulse_id': '63ac10d2a4d29d94a7766d7a', 'indicators': [{'id': 2302064857, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'offerings.cloud', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2641984561, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'smbc.ltd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3521101306, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'beyondnextventures.co', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3551191499, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'tptf.ltd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3552786227, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'cloud.mufg.tokyo', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3558143289, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'docs.azure-protection.cloud', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3562693464, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'www.onlinecloud.cloud', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3573888305, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'ms.msteam.biz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3584665023, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'angelbridge.capital', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3590394763, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'mizuhogroup.us', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3590394765, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'mufg.tokyo', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3590394768, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'perseus.bond', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3590394771, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'smbcgroup.us', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3590394775, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'avid.lno-prima.lol', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3590394781, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'careers.mizuhogroup.us', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3592355698, 'role': 'command_and_control', 'type': 'hostname', 'title': 'TA444', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'www.capmarketreport.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3592355699, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': '21e9ddd5753363c9a1f36240f989d3a9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3592355702, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': '71627bf5d3fa0c09e0631b2172ee0c6499168ed9', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 21e9ddd5753363c9a1f36240f989d3a9'}, {'id': 3592355704, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'a3f087c83453cde2bc845122c05ebeb60e8891e395b45823c192869ec1b72ea6', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 21e9ddd5753363c9a1f36240f989d3a9'}, {'id': 3592562276, 'role': None, 'type': 'FileHash-MD5', 'title': 'Win64:Trojan-gen', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': '931d0969654af3f77fc1dab9e2bd66b1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3592562305, 'role': None, 'type': 'FileHash-MD5', 'title': 'stack_string', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'a17e9fc78706431ffc8b3085380fe29f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3595105572, 'role': None, 'type': 'FileHash-SHA1', 'title': 'stack_string', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': '37002564bae2fcffea363f6ec7aeac151dc72f6b', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of a17e9fc78706431ffc8b3085380fe29f'}, {'id': 3595105574, 'role': None, 'type': 'FileHash-SHA1', 'title': 'Win64:Trojan-gen', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': '7cf53577520861a1833ae99489c307f98da01b4b', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 931d0969654af3f77fc1dab9e2bd66b1'}, {'id': 3595105578, 'role': None, 'type': 'FileHash-SHA256', 'title': 'stack_string', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': '5f4f006bfb9136c304e0aabf75575360120d022567180ce6b9c1835e209c541e', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of a17e9fc78706431ffc8b3085380fe29f'}, {'id': 3595105580, 'role': None, 'type': 'FileHash-SHA256', 'title': 'Win64:Trojan-gen', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'f14c5bad5219b1ed5166eb02f5ff08a890a181cef2af565f3fe7bcea9c870e22', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 931d0969654af3f77fc1dab9e2bd66b1'}, {'id': 3604976002, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': '087407551649376d90d1743bac75aac8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976003, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': '1e3df8ee796fc8a13731c6de1aed0818', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976004, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': '4c0fb06320d1b7ecf44ffd0442fc10ed', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976005, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': '61a227bf4c5c1514f5cbd2f37d98ef5b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976006, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'd3503e87df528ce3b07ca6d94d1ba9fc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976007, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'd8f6290517c114e73e03ab30165098f6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976008, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'f766f97eb213d81bf15c02d4681c50a4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976009, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'da9f0e7dc6c52044fa29bea5337b4792b8b873373ba99ad816d5c9f5f275f03f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976026, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'abf-cap.co', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976028, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'bankofamerica.nyc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976029, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'bankofamerica.tel', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976030, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'bankofamerica.us.org', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976032, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'smbc-vc.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976034, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'tptf.us', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976035, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'cloud.beyondnextventures.co', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976036, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'it.zvc.capital', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3604976037, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2022-12-28T09:48:03', 'indicator': 'vote.anobaka.info', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 42}

cc5d3771b65ae75d0b6880a56d8b5095d48d265355bb1218a3edc7c977dfddc9

2026-06-04 16:17:10.566101+03:00

2026-06-04 16:17:10.566101+03:00

6829772f15beb81385e3cc8d

hijx.xyz

domain

Operation RoundPress targeting high-value webmail servers

ESET researchers have uncovered a Russia-aligned espionage operation named RoundPress, targeting high-value webmail servers through XSS vulnerabilities. The campaign, attributed to the Sednit group, aims to steal confidential data from specific email accounts. Initially focused on Roundcube in 2023, the operation expanded to include Horde, MDaemon, and Zimbra in 2024. The attackers exploit various vulnerabilities, including a zero-day in MDaemon, to inject malicious JavaScript code into victims' webmail pages. Targets include governmental entities and defense companies in Eastern Europe, with some victims in Africa, Europe, and South America. The malware, known as SpyPress, can steal webmail credentials, exfiltrate contacts and email messages, and in some cases, bypass two-factor authentication.

2025-05-18 05:59:11.339000+03:00

2025-06-17 05:01:48.648000+03:00

['spypress.mdaemon', 'russia', 'xss', 'espionage', 'spypress.zimbra', 'cve-2023-43770', 'zero-day', 'cve-2024-11182', 'spypress.roundcube', 'cve-2024-27443', 'spypress.horde']

['SpyPress.HORDE', 'SpyPress.MDAEMON', 'SpyPress.ROUNDCUBE', 'SpyPress.ZIMBRA']

['https://www.welivesecurity.com/en/eset-research/operation-roundpress/']

{'pulse_id': '6829772f15beb81385e3cc8d', 'indicators': [{'id': 3167056262, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'hijx.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3311071633, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'ceriossl.info', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3645090758, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'CVE-2023-23397', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3700085999, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'global-world-news.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3839832478, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'CVE-2023-43770', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3905875204, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'hfuu.de', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4038691053, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'skiff.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4068560703, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'CVE-2024-11182', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4068560704, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'CVE-2024-27443', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4068560709, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'ikses.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4068560710, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'jiaw.shop', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4068560711, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'lsjb.digital', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4068560712, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'raxia.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4068560713, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'tgh24.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4068586464, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'victim.org', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4068586465, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-05-18T05:59:12', 'indicator': 'terembg.com', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 16}

a66fccd566bf904dd7bad70ebc7433bd31ed7b502638aba081a1cfc255fa9015

2026-06-04 16:17:10.566101+03:00

2026-06-04 16:17:10.566101+03:00

68501626c518117611bbbffe

pastejustit.com

domain

Clone, Compile, Compromise: Open-Source Malware Trap on GitHub

A newly identified threat actor, Water Curse, is exploiting GitHub to deliver weaponized repositories containing multistage malware. The group has been linked to at least 76 GitHub accounts, targeting cybersecurity professionals, game developers, and DevOps teams. Their malware enables data exfiltration, remote access, and long-term persistence on infected systems. The attack begins with trojanized open-source tools, progresses through complex infection chains using obfuscated scripts, and culminates in extensive system reconnaissance and data theft. Water Curse employs anti-debugging techniques, privilege escalation methods, and persistence mechanisms to maintain control over affected systems. The campaign poses a significant supply chain risk, especially to those relying on open-source tooling from GitHub.

2025-06-16 13:03:34.462000+03:00

2025-06-16 14:59:28.504000+03:00

['anti-debugging', 'privilege escalation', 'supply chain', 'backdoor.js.dullrat', 'open-source', 'github', 'data exfiltration', 'persistence', 'multistage malware']

['Backdoor.JS.DULLRAT']

['https://www.trendmicro.com/en_us/research/25/f/water-curse.html']

{'pulse_id': '68501626c518117611bbbffe', 'indicators': [{'id': 4025097685, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': 'pastejustit.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067847557, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': 'https://pastejustit.com/raw/tfauzcl5xj', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067847564, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': 'https://rlim.com/seraswodinsx/raw', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067847566, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': 'popcornsoft.me', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4073146898, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': 'f062c7884844da7535cb7b4e7e0a517856022fbd410eb62ecf661fded2c473bc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4073396715, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': 'f237706156df9761f419fe5729a7045b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4073396721, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': '4c391ebeff4cdfbc87ca83772a535d4386e5a5b2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4076983561, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': '2fc0686693afd37778cba68702986065e995f765', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4076983562, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': '5cd53d94caf0e811b82bad958b34322eb082567f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4076983563, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': '6894aa7c5bb643b8c32c10f6c409bbaae250ea85', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4076983564, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': 'd94f476b2aceaf4e83197475280f89ecbe3b8d35', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4076986317, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': '27c4161777ba005166156de311ba58de49eac874', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4076986318, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': '435e74551890b8c70c4b09446ec6ce0a932763f5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4076986319, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': '4c189405d684eb8e70b1848b356967e783b9c543', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4076986320, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': '585b76875aad1c99d3e06c29ad46b3adeb45639d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4076986321, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': '60bdf425bd22c34bad7d5663db31d2107153f729', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4076986322, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': '68911ad6696cfdb15c967a82c2d8aab1be634659', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4076986323, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': '6b78948f441eee53f21791d4dd88dd4fdcd5f7e3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4076986324, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': 'ad25ee224973140d41c6ecf1c1500d4efeb0b324', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4076986325, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': 'e1a02b787597a844b82a73c2488000088d0533b4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4076986326, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-16T13:03:35', 'indicator': 'fdb9fc2de72be71084cc60508d00bedbf9337172', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 21}

a1cfd84083c963fd1132a5c1fe61da98ee461c366e1d943812c406c9e05f25b2

2026-06-04 16:17:10.566101+03:00

2026-06-04 16:17:10.566101+03:00

6826fc7e4da6d524398ef1ff

https://compaq-hr-buyers-where.trycloudflare.com/cloudfla

URL

Yet Another NodeJS Backdoor (YaNB): A Modern Challenge

A resurgence in malicious campaigns exploiting deceptive CAPTCHA verifications has been observed, tricking users into executing NodeJS-based backdoors and deploying sophisticated Remote Access Trojans. The attack begins with a malicious NodeJS script connecting to attacker-controlled infrastructure, remaining passive until further commands are received. An advanced NodeJS RAT variant capable of tunneling malicious traffic through SOCKS5 proxies and using XOR-based encryption was uncovered. The campaign, known as KongTuke, uses compromised websites as initial access points. The malware employs anti-VM mechanisms, collects system information, and establishes persistence. It includes features for command execution, payload dropping, and covert communication. The RAT's functionality includes detailed system reconnaissance, remote command execution, and network traffic tunneling.

2025-05-16 08:51:10.519000+03:00

2025-06-15 08:05:52.460000+03:00

['rat', 'anti-vm', 'persistence', 'nodejs', 'socks5 proxy', 'xor encryption', 'backdoor', 'system reconnaissance', 'captcha', 'nodejs rat', 'kongtuke']

['KongTuke', 'NodeJS RAT']

['https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/yet-another-nodejs-backdoor-yanb-a-modern-challenge/']

{'pulse_id': '6826fc7e4da6d524398ef1ff', 'indicators': [{'id': 4031779404, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-16T08:51:11', 'indicator': 'https://compaq-hr-buyers-where.trycloudflare.com/cloudfla', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4032094469, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-16T08:51:11', 'indicator': 'https://rebecca-nylon-invention-ii.trycloudflare.com/cloudfll', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4038513914, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-16T08:51:11', 'indicator': 'https://rwanda-ventures-soil-trains.trycloudflare.com/cloudfla', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4039115256, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-16T08:51:11', 'indicator': 'https://lack-behind-came-verification.trycloudflare.com/cloudfla', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4064955714, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2025-05-16T08:51:11', 'indicator': 'lack-behind-came-verification.trycloudflare.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4064955715, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2025-05-16T08:51:11', 'indicator': 'rebecca-nylon-invention-ii.trycloudflare.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4064955716, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2025-05-16T08:51:11', 'indicator': 'rwanda-ventures-soil-trains.trycloudflare.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4068785766, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-16T08:51:11', 'indicator': 'https://compaq-hr-buyerswhere.trycloudflare.com/cloudfla', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4068785767, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2025-05-16T08:51:11', 'indicator': 'compaq-hr-buyers-where.trycloudflare.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4068785768, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2025-05-16T08:51:11', 'indicator': 'compaq-hr-buyerswhere.trycloudflare.com', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 10}

863ee524a13e5fc7c8671e9831d88a71b8c3254543e68bfa1ed4d4c0ec54722b

2026-06-04 16:17:10.566101+03:00

2026-06-04 16:17:10.566101+03:00

5d248087f8b3497984824460

urchintelemetry.com

domain

New MassMiner Samples

New samples of a crypto-mining worm.

2019-07-09 11:54:47.672000+03:00

2019-09-13 10:49:13.471000+03:00

[]

['https://blog.360totalsecurity.com/en/bondat-worm-struck-again-built-botnets-for-mining-cryptocurrency-and-attacking-wordpress/']

{'pulse_id': '5d248087f8b3497984824460', 'indicators': [{'id': 820245, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2019-09-13T10:49:05', 'indicator': 'urchintelemetry.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 122461025, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2019-09-13T10:48:48', 'indicator': 'bellsyscdn.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1193087587, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://a46.bulehero.in/download.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1280346076, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'bulehero.in', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1280346106, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'a46.bulehero.in', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1592957456, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'http://axx.bulehero.in/downloader.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1600887230, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'a88.bulehero.in', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1656709225, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'a88.heroherohero.info', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1660423550, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'axx.bulehero.in', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1660596059, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'http://axx.bulehero.in/appveif.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1660596060, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'http://axx.bulehero.in/avrtes.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1660596061, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'http://axx.bulehero.in/docropool.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1660596062, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'http://axx.bulehero.in/download.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1660596064, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'http://axx.bulehero.in/logagnet.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1660596065, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'http://axx.bulehero.in/mscteui.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1660596066, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'http://axx.bulehero.in/scvsots.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1660596067, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'http://axx.bulehero.in/sxstruse.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1660596068, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'http://axx.bulehero.in/unloadcur.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1660596080, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'b6ba59f8c440ff49c392e6f160bff5d9c9e45d8527e331c3e2a5c8d9bcf2d412', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1660596082, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'c69d5f4adaa27f66c3eaf3d632c839c8fb357fa864671d7dc3048c86dbeabc84', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1660596100, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'a45.bulehero.in', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1780001860, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'uio.hognoob.se', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1780001861, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'fid.hognoob.se', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1780001862, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'q1a.hognoob.se', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1803988130, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/download.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1818123725, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'upa2.hognoob.se', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1818123750, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'upa1.hognoob.se', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1818152585, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://a45.bulehero.in/download.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1826514052, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'd233335ee3810e1df0bcc768c283a122b2fbf7c322205098ccef1627be9b4e5d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2113539775, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2019-07-09T11:57:08', 'indicator': 'haq.hognoob.se', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2114058274, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': "http://fid.hognoob.se/download.exe','C:/Windows/temp/osbotslytzmfesr10840.exe'", 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2117270086, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/Wdisetection.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2117270446, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/HidregSvc.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2117791791, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/upnpprhost.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502752, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/Scarloginler.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502753, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/SunloglicySrv.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502754, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/download.exe%20C:/Windows/temp/bkxigfrpbzlwivy5013.exe%20&%20cmd.exe%20/c%20C:/Windows/temp/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502755, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/download.exe%20C:/Windows/temp/bkxigfrpbzlwivy5013.exe%20&%20cmd.exe%20/c%20C:/Windows/temp/bkxigfrpbzlwivy5013.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502756, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/download.exe%E2%80%99', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502757, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': "http://fid.hognoob.se/download.exe';'C:/Windows/temp/", 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502758, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': "http://fid.hognoob.se/download.exe';'C:/Windows/temp/ubhflqgunjzgqat2803.exe", 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502759, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/download.exe)%E4%B8%8B%E8%BC%89%E6%83%A1%E6%84%8F%E5%9F%B7%E8%A1%8C%E6%AA%94%E3%80%82', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502760, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/download.exe.', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502761, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/download.exe931ACFC939497192EBA8821B57C1911A232BBE51', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502762, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/downloads', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502763, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/downlode.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502764, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/favicon.ico', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502765, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/scarloginler.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502766, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/sunloglicysrv.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2118502767, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-09T11:54:49', 'indicator': 'http://fid.hognoob.se/wercplhost.exe', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 142}

7fa8ee8c566fe848fe4116ecca8a274d9aa233304cd4485593caa81e1366f4bf

2026-06-04 16:17:13.800238+03:00

2026-06-04 16:17:13.800238+03:00

69f25f08af8a4430bf75a39f

https://app.kuse.ai/sharednote/

URL

Kuse Web App Abused to Host Phishing Document

Bad actors exploited Kuse, a legitimate AI-based workplace application, to conduct a phishing campaign. Attackers leveraged a Vendor Email Compromise (VEC) to send malicious emails from a trusted vendor's compromised mailbox, establishing initial trust. The attack utilized Kuse's file-sharing features to host a fake blurred document with a Markdown file extension (.md) under the legitimate domain app[.]kuse[.]ai. Victims were presented with a fabricated document preview containing Spanish text prompting them to click a link. This redirected users to a fraudulent Microsoft login page designed to harvest credentials. The attack combined multiple social engineering techniques including domain trust exploitation, unusual file extensions to evade detection, and vendor relationship abuse to bypass security controls and user scrutiny.

2026-04-29 19:42:00.852000+03:00

2026-05-29 19:04:23.918000+03:00

['fake login page', 'credential harvesting', 'vendor email compromise', 'supply chain', 'ai platform abuse', 'markdown file', 'social engineering', 'phishing']

[]

['https://www.trendmicro.com/en_us/research/26/d/kuse-web-app-abused-to-host-phishing-document.html']

{'pulse_id': '69f25f08af8a4430bf75a39f', 'indicators': [{'id': 4334026142, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-29T19:42:01', 'indicator': 'https://app.kuse.ai/sharednote/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4334026143, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-29T19:42:01', 'indicator': 'https://onlineapp.ooraikaoo.info/?auth2=8rf22euu-2nxkebabDjjILlzldhQq2Pz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4334026145, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-29T19:42:01', 'indicator': 'onlineapp.ooraikaoo.info', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 3}

b8c26a1cfca70002a5bf7be41e242014d1689f130d3789fb0d43cb0bfbbde69a

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

63a5aee2ab023fdb06264ff2

0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8

FileHash-SHA256

Godfather: A banking Trojan that is impossible to refuse

Group-IB’s Threat Intelligence team has identified and identified the Android banking Trojan Godfather, which has been used by cybercriminals to steal the login credentials of hundreds of financial services.

2022-12-23 13:36:33.428000+03:00

2023-01-22 13:01:57.435000+03:00

['Godfather', 'Banking Trojan']

['Anubis']

['https://blog.group-ib.com/godfather-trojan']

{'pulse_id': '63a5aee2ab023fdb06264ff2', 'indicators': [{'id': 3404733623, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': '0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3404733624, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': 'c79857015dbf220111e7c5f47cf20a656741a9380cc0faecd486b517648eb199', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3406579480, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': 'd7118d3d6bf476d046305be1e1f9b388', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3406579482, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': '2b3b78d3a62952dd88fc4da4688928ec6013af71', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3460877337, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': 'pluscurrencyconverter.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3520291481, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': 'banerrokutepera.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3520291929, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': 'henkormerise.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603339349, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': '0ece45f5deb77db816d8950fce07cabb', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 38386f4fabd0bc7f7065eaee818717e89772fb3b1a3744df754c45778e353f70'}, {'id': 3603339350, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': '735ede5f45394a36d3a44c9eba738925', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 9dfb5b4ad9aac36c2d7fbb93f8668faa819cb0df16f4a55d00f1cdda89c9a6d2'}, {'id': 3603339351, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': '7e061e87f9a4c27bfb69980980270720', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 34d37927b35f422e7c28055ea989ef6524a668ef'}, {'id': 3603339352, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': '34d37927b35f422e7c28055ea989ef6524a668ef', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603339353, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': '3d74ce909e34f4e995363e0f079666de17f51d30', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 9dfb5b4ad9aac36c2d7fbb93f8668faa819cb0df16f4a55d00f1cdda89c9a6d2'}, {'id': 3603339354, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': 'e3abf2f1e5cf5de264b7a9488edf9187fab30695', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 38386f4fabd0bc7f7065eaee818717e89772fb3b1a3744df754c45778e353f70'}, {'id': 3603339355, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': '38386f4fabd0bc7f7065eaee818717e89772fb3b1a3744df754c45778e353f70', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603339356, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': '7664293fc1dde797940d857d1f16eb1e12a15b9126d704854f97df1bedc18758', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603339357, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': '9815ba07d0a2528c11d377b583243df24218a48c6a4f839f40769ea290555070', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603339358, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': '9dfb5b4ad9aac36c2d7fbb93f8668faa819cb0df16f4a55d00f1cdda89c9a6d2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603339359, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': 'a14aad1265eb307fbe71a3a5f6e688408ce153ff19838b3c5229f26ee3ece5dd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603339360, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': 'b6249fa996cb4046bdab37bab5e3b4d43c79ea537f119040c3b3e138149897fd', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 34d37927b35f422e7c28055ea989ef6524a668ef'}, {'id': 3603339361, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': 'c3dadb9a593523d1bf3fe76dabf375578119aff3110d92a1a4ee6db06742263a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603339362, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': 'c4bace10849f23e9972e555ac2e30ac128b7a90017a0f76c197685a0c60def6d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603339363, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': 'd652ac528102de3ebb42a973db639ae27f13738e005172e5ff8aac6e91f3f760', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603339364, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': 'f8d2382f72890b1975e1f149d07fdd3c36fff1d523e4ea83b2b1f593f956e7a0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603339371, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-12-23T13:36:34', 'indicator': 'heikenmorgan.com', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 24}

6f7dde2edfd8dd61af3f0dc551052f73e533cf8d31f410033a3b779ef89ad885

2026-06-04 16:17:12.408553+03:00

2026-06-04 16:17:12.408553+03:00

5e12fa63c8f8ca38b987d577

microsft-update.com

domain

New GhostCringe Samples used for DDoS and Mining

The samples are sent over Telegram using backdoored bait documents.

2020-01-06 09:14:11.050000+03:00

2020-01-06 09:14:11.050000+03:00

['GhostCringe']

['https://ti.qianxin.com/blog/articles/newly-disclosed-golden-eye-dog-black-gang/']

{'pulse_id': '5e12fa63c8f8ca38b987d577', 'indicators': [{'id': 982014458, 'role': '', 'type': 'domain', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'microsft-update.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2138753599, 'role': '', 'type': 'domain', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'chenyon1314.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896066, 'role': '', 'type': 'domain', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'sudaqiang123.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896067, 'role': '', 'type': 'domain', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'dpcq999.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896068, 'role': '', 'type': 'domain', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'xunqing8888.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896069, 'role': '', 'type': 'domain', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'globaltopgarlic.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896070, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://223.199.14.229:5767', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896071, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://103.76.87.126:9772', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896072, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://103.233.8.24:5768', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896073, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://202.181.24.16:8596', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896074, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://112.67.34.32:5767', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896075, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://202.181.24.16:9118', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896076, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://223.199.1.113:5767', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896077, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://103.233.10.85:5769', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896078, 'role': '', 'type': 'hostname', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'test.microsft-update.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896079, 'role': '', 'type': 'hostname', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'test.hhlywsc.cn', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896080, 'role': '', 'type': 'hostname', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'www.bestriven123.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896081, 'role': '', 'type': 'hostname', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'www.xunqing888.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896082, 'role': '', 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': '03d8614a18a2d4bf1d6478fd216da2e2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896083, 'role': '', 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': '79a4f8c5fe33b162187e2341e3fac004', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896084, 'role': '', 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': '7b3ba2f713f05906b6241144f3979628', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896085, 'role': '', 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'b65b16cb38101fe83edc4afc50cdf100', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896086, 'role': '', 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': '2f4329446849a13600aab4f03a7427a2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896087, 'role': '', 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': '6ae80424599498af8bcb128f0a24f9d1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896088, 'role': '', 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': '30ec1d1dabe0cd4e757f84a3052f3465', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896089, 'role': '', 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': '0d0e93676954f41af2b7885f6b788d1e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896090, 'role': '', 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'f3b32e9b5632230769de0abf150288a2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896091, 'role': '', 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': '7762605dcb35118fb69546affd096ac8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2185896092, 'role': '', 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': '2de1a991b799bc11a67e9b5112947182', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683811, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://www.xunqing8888.xyz/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683812, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://xunqing8888.xyz/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683813, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://test.microsft-update.com/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683814, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://globaltopgarlic.com/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683815, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://globaltopgarlic.com/1.jpg', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683816, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://globaltopgarlic.com/Junction.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683817, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://globaltopgarlic.com/queryInstallLsp.dll', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683818, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://globaltopgarlic.com/tmp.log', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683819, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://globaltopgarlic.com/tmp2.log', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683820, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://test.hhlywsc.cn/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683821, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://test.hhlywsc.cn/Junction.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683822, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://test.hhlywsc.cn/basicnetutils.dll', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683823, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://test.hhlywsc.cn/new.jpg', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683824, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://test.hhlywsc.cn/q.crt', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683825, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'http://test.hhlywsc.cn/q.sct', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683826, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'https://chenyon1314.xyz/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683827, 'role': '', 'type': 'hostname', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'www.xunqing8888.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683828, 'role': '', 'type': 'hostname', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': 'www.chenyon1314.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683829, 'role': '', 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': '65ee8673ce079b4859608cbb047d1614795ec5f179a072180ae83468b0ab34d3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683830, 'role': '', 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': '6d779b61f0f9c5203889a6f15b488b1e196b959f67635ba28b03d81d7f49e2b1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2192683831, 'role': '', 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-01-06T09:14:12', 'indicator': '8a310af2787bb9db77c98111945458f0cf3968ed908c2e65e2c233dc86f86d86', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 60}

cb2eab02340d56e0bf7689f8705c522f216b880311cac48d371bcc17a514bdd7

2026-06-04 16:17:13.800238+03:00

2026-06-04 16:17:13.800238+03:00

646765746468225843222473

magicfinger.ddns.net

hostname

Java RAT C2

C2 server for Java RAT stored on the Discord CDN according to ISC researcher.

2023-05-19 12:02:58.125000+03:00

2023-05-19 12:02:58.125000+03:00

['Java RAT']

[]

['https://isc.sans.edu/diary/rss/29864']

{'pulse_id': '646765746468225843222473', 'indicators': [{'id': 3682294754, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-19T12:03:01', 'indicator': 'magicfinger.ddns.net', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 1}

6f01b95ee5a687112aca3039bceb40a21c2ae882becfd67acd430c1b4c521be8

2026-06-04 16:17:12.090041+03:00

2026-06-04 16:17:12.090041+03:00

633dcf3971af0a0dae3243b7

ppaauuaa11232.cc

domain

LockBit 3.0 Ransomware Distributed via Word Documents

The ASEC team has identified that LockBit 3.0 ransomware is being distributed in NSIS format and in Word document format, similar to the previous cases in which the ransomware was distributed disguised as job applications.

2022-10-05 18:38:48.730000+03:00

2022-10-05 18:39:27.981000+03:00

['Lockbit', 'VBA Macro', 'Word Document', 'Powershell', 'Ransomware', 'Phishing']

['LockBit']

['https://asec.ahnlab.com/en/39242/']

{'pulse_id': '633dcf3971af0a0dae3243b7', 'indicators': [{'id': 3558172107, 'role': 'malware_hosting', 'type': 'domain', 'title': '', 'content': '', 'created': '2022-10-05T18:38:50', 'indicator': 'ppaauuaa11232.cc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3558172108, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:38:50', 'indicator': '2d8b6275dee02ea4ed218ba2673b834e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3558172109, 'role': None, 'type': 'FileHash-MD5', 'title': 'SLF:SCPT:OffRelAttachedTemplateHttp.A', 'content': '', 'created': '2022-10-05T18:38:50', 'indicator': '45dfdde3df07b6ccc23b7ae6e3dc1212', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3558172110, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:38:50', 'indicator': '738bee5280d512a238c3bb48c3278f63', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3558172111, 'role': None, 'type': 'FileHash-MD5', 'title': 'Other:Malware-gen\\ [Trj]', 'content': '', 'created': '2022-10-05T18:38:50', 'indicator': '77c5fb080bf77f099c5b5f268dcf4435', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3558172112, 'role': None, 'type': 'FileHash-MD5', 'title': 'SUSP_NullSoftInst_Combo_Oct20_1', 'content': '', 'created': '2022-10-05T18:38:50', 'indicator': '7b74e4fb9a95f41d5d9b4a71a5fe40b9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3558172113, 'role': None, 'type': 'FileHash-MD5', 'title': 'SLF:SCPT:OffRelAttachedTemplateHttp.A', 'content': '', 'created': '2022-10-05T18:38:50', 'indicator': '97c07d03556ddcfc8ebfa462df546eb5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3558172114, 'role': None, 'type': 'FileHash-SHA1', 'title': 'Other:Malware-gen\\ [Trj]', 'content': '', 'created': '2022-10-05T18:38:50', 'indicator': '160c8bc7c5284ba5c0f1b68bd61500d7c7a6b2c4', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 77c5fb080bf77f099c5b5f268dcf4435'}, {'id': 3558172115, 'role': None, 'type': 'FileHash-SHA1', 'title': 'SLF:SCPT:OffRelAttachedTemplateHttp.A', 'content': '', 'created': '2022-10-05T18:38:50', 'indicator': '36ff7eb9b5e0c112197de5cbb13761927e201053', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 45dfdde3df07b6ccc23b7ae6e3dc1212'}, {'id': 3558172116, 'role': None, 'type': 'FileHash-SHA1', 'title': 'SLF:SCPT:OffRelAttachedTemplateHttp.A', 'content': '', 'created': '2022-10-05T18:38:50', 'indicator': 'c625a62c9fc3abbd7cba88e275ddb2c07368856f', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 97c07d03556ddcfc8ebfa462df546eb5'}, {'id': 3558172117, 'role': None, 'type': 'FileHash-SHA1', 'title': 'SUSP_NullSoftInst_Combo_Oct20_1', 'content': '', 'created': '2022-10-05T18:38:50', 'indicator': 'ff3e85fec483c637774101194c52a17a6a0598ef', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 7b74e4fb9a95f41d5d9b4a71a5fe40b9'}, {'id': 3558172118, 'role': None, 'type': 'FileHash-SHA256', 'title': 'SUSP_NullSoftInst_Combo_Oct20_1', 'content': '', 'created': '2022-10-05T18:38:50', 'indicator': '0ec87a7f943ab72d08aeb957d33dd348ab7cf45052ab7a31bcce33ff7a095837', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 7b74e4fb9a95f41d5d9b4a71a5fe40b9'}, {'id': 3558172119, 'role': None, 'type': 'FileHash-SHA256', 'title': 'SLF:SCPT:OffRelAttachedTemplateHttp.A', 'content': '', 'created': '2022-10-05T18:38:50', 'indicator': '1f0617725b2a0b0c3bb1067f0b77da049da0545710d9743813969b3bbcc563f4', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 97c07d03556ddcfc8ebfa462df546eb5'}, {'id': 3558172120, 'role': None, 'type': 'FileHash-SHA256', 'title': 'Other:Malware-gen\\ [Trj]', 'content': '', 'created': '2022-10-05T18:38:50', 'indicator': 'baafd4f1903f80a473facbf3889ee98823fa560c3eecf3fb232e67c78b0c3a80', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 77c5fb080bf77f099c5b5f268dcf4435'}, {'id': 3558172121, 'role': None, 'type': 'FileHash-SHA256', 'title': 'SLF:SCPT:OffRelAttachedTemplateHttp.A', 'content': '', 'created': '2022-10-05T18:38:50', 'indicator': 'f019495a1d4feecc07769dc1fbecccb871634cc707c43befe1ea7aa2c629e337', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 45dfdde3df07b6ccc23b7ae6e3dc1212'}], 'indicators_count': 15}

5df89213a8a6f3f27f2c856c8f7a07d1fa9b6df7d6e4695831f277c90b81a081

2026-06-04 16:17:12.408553+03:00

2026-06-04 16:17:12.408553+03:00

682234494e60523c62b4e695

f9baac5f7aef86ee1e331bd9cf004969

FileHash-MD5

New Noodlophile Stealer Distributes Via Fake AI Video Generation Platforms

As artificial intelligence (AI) surges into mainstream adoption, millions of users turn daily to AI-powered tools for content creation—from generating art and music to transforming photos into videos. But amid this excitement, cybercriminals have uncovered a potent new lure: fake AI platforms promising cutting-edge content generation in exchange for user uploads.

2025-05-12 17:47:52.927000+03:00

2025-06-11 17:05:44.412000+03:00

['noodlophile', 'xworm', 'capcutloader', 'morphisec', 'word document', 'video dream', 'worm', 'python', 'credential theft', 'infostealer', 'remote access', 'facebook', 'ai']

['xworm']

['https://www.morphisec.com/blog/new-noodlophile-stealer-fake-ai-video-generation-platforms/']

{'pulse_id': '682234494e60523c62b4e695', 'indicators': [{'id': 4059212833, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'f9baac5f7aef86ee1e331bd9cf004969', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 18c14dcfb9a54c5359026a5fcbdb3e4ba6ced2628a9cd9ae589baedbb29beaa6'}, {'id': 4059212865, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'fb6ae9cb662361d7ad1b58a4b03fe6e3c84e53ba', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 18c14dcfb9a54c5359026a5fcbdb3e4ba6ced2628a9cd9ae589baedbb29beaa6'}, {'id': 4059212867, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': '18c14dcfb9a54c5359026a5fcbdb3e4ba6ced2628a9cd9ae589baedbb29beaa6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898053, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': '11c873cee11fd1d183351c9cdf233cf9b29e28f5e71267c2cb1f373a564c6a73', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898055, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': '286076a09f524cc7015f23fb63515b3a30cee070fbc13fbb6f8e9cb1e5ced2ce', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898056, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': '32174d8ab67ab0d9a8f82b58ccd13ff7bc44795cca146e61278c60a362cd9e15', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898057, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': '353f17553a3457c6b77c4ca30505d9307dda9613e2a98ad3e392d2084284b739', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898058, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': '5c98553c45c9e86bf161c7b5060bd40ba5f4f11d5672ce36cd2f30e8c7016424', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898059, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': '67779bf7a2fa8838793b31a886125e157f4659cda9f2a491d9a7acb4defbfdf5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898060, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': '6c32460510925289421d1c7af986e00e9ada459f56a423d8b65d6cc57ed053c7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898061, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': '82c0d5c4c405739aee74b792dccd7c821a9f06a0f6e389ad57a321adcc6757a7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898062, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': '86d6dd979f6c318b42e01849a4a498a6aaeaaaf3d9a97708f09e6d38ce875daa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898063, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': '8b0ee435928189c98969825e729a014e94b90e1da3af3cfeee1d02374c2bd906', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898064, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': '934a68ac125cf995662bdd2d76a1d8dd3f107010ce77e21f003ebc581dc025d3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898065, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': '97927fdaaa8c55ac7c85ae6087a1ea637bb0e43148b3759740eaa75b64c459b2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898066, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'c006c6dddb9bfcdbf2790eee4bc77dd09cd63ab5b8e64190a55b9e5b66325d55', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898067, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'c612a70e6a5c211d888f6032143e8ba8c70c15a5e1ebf17ab59146eb7fb707f1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898068, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'dc3e9daf25c44eb5d3ad12aa668c6219e8e7031152e1d7d51ee0b889c37ba443', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898069, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'e2c8eaf77dca9ed188f12261b9e9052ba0e58d1b9c45d922cbf0f3d00611ea56', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898070, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'ecf0f68e8cd4683f0bb0e11b575ee2c31ff559abcea8823c54d86fc4b36fd83f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898071, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'f9a8b13c56d1074beed40de97920beef2e39086591e961c2c45e25fdd16b4786', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898072, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'fa0c8f439db570b4206f7c8be497cf91aaf28e41eaffdc70baef904b190387ef', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898074, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'http://103.232.54.13:25902', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898075, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'http://160.25.232.62/bee/bee02_ads.txt', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898076, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'http://lumalabs-dream.com/VideoLumaAI.zip', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898077, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'https://85.209.87.207/sysdi/LDXC10.txt', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898078, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'https://85.209.87.207/sysdi/randomuser2025.txt', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898079, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'https://luma-aidreammachine.com/Creation_Luma.zip', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898080, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'https://luma-dreammachine.com/File_Successful.zip', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4066898081, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'https://luma-dreammachine.com/LumaAI.zip', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067745472, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T17:47:54', 'indicator': 'https://85.209.87.207/sysdi/randomuser2025.txt.', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 31}

4cbc6e92df4210c4e1adb1cc105e1f4393aa100acf26efbd7cf636749a8e8454

2026-06-04 16:17:10.566101+03:00

2026-06-04 16:17:10.566101+03:00

60df026b54737eb1c5a3dc70

micsoftin.us

domain

Backdoored Client from Mongolian CA MonPass

Avast has released an analysis of malware that was backdoored with Cobalt Strike binaries and sent shellcode to victims, including MonPass, which is a major certification authority in East Asia.

2021-07-02 12:11:22.977000+03:00

2021-08-01 00:02:03.928000+03:00

['cobalt strike', 'monpass', 'Backdoor', 'CA']

['Cobalt Strike']

['https://decoded.avast.io/luigicamastra/backdoored-client-from-mongolian-ca-monpass/']

{'pulse_id': '60df026b54737eb1c5a3dc70', 'indicators': [{'id': 2735709083, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'micsoftin.us', 'is_active': 1, 'expiration': None, 'description': 'Registered=06/04/2020 Registrar=NAMECHEAP INC NS=leonidas.ns.cloudflare.com'}, {'id': 2871393594, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'download.google-images.ml', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2990127229, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'jquery-code.ml', 'is_active': 1, 'expiration': None, 'description': 'NS=nadia.ns.cloudflare.com'}, {'id': 3116303853, 'role': '', 'type': 'URL', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'https://webplus-cn-hongkong-s-5faf81e0d937f14c9ddbe5a0.oss-cn-hongkong.aliyuncs.com/Silverlight_ins.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303854, 'role': None, 'type': 'FileHash-MD5', 'title': 'ALF:Trojan:Win64/Fishter.A!dha', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'abcd461bdb6a6537b7a36848a87b5ea6', 'is_active': 1, 'expiration': None, 'description': 'MD5 of f21a9c69bfca6f0633ba1e669e5cf86bd8fc55b2529cd9b064ff9e2e129525e8'}, {'id': 3116303855, 'role': None, 'type': 'FileHash-SHA1', 'title': 'ALF:Trojan:Win64/Fishter.A!dha', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'e99d5a620a488133f4da24e1f8d2d5e68542b6f3', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of f21a9c69bfca6f0633ba1e669e5cf86bd8fc55b2529cd9b064ff9e2e129525e8'}, {'id': 3116303856, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '28e050d086e7d055764213ab95104a0e7319732c041f947207229ec7dfcd72c8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303857, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '379d5eef082825d71f199ab8b9b6107c764b7d77cf04c2af1adee67b356b5c7a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303858, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '456b69628caa3edf828f4ba987223812cbe5bbf91e6bbf167e21bef25de7c9d2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303859, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '4a43fa8a3305c2a17f6a383fb68f02515f589ba112c6e95f570ce421cc690910', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303860, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '5cebdb91c7fc3abac1248deea6ed6b87fde621d0d407923de7e1365ce13d6dbe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303861, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '9834945a07cf20a0be1d70a8f7c2aa8a90e625fa86e744e539b5fe3676ef14a9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303862, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'a7e9e2bec3ad283a9a0b130034e822c8b6dfd26dda855f883a3a4ff785514f97', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303863, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'e2596f015378234d9308549f08bcdca8eadbf69e488355cddc9c2425f77b7535', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303864, 'role': None, 'type': 'FileHash-SHA256', 'title': 'ALF:Trojan:Win64/Fishter.A!dha', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'f21a9c69bfca6f0633ba1e669e5cf86bd8fc55b2529cd9b064ff9e2e129525e8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303865, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'http://37.61.205.212:8880/dow/Aili.pdf', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303866, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'http://37.61.205.212:8880/download/Browers_plugin.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303867, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'http://download.google-images.ml:8880/downloa/37.bmp', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303868, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'http://download.google-images.ml:8880/download/37.bmp', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303869, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'http://download.google-images.ml:8880/download/DNSs.bat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303870, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'http://download.google-images.ml:8880/download/x37.bmp', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303871, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'http://micsoftin.us:2086/dow/83.bmp', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303872, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'https://jquery-code.ml', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303873, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'https://jquery-code.ml/Download/Browser_Plugin.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303874, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '0dca25cb980e13b125c2490e63ffdd86', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303875, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '0fab8fa2ef340a93f0b062d575ade5b7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303876, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '2a61b97914cfb6810e37ebebb440e943', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303877, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '41dc7763def09be7f2e8a4dbc9922434', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303878, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '6136add51eda5b198b6d36dc0c693e20', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303879, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '738f46546f6d4a79e2d917b26bf8a93a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303880, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'a241ff3d86925a4a12916b401536b019', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303881, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'e451a8a028da21cf0faa97881f226dfc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303882, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '3880ee01f2fc37dcae2c840799c7a8a71f31a0ed', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303883, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '6fb68fcbc578b4eda978b463345d2919eed70020', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303884, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '74995058f9e7fa6951821c0568fdaf168cace179', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303885, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '7c425c48861e39f2613ff72199f711e761165054', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303886, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': '834e80f6fa9935fd3184c25e4e37b0a068a773ee', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303887, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'd28eacb1b4d2e9ef54f7dff09ca03a6866fc9184', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303888, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'fc33ae4120496b81fbad82b14821ea996ce46ce7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3116303889, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2021-07-02T12:11:24', 'indicator': 'ff703024e0b59fe20495d6b9f568bedddc8b12e1', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 40}

b5e20debb78057b803b72424fe535f90225129e1220ec3f4cf76e906ca3ec964

2026-06-04 16:17:13.090022+03:00

2026-06-04 16:17:13.090022+03:00

664da54293c6536501aaaaad

monopoliafromyou.ru

domain

Spring Exacerbation: UAC-0006 increased cyberattacks

This report aims to provide insights into the ongoing cyber operations targeting Ukraine. It analyzes the tactics, techniques, and procedures employed by threat actors in their malicious campaigns. The document offers a comprehensive overview of the cybersecurity landscape in Ukraine, highlighting the challenges faced and the measures taken to counter these threats.

2024-05-22 07:56:49.440000+03:00

2024-06-21 07:00:09.028000+03:00

['ukraine', 'uac-0006', 'smokeloader', 'powershell', 'taleshot']

['taleshot', 'Trojan:Win32/SmokeLoader']

['https://cert.gov.ua/article/6279366']

{'pulse_id': '664da54293c6536501aaaaad', 'indicators': [{'id': 3793489145, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'monopoliafromyou.ru', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996199, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': '09f4f3a9a0b5a8c7ab42bf1a41ae623c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996200, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': '36da0a1d6f88800b96c2f4cf69ec79d0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996201, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': '408cff891cbade705d9e720831aecb23', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996202, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': '49971fb6daddfd893d2753f23df819fc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996203, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': '4affa48a16a972442d8c401962b5c723', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996204, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': '5ad45fc2b7ca8db7385227a5831fdae9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996205, 'role': None, 'type': 'FileHash-MD5', 'title': 'PowerShell_Case_Anomaly', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': '6ea31e8fa244e26b552320114ff75130', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 96e1fc4906cb79eab198dc76dbed47afc5855d26be0ca37910f8359b2683aef0'}, {'id': 3891996206, 'role': None, 'type': 'FileHash-MD5', 'title': 'PowerShell_Case_Anomaly', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'bd5e7e4a03d07749c8ee058f9f7f5e24', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 5713b230f0aa6e8a78c655494c40885b606a5ed2e2ba5a1c8729974158e683fd'}, {'id': 3891996207, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'd9231f86da8cfe84b4cc9de1b0144605', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996208, 'role': None, 'type': 'FileHash-SHA1', 'title': 'PowerShell_Case_Anomaly', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'bd437f1014fe3cd156b2a8e9eaf42b0619001f38', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 5713b230f0aa6e8a78c655494c40885b606a5ed2e2ba5a1c8729974158e683fd'}, {'id': 3891996209, 'role': None, 'type': 'FileHash-SHA1', 'title': 'PowerShell_Case_Anomaly', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'e1f37bcd29e7d7fc8665275c6b8521bf5c7338d9', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 96e1fc4906cb79eab198dc76dbed47afc5855d26be0ca37910f8359b2683aef0'}, {'id': 3891996210, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': '41bfd96d49bf35bf4ca946b9a51fa8784baf683d634f7ce9e068f6bded979fa2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996211, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': '49127fcef058750578d87b6a4a25c8da77185cdd8796bc589dc5cf31f884c171', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996212, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': '4c9b55906b1d9774cb3a43f3ca11cde266b6ebec0afdcab2dd1bcffa1bd99ec3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996213, 'role': None, 'type': 'FileHash-SHA256', 'title': 'PowerShell_Case_Anomaly', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': '5713b230f0aa6e8a78c655494c40885b606a5ed2e2ba5a1c8729974158e683fd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996214, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': '82c78f76eabaab176b69b671865d3605d6af7e66a06bbc57d58d1494d44475b4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996215, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': '84a02a761c545b0cc9753a74f9820dd39adfe54c635fc00fe21c2989d03874f7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996216, 'role': None, 'type': 'FileHash-SHA256', 'title': 'PowerShell_Case_Anomaly', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': '96e1fc4906cb79eab198dc76dbed47afc5855d26be0ca37910f8359b2683aef0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996217, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': '9c9df8669f1b07ec66e7b82ac97e188412f82ce549fb3552cca84413005fec9f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996218, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'a546e49506f7144ff08c824c0503f8625d17f760d8ac20074aac870b0a3941d7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996224, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'http://agentsuperpupervinil.ru/index.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996225, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'http://ccbaminumpot.ru/index.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996226, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'http://monopoliafromyou.ru/download/1.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996227, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'http://picwalldoor.ru/index.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996228, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'http://rafraystore.ru/index.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996229, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'http://sephoraofficetz.ru/index.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996230, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'http://vikompalion.ru/index.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996231, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'http://vivianstyler.ru/index.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996232, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'agentsuperpupervinil.ru', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996233, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'ccbaminumpot.ru', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996234, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'picwalldoor.ru', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996235, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'rafraystore.ru', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996236, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'sephoraofficetz.ru', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996237, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'vikompalion.ru', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891996238, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-05-22T07:56:51', 'indicator': 'vivianstyler.ru', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 36}

18019e11e8fb8cf4f4353f773350d430c8251e517d3ce3c465b3f7002930845a

2026-06-04 16:17:11.462594+03:00

2026-06-04 16:17:11.462594+03:00

6a0b5e378b3635e94b3b7656

6182120286.my.id

domain

FlowerStorm unleashes the KrakVM: PhaaS operators turn to VM-based obfuscation

FlowerStorm is a widely known Phishing-As-A-Service (PhaaS) attack kit that has been active since at least mid-2024, increasingly in large scale campaigns. FlowerStorm performs targeted, complex collection of a victim’s credentials, including the management of multi-factor authentication (MFA).

2026-05-18 18:45:09.920000+03:00

2026-05-18 18:45:09.920000+03:00

['phaas', 'flowerstorm', 'mfa', 'kravvm', 'vm', 'phishing', 'html', 'attachment']

['FlowerStorm']

['https://sublime.security/blog/flowerstorm-unleashes-the-krakvm-phaas-operators-turn-to-vm-based-obfuscation/']

{'pulse_id': '6a0b5e378b3635e94b3b7656', 'indicators': [{'id': 4014853728, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '6182120286.my.id', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4029299577, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'alexperu.courtfilecloud.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4127711857, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '7250102277.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4136333664, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '5832068083.cyou', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4136333666, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '7840190445.cyou', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4141801968, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'bafybeiclfnumyd3aztwl2xjz5o6cfw4fqepqz6a6uow3dig57pf5najq2u.ipfs.w3s.link', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4145778139, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '5348785839.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4197668899, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'rdaol.dreamsintheframe.de', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4201825109, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'dfjxt.patienceintherain.de', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4226215939, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'pkxza.ruminatingbrook.de', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4250402919, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'vvbea.builtinlayers.de', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4287676056, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'uvehh.digitalsuccessframeworks.de', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4292003930, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'pozao.clearconceptsdesign.de', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4294792753, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'vunbp.scalableplatforms.de', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4301040632, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'dpqcm.solidreputation.de', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4317873690, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'ottm.secureuserguard.de', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327345859, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'sjask.reliablevisibility.de', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025396, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'b0ed4da928344ac2972a05ded086e4da', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025397, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '1391604445.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025398, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '1419993777.cyou', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025399, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '1518076290.cyou', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025400, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '1569742347.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025401, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '1969421924.cyou', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025402, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '2008377162.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025403, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '2067612207.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025404, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '2143835084.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025405, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '5237741854.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025406, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '5334635671.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025407, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '5531648314.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025408, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '5624221719.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025409, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '6018258857.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025410, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '6185945827.sbs', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025411, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '6264277690.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025412, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '6326889358ghf.cyou', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025413, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '6438259665.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025414, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '6837577840.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025415, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '6970793981ad.cyou', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025416, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '7588085895.cyou', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025417, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '7622350912.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025418, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '7766360391.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025419, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '7983520156.cyou', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025420, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '8103841751.cyou', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025421, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '8191769809.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025422, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'amaxelectronics.co.za', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025423, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'asphalt9nitroo.my.id', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025424, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'mkreply2024.my.id', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025425, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'outrageousorganisation.com.au', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025426, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '04qq.digitalcompetitiveedge.de', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025427, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': '2059746795x.diflucan50.store', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367025428, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-18T18:45:11', 'indicator': 'ableg.docufiled.com', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 87}

c47b257f19db299ab6dfbbae75f14bebe94fe6807b16769e12effbc2bc4c37fe

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

5f034f9b9e99f7d878531c42

CVE-2020-5902

CVE

F5 RCE vulnerability (CVE-2020-5902) ITW Findings

A collection of CVE-2020-5902 IOCs observed scanning in the wild, with samples delivered.

2020-07-06 16:21:46.918000+03:00

2020-08-23 00:07:47.185000+03:00

['F5', 'RCE', 'CVE-2020-5902']

[]

['AT&T Alien Labs', 'https://research.nccgroup.com/2020/07/05/rift-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902-intelligence/', 'https://twitter.com/bad_packets/status/1279986441385172993']

{'pulse_id': '5f034f9b9e99f7d878531c42', 'indicators': [{'id': 2285664748, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2020-07-06T16:22:16', 'indicator': 'CVE-2020-5902', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2287140394, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2020-07-06T17:48:54', 'indicator': 'http://panel.devilsden.net/iot.sh', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2287140396, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2020-07-06T17:48:54', 'indicator': 'panel.devilsden.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2287260379, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2020-07-06T16:21:48', 'indicator': 'http://103.224.82.85:8000/zabbix', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2287260380, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2020-07-06T16:21:48', 'indicator': 'http://217.12.199.179/b.sh', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2287260381, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2020-07-06T16:21:48', 'indicator': 'http://45.77.28.70/inf5.sh', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2287260385, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-06T16:21:48', 'indicator': 'a29efb89993616ba832adf005454bc926afcfb60cefbf93fb2c474669b8cc6ab', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 25ae7068f1f5e71c24e3ff69403af9d7'}, {'id': 2287260386, 'role': None, 'type': 'FileHash-SHA256', 'title': 'Txt.Malware.Sustes-6779550-1', 'content': '', 'created': '2020-07-06T16:21:48', 'indicator': 'cdc377df83282b781145f23a6b51687f18a862c8d0125e91a5f369bdc806dd23', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 38303db793ece20c6ee3abd73f51abd0'}, {'id': 2287260387, 'role': None, 'type': 'FileHash-MD5', 'title': 'Txt.Malware.Sustes-6779550-1', 'content': '', 'created': '2020-07-06T16:21:48', 'indicator': '38303db793ece20c6ee3abd73f51abd0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2287260388, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-07-06T16:21:48', 'indicator': '25ae7068f1f5e71c24e3ff69403af9d7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2287260389, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2020-07-06T16:21:48', 'indicator': '4e702109ffac9880989a2312cfd5e9e848a61395', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 25ae7068f1f5e71c24e3ff69403af9d7'}, {'id': 2287260390, 'role': None, 'type': 'FileHash-SHA1', 'title': 'Txt.Malware.Sustes-6779550-1', 'content': '', 'created': '2020-07-06T16:21:48', 'indicator': '3707cee08e6e87ca3688b79234d61eabbcdcb213', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 38303db793ece20c6ee3abd73f51abd0'}, {'id': 2287260391, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2020-07-06T16:21:48', 'indicator': 'b8ce500c1e6ec4d4268ae0d2de82f9f35bbfc673', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2287260392, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2020-07-06T16:21:48', 'indicator': 'e1775079d58a6266fdd6185143642ac53b4314fe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2287260419, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2020-07-06T16:22:16', 'indicator': 'http://45.77.28.70/demo.txt', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2287290345, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2020-07-06T17:48:54', 'indicator': 'http://185.172.111.233:999/sisi/x86', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2287374751, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-06T22:55:53', 'indicator': '03d46ea35711bfd8254ddf53077c03e53a5e2368300c754b0286ab66196baee9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2287375183, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-06T22:57:55', 'indicator': 'bfa96a2ddb39a5e81e32a275aa6fc134030279ddde6c116d41945142328465ab', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2288253850, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-07T17:54:43', 'indicator': '4a1fc30ffeee48f213e256fa7bff77d8abd8acd81e3b2eb3b9c40bd3e2b04756', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2288253851, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-07T17:54:43', 'indicator': 'b36d78fafde3852812ebc7d59a4dccbd4a77004418af1c060be3917d177787d1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2288253852, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-07-07T17:54:43', 'indicator': 'fd6c1e1fbe93a6c1ae97da3ddc3a381f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2288253853, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-07-07T17:54:43', 'indicator': '427996258f0b5947c182fc908c7c9dd4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2297858098, 'role': None, 'type': 'FileHash-SHA256', 'title': 'is__elf', 'content': '', 'created': '2020-07-24T18:43:35', 'indicator': 'c44b63b1b53cbd9852c71de84ce8ad75f623935f235484547e9d94a7bdf8aa76', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2301626385, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-24T18:43:35', 'indicator': '517168df462fd33d5946f8cc6a09090d1dfdac19b10ac8ef8e15e4583557749d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2301626386, 'role': None, 'type': 'FileHash-MD5', 'title': 'is__elf', 'content': '', 'created': '2020-07-24T18:43:35', 'indicator': 'fa3cf35e7e83175f395a5b6d35fd456d', 'is_active': 1, 'expiration': None, 'description': 'MD5 of c44b63b1b53cbd9852c71de84ce8ad75f623935f235484547e9d94a7bdf8aa76'}, {'id': 2301626387, 'role': None, 'type': 'FileHash-SHA1', 'title': 'is__elf', 'content': '', 'created': '2020-07-24T18:43:35', 'indicator': '84de17dc143f4a2001c7caeda22c783cb8daec45', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of c44b63b1b53cbd9852c71de84ce8ad75f623935f235484547e9d94a7bdf8aa76'}, {'id': 2302108936, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-24T18:43:35', 'indicator': '34e0ad00a23762da270ad5a352d1e523f45a685b4a4931ae02973ecef79140c5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2302108937, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-24T18:43:35', 'indicator': '9994a3ab51521ee54902826d46de3f8c541e625873f10aec2568dd51ddf78f9c', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 28}

27d7ba291a00cea1bde0e7f16ddeef0bfb754e1d0de47d96ff15c59e14fbdb50

2026-06-04 16:17:13.458539+03:00

2026-06-04 16:17:13.458539+03:00

65eb43b73126f426dbb1e92b

2a0d26b8b02bb2d17994d2a9a38d61db

FileHash-MD5

z0Miner Exploits Korean Web Servers to Attack WebLogic Server

AhnLab Security intelligence Center (ASEC) has discovered numerous instances of threat actors attacking vulnerable Korean servers. This post examines a recent case in which the 'z0Miner' threat actor targeted Korean WebLogic servers. The actor has a history of distributing miners against vulnerable servers and is known for exploiting WebLogic server vulnerabilities.

2024-03-08 16:58:30.831000+03:00

2024-04-07 16:03:45.758000+03:00

['z0miner', 'xmrig', 'crypto']

['z0Miner']

['https://asec.ahnlab.com/en/62564/']

{'pulse_id': '65eb43b73126f426dbb1e92b', 'indicators': [{'id': 3577140650, 'role': None, 'type': 'FileHash-MD5', 'title': 'ALF:Trojan:Win32/CoinMiner.D', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': '2a0d26b8b02bb2d17994d2a9a38d61db', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3615313491, 'role': None, 'type': 'FileHash-MD5', 'title': 'Trojan:Linux/CoinMiner.K', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': 'c2fb307aee872df475a7345d641d72da', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3615313492, 'role': None, 'type': 'FileHash-SHA1', 'title': 'Trojan:Linux/CoinMiner.K', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': '430e3d3bb3a4ebf30b9345b8fc7a2a6cf69ba8a8', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of c2fb307aee872df475a7345d641d72da'}, {'id': 3749894607, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': '5fc34a89d873a09b325adee825fbc869a2bc05b3', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 98e167e7c2999cbea30cc9342e944a4c'}, {'id': 3853296919, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': '085c68576c60ca0361b9778268b0b3b9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296920, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': '4cd78b6cc1e3d3dde3e47852056f78ad', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296921, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': '547c02a9b01194a0fcbfef79aaa52e38', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296922, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': '575575f5b6f9c4f7149ed6d86fb16c0f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296923, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': '7b2793902d106ba11d3369dff5799aa5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296924, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': '7e5cc9d086c93fa1af1d3453b3c6946e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296925, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': '83e163afd5993320882452453c214932', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296926, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': '8434de0c058abb27c928a10b3ab79ff8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296927, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': '88d49dad824344b8d6103c96b4f81d19', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296928, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': '903fce58cb4bfc39786c77fe0b5d9486', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296929, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': '90b74cdc4b7763c6b25fdcd27f26377f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296930, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': '98e167e7c2999cbea30cc9342e944a4c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296931, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': 'a0766ad196626f28919c904d2ced6c85', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296932, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': 'ad33f965d406c8f328bd71aff654ec4c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296933, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': 'b6aaced82b7c663a5922ce298831885a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296934, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': 'e60d8a3f2190d78e94c7b952b72916ac', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296935, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': 'efc2a705c858ed08a76d20a8f5a11b1b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296936, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': 'fd0fe2a3d154c412be6932e75a9a5ca1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3853296937, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-03-08T16:58:32', 'indicator': 'c1731fa2a5631a1527c77494eb353340ba57868902215f151147410353bbd0e6', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 98e167e7c2999cbea30cc9342e944a4c'}], 'indicators_count': 23}

15dc726a244600dd6fb76464ee82d6338d2de0d3a37490bd1bbdb3c921f7ccd3

2026-06-04 16:17:11.462594+03:00

2026-06-04 16:17:11.462594+03:00

633dcc2e61726f81d309867b

f34d5f2d4577ed6d9ceec516c1f5a744

FileHash-MD5

CovalentStealer

The US Department of Homeland Security (DHS) is distributing a report on malware associated with the CovalentStealer malware, which can identify and exfiltrate files to a remote server.

2022-10-05 18:25:50.665000+03:00

2022-10-05 18:27:42.497000+03:00

['covalentstealer', 'ifileworker', 'powershell', 'trojan', 'information stealer', 'obfuscated', '.NET executable', 'exfiltration', 'apt', 'credential harvesting']

['CovalentStealer', 'Tedy']

['https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a']

{'pulse_id': '633dcc2e61726f81d309867b', 'indicators': [{'id': 80, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'f34d5f2d4577ed6d9ceec516c1f5a744', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149739, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '0551c676439e5d812cb2bab3f2060c1b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149740, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '14b8e37952e1f532be9db40f654e6ac7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149741, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '204dc02c928d7206969d5e40f4ed4de4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149742, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '20b7eb0af9b9e7403a298f7966d5a1d4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149743, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '27a0ba098b8403570c7b1e0863c2d6c5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149744, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '30ea2a37c7174ed8c3ab88aecee0002b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149745, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '3994632889cebeff28c360da22c696f3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149746, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '444ccf674588f47ab5638fb08db98b01', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149747, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '489bbfac9377f3ef9a60f9d64d9ccda8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149748, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '5488f249cf62feed84546911d54f96f2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149749, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '5753ddd324c2054718252c834d93aac9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149750, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '63cf36ac25788e13b41b1eb6bfc0c6b6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149751, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '8a2ac318e59571d7c72221d67498bd5f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149752, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '9b75c9220e4242a6403f02bb9da3d198', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149753, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'a1eef53765269a304aaa217af7ede436', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149755, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'a69c4d0928332121839c97d955246112', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149756, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'adfac9c5ef66c21b85fde6503c025b58', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149757, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'b1a7c2ae593e814cfecdcff709b02615', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149758, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'baa634fdd2b34956524b5519ee97b8a8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149760, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'bd95f0df1272e5b2854b304c71930168', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149761, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'bdd5c1c64355001493f1f48cc64646a3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149762, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'be70af56c305ef153e32ecc2430d4d8a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149763, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'bec2cac9d419ae07e526a03c4a94cb64', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149764, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'c435d133b45783cce91a5d4e4fbe3f52', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149765, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'c574847bfb2e8be8830c3d846238d2d6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149766, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'd287a50bd0b95d1f153dc071d43e45d3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149767, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'd3951137283e84d42f85bb91f0ccfcdd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149768, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'd5a7b90177cdf81c2e1de40dc834d764', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149769, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'f54ae2b0d51bb4cdc2a142733f122311', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149770, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'f80d2b416a07808182a35c49f6967d8f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149771, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'fbf8fada938118d358a40e73eb0c8bb9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149772, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '01d6b5df5761904b7c8c6c4e34490675d4fa0f36', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149773, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '184adab2435e4b0f9b02521fed5e56390b5e775f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149774, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '22ab6af92ddd984bd054c21799742a5e498e8453', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149775, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '22cb98b9548ffd1010b2799a791ef42b8943f3c9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149776, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '2d28c56daf370370d1c4d95fd25e4f0a04ceda07', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149777, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '3a6f2826aab7948d8b930f6bf13897160c198807', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149778, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '450982b1420a97dcedb15fb058e00e108d240bb7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149779, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '4fcf2c22d2ea70430580b487a7834c165deee5d0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149780, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '9ddfa0669358bc19a166a41fd93cec5a3c88205d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149781, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'a2e852b0d911ced7011a7b954fc379c0d0564fc5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149782, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'ababa956175b2ddae7ec92162a8464b40b79064a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149783, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'b2018e61e8b435b6a172b35774377ebc16fd0168', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149784, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'cdc7e3b6905f69d8330c4b0f71494a7db7ac61e7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149785, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'cf1d9da39f4847ee735d46157232585068387763', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149786, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'd5dee0a05101cf9ed3c3ca76cf01f518c3ef922c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149787, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': 'd7950ad0cc1798f2184be502fcb12bc0a6f27864', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149788, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '09605981a072c604e6ef9ad2dd7d2a78b48b07ee3339589bfcf0a466a9190904', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3377149789, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T18:25:50', 'indicator': '0b01f392fa030be1ddd549fb79cf280d2a2c745578a56fedd4cb5e9438ae72cb', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 80}

bd3bbcb6f368d4fdc01d6ce268ac101921648c8573c741d91461cc6131fa8803

2026-06-04 16:17:12.408553+03:00

2026-06-04 16:17:12.408553+03:00

64f1e91a2dd9db4bd3af8ce4

gstatic-node.io

domain

Fake Update Utilizes New IDAT Loader To Execute StealC and Lumma Infostealers

Fake browser updates lure users into executing malicious binaries which include a new IDAT loader which is utilized in order to execute infostealers on compromised systems including StealC and Lumma.

2023-09-01 13:37:29.869000+03:00

2023-10-01 13:02:18.554000+03:00

['msi downloader', 'idat loader', 'idat injector', 'defense evasion', 'msi package', 'amadey', 'lumma', 'fake update']

['Amadey', 'Lumma', 'Fake Update', 'SectopRAT', 'Stealc', 'SocGholish']

['https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/']

{'pulse_id': '64f1e91a2dd9db4bd3af8ce4', 'indicators': [{'id': 3710884382, 'role': 'command_and_control', 'type': 'domain', 'title': 'Win32/Lumma', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'gstatic-node.io', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3743906553, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'lazagrc3cnk.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775154, 'role': None, 'type': 'FileHash-MD5', 'title': 'stack_string', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': '1bcf03b31489b63436d4216249bbf246', 'is_active': 1, 'expiration': None, 'description': 'MD5 of b287c0bc239b434b90eef01bcbd00ff48192b7cbeb540e568b8cdcdc26f90959'}, {'id': 3747775155, 'role': None, 'type': 'FileHash-MD5', 'title': 'Zeppelin_10', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'e07aa33f0e6aec02240a232e71b7e741', 'is_active': 1, 'expiration': None, 'description': 'MD5 of c9094685ae4851fd5a5b886b73c7b07efd9b47ea0bdae3f823d035cf1b3b9e48'}, {'id': 3747775156, 'role': None, 'type': 'FileHash-MD5', 'title': 'Zeppelin_10', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'e24bdc9074518cf8e0afd9f017855eee', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 3bf4b365d61c1e9807d20e71375627450b8fea1635cb6ddb85f2956e8f6b3ec3'}, {'id': 3747775157, 'role': None, 'type': 'FileHash-SHA1', 'title': 'Zeppelin_10', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': '2106fc1e0f83df0f658934129a5a374948cc97a0', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of c9094685ae4851fd5a5b886b73c7b07efd9b47ea0bdae3f823d035cf1b3b9e48'}, {'id': 3747775158, 'role': None, 'type': 'FileHash-SHA1', 'title': 'Zeppelin_10', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'afdf930278ae74d600d31463ba31ec2543ceb121', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 3bf4b365d61c1e9807d20e71375627450b8fea1635cb6ddb85f2956e8f6b3ec3'}, {'id': 3747775159, 'role': None, 'type': 'FileHash-SHA1', 'title': 'stack_string', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'e330e5b7f62ca55cb6e6c97406e0b56878806960', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of b287c0bc239b434b90eef01bcbd00ff48192b7cbeb540e568b8cdcdc26f90959'}, {'id': 3747775160, 'role': None, 'type': 'FileHash-SHA256', 'title': 'Zeppelin_10', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': '3bf4b365d61c1e9807d20e71375627450b8fea1635cb6ddb85f2956e8f6b3ec3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775161, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': '51cee2de0ebe01e75afdeffe29d48cb4d413d471766420c8b8f9ab08c59977d7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775162, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': '53c3982f452e570db6599e004d196a8a3b8399c9d484f78cdb481c2703138d47', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775163, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': '5f57537d18adcc1142294d7c469f565f359d5ff148e93a15ccbceb5ca3390dbd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775164, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': '8ce0901a5cf2d3014aaa89d5b5b68666da0d42d2294a2f2b7e3a275025b35b79', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775165, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': '931d78c733c6287cec991659ed16513862bfc6f5e42b74a8a82e4fa6c8a3fe06', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775166, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'a0319e612de3b7e6fbb4b71aa7398266791e50da0ae373c5870c3dcaa51abccf', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775167, 'role': None, 'type': 'FileHash-SHA256', 'title': 'stack_string', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'b287c0bc239b434b90eef01bcbd00ff48192b7cbeb540e568b8cdcdc26f90959', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775168, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'b3d8bc93a96c992099d768beb42202b48a7fe4c9a1e3b391efbeeb1549ef5039', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775169, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'be8eb5359185baa8e456a554a091ec54c8828bb2499fe332e9ecd65639c9a75b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775170, 'role': None, 'type': 'FileHash-SHA256', 'title': 'Zeppelin_10', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'c9094685ae4851fd5a5b886b73c7b07efd9b47ea0bdae3f823d035cf1b3b9e48', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775171, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'd19c166d0846ddaf1a6d5dbd62c93acb91956627e47e4e3cbd79f3dfb3e0f002', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775173, 'role': None, 'type': 'URL', 'title': 'Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 14:06:51 2020, Security: 0, Code page: 1252, Revision Number: {94224AA3-26E6-468B-88D7-094689CA5B5B}, Number of Words: 10, Subject: Installation Assistant S54FCF1E7-E6A4-478B-u7tmn7rcpfvzbyy, Author: p9mc6m, Last Saved By: p9mc6m, Name of Creating Application: Installation Assistant S54FCF1E7-E6A4-478B-u7tmn7rcpfvzbyy, Template: ;1', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'https://ocmtancmi2c5t.xyz/82z2fn2afo/b3/update.msi', 'is_active': 1, 'expiration': None, 'description': '4fc609aab3c404ae776ebdd60f1dbf1d0f0b3aa7aeace20b61b8c64335fd06c9'}, {'id': 3747775174, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'https://zeltser.com/media/docs/malware-analysis-lab.pdf', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775175, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'bgobgogimrihehmxerreg.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775176, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'buyerbrand.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775177, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'costexcise.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775178, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'doorblu.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775179, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'gapi-node.io', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775180, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'ocmtancmi2c5t.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775181, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'omdowqind.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775182, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'ooinonqnbdqnjdnqwqkdn.space', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775183, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'weomfewnfnu.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3747775184, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2023-09-01T13:37:31', 'indicator': 'winextrabonus.life', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 32}

68eca0f2cb7f63be95e39af17b3ed5be853c7dc860faf5767198fa86d57dcb27

2026-06-04 16:17:12.090041+03:00

2026-06-04 16:17:12.090041+03:00

68494baf27507539fd31918c

healthherofit.com

domain

Stealth Falcon and Horus: A Saga of Middle Eastern Cyber Espionage

Check Point Research (CPR) uncovered an active-weaponized Microsoft WebDAV zero‑day (CVE‑2025‑33053) exploited by the Stealth Falcon APT in a targeted campaign against defense and government organizations across the Middle East and Africa. The attack began with a spear-phishing-disguised .url file that hijacks the working-directory-based execution of legitimate Windows tools (LOLBins) to load malicious executables from a WebDAV server.

2025-06-11 09:26:07.082000+03:00

2025-06-11 09:59:11.785000+03:00

['apt', 'cyberespionage', 'cve-2025-33053', 'zeroday', 'webdav', 'keylogger', 'mythic']

['Mythic - S0699']

['https://research.checkpoint.com/2025/stealth-falcon-zero-day/']

{'pulse_id': '68494baf27507539fd31918c', 'indicators': [{'id': 2936141306, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'healthherofit.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3476524965, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '3b83250383c2a892e0ca86e54fcc6aca9960fc4b425ab9853611ff3e5aa2f9c6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3758943170, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'joinushealth.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3780833073, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '00c05d72920d62077b7c670919214339', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 092c344330bd5cba71377dead11946f7277f2dd4af57f5b636b70b343bc7ebe0'}, {'id': 3780833114, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'f141c2a4b670b7f17adac33e2bada5682f7bc391', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 092c344330bd5cba71377dead11946f7277f2dd4af57f5b636b70b343bc7ebe0'}, {'id': 3780833116, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '0598e1af6466b0813030d44fa64616eea7f83957d70f2f48376202c3179bd6b1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3780833118, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '092c344330bd5cba71377dead11946f7277f2dd4af57f5b636b70b343bc7ebe0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3780833124, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '5671b3a89c0e88a9bfb0bd5bc434fa5245578becfdeb284f4796f65eecbd6f15', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3780833127, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '8065c85e387654cb79a12405ff0f99fd4ddd5a5d3b9876986b82822bd10c716f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3783903379, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'cyclingonlineshop.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3783903385, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'radiotimesignal.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3783903391, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'worryfreetransport.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255470, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '1d95a44f341435da50878eea1ec0a1aab6ae0ee91644c497378266290a6ef1d8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255471, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '257c63a9e21b829bb4b9f8b0e352379444b0e573176530107a3e6c279d1919da', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255472, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '3259ecfb96d3d7e2d1a782b01073e02b3488a3922fd2fd35c20eeb5f44b292ec', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255473, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '32f2773ceb6503f8a1c3e456d34ceda5c188974a115e5225a1315e7ec3f8eb5e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255474, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '46c95af6fea41b55fa0ab919ec81d38a584e32a519f85812fe79a5379457f111', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255475, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '4e045c83cf429210e71e324adccad8818540b9805a44c8d79a8c16c3d5f6fbb6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255476, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '50a2b6c1b0a0d308e8016aece9629c1bf6ca4ecc6f4cef34c904e9c3e82355fb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255477, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '62797e28a334e392cb56fcc26dd07f04ac031110f0e9ed8489ec0825beea75eb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255478, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '66a893728a0ac1a7fae39ee134ad4182d674e719219fbf5d9b7cd4fd4f07f535', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255479, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '700b422556f070325b327325e31ddf597f98cc319f29ef8638c7b0508c632cee', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255480, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '8291b886cce1f0474db5b3dc269adf31d1659b7d949f62ea23608409d14b9ceb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255481, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '9a82e21c2463d6c23a48409a862e668ed9c205468d216d2280f7debe1ab1ddd8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255482, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '9ed8f51548a004ac61b7176df12a0064dc3096088cbf3c644a9abdb5c92936f7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255483, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'aa612f53e03539cdc8f8a94deee7bf31f0ac10734bb9301f4506b9113c691c97', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255484, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'ba5beb189d6e1811605b0a4986b232108d6193dcf09e5b2a603ea4448e6f263c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255485, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'c5b00e8312e801dc35652c631a14270ed4eec8f6d90d08cdde3c6e7fd1ec24b6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255486, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'cd6335101e0187c33a78a316885a2cbf4cbbd2a72daf64a086edb4a2615749fb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255487, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'da3bb6e38b3f4d83e69d31783f00c10ce062abd008e81e983a9bd4317a9482aa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255488, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'db7364296cc8f78981797ffb2af7063bba97e2f6631c29215d59f4979f8b4fce', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255489, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'dc7cb53c5dc2e756822328a7144c29318cb871890727eff9c8da64a01e8e782d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255490, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'ddce79afe9f67b78e83f6e530c3e03265533eb3f4530e7c89fdc357f7093a80b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255491, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'dec6dda0559e381c23f1dfbe92fa4705c8455430f8278c78c170a7533b703296', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255492, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'e0a44274d5eb01a0379894bb59b166c1482a23fede1f0ee05e8bf4f7e4e2fcc6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255493, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'f270202cd88b045630f6d2dec6d5823aa08aa66949b9ccd20f6e924c7992fea7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255496, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'downloadessays.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255497, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'fastfilebackup.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255498, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'luxuryfitnesslabs.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255499, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'purvoyage.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255500, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'roundedbullets.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075255501, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': 'summerartcamp.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4075467645, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '2e386983ab9fe53095b66d1d14715ff6', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 66a893728a0ac1a7fae39ee134ad4182d674e719219fbf5d9b7cd4fd4f07f535'}, {'id': 4075467646, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '33922ecb35a51a1f1999c4fef4c10187', 'is_active': 1, 'expiration': None, 'description': 'MD5 of ba5beb189d6e1811605b0a4986b232108d6193dcf09e5b2a603ea4448e6f263c'}, {'id': 4075467647, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '7cae6334841a2750b8a4e801ee106a94', 'is_active': 1, 'expiration': None, 'description': 'MD5 of e0a44274d5eb01a0379894bb59b166c1482a23fede1f0ee05e8bf4f7e4e2fcc6'}, {'id': 4075467648, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '901cc70d54f9e247b9909debc0352f30', 'is_active': 1, 'expiration': None, 'description': 'MD5 of cd6335101e0187c33a78a316885a2cbf4cbbd2a72daf64a086edb4a2615749fb'}, {'id': 4075467649, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '97678cf4b8456e8aeaec1ed9bcfdd9eb', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 700b422556f070325b327325e31ddf597f98cc319f29ef8638c7b0508c632cee'}, {'id': 4075467650, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '4d8cf62110f705da782742359e42a4d7501039d2', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of e0a44274d5eb01a0379894bb59b166c1482a23fede1f0ee05e8bf4f7e4e2fcc6'}, {'id': 4075467651, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '4f0365798d32b282ba4031b3809cf088152ab3e1', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of ba5beb189d6e1811605b0a4986b232108d6193dcf09e5b2a603ea4448e6f263c'}, {'id': 4075467652, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-06-11T09:26:07', 'indicator': '551cf70bf1ce0ac6cd90eb8506f6da9367995f25', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 66a893728a0ac1a7fae39ee134ad4182d674e719219fbf5d9b7cd4fd4f07f535'}], 'indicators_count': 52}

9946de97fade02f6c1efbc149e96f993713539be1a76de27e694a88e4b05ff1b

2026-06-04 16:17:10.566101+03:00

2026-06-04 16:17:10.566101+03:00

633d8676c25a255fb0e9b19a

CVE-2021-26855

CVE

China Chopper Webshells

This Malware Analysis Report (MAR) is the result of analytic efforts by the Cybersecurity and Infrastructure Security Agency (CISA) to provide detailed analysis of files associated with "China Chopper" webshells

2022-10-05 13:28:22.196000+03:00

2022-10-05 13:28:22.196000+03:00

['China Chopper', 'Exploit', 'Webshell', 'Javascript', 'Trojan', 'Microsoft Exchange', 'RCE']

['China Chopper']

['https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277c']

{'pulse_id': '633d8676c25a255fb0e9b19a', 'indicators': [{'id': 2881717446, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'CVE-2021-26855', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2881717447, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'CVE-2021-27065', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2899240867, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'ab3963337cf24dc2ade6406f11901e1f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2899240870, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787504, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '0f8d4a9a0f41f1b347daa3ee3da48f54', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787505, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '172e2090dcd8571d3d98e219a2e6b226', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787506, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '1c0e6e63818a2955cb368f7ae9a934da', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787507, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '264b80ff5d873d630168f21892f27724', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787508, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '58b07454a038cd6bb1ca3d6ff4fa38ce', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787509, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '5cbd52c0a7517ddcd8a0e764131bd791', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787510, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '62281d112d8a17b49c2dc87bf2167b9f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787511, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '674ad3430e17de5279ceae899ee2d951', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787512, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '981d83dc485048c3c8e4d74fb4a3eab6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787513, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '9a597c67ad6cd1a448f58a2c8e5c4ca6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787514, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'b5be2d3f0ebbb9a0925236f171c5b5e0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787515, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'bd01f935103002ccf3a21c9815697c24', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787516, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'd07539a27792c1a1d37dc0b7c5fa0f40', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787517, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'd67c8e0b4489979922c5acfff7211186', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787518, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'e591908bd81d43464696dde547d45003', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787519, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '1351bca8b60f74894d13553703597d861acd04ea', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787520, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '1c2526572d10d3577802c15125d9c3a701c48919', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787521, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '3179101b5d8484a3cb316fb22e4e6aaa60eda94d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787522, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '36531b3b859b7d875260a67e7ce5b59e48d46404', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787523, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '5537d6f6d321a623ebd7c785df4ada06cbe688c6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787524, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '7517f601fc648bb731961d492b638f4d39e698fa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787525, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '7603dc2f7d940f8d27b6c36dcd8d66d5cca515ad', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787526, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '82809edc726101e5baea2ae70bcd9cf2e20bdffa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787527, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'a3bcf1bb8ed3073a0c9e6c5a87ad0aeab4001240', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787528, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'ae0d3ca3f7bec5703f1bc554f9b57bcdda8022ba', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787529, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'bed00a85dbb0cbf3766cb7b05d355db158190a40', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787530, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'c6ff7631c088c60a461d70b47dd85aea9fc51019', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787531, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'dc10dd5a896e0e343b8a8bf117beca4327b3c4ab', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787532, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'e731bc758f81f8c6021d59a9ceda37e015d9587b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787533, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'f44cecce75f74b62a6596872b8dd86dbca2a59a8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787534, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '07208095feb011ed915a881b689d6b70c352d40e90131df2c2abc92c4b93fbd9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787535, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '1435e7871e32779a81e28aa9b6fa57949439220527ed3b3fb83a1c0699f376e3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787536, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '1e05b263cfea600f727614e58646a2ff6a4c89a4499e2410f23bf40c718a94d3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787537, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '1f5f5b8dd702da3628e8612d44563d8267fa160048a0da389ee821152ac658f2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787538, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '3918f060a7df3ef3488f4158b56cd720e1e4872f1c5a075df5870164260af650', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787539, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '411fef05a37e286a4e48700e5155cd55672cce4c9283b448d968391267b4f866', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787540, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '53c7c1bf8526bb7a6d0af1fd7c7673a8138db90bb81b786f3987b9d854697f6c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787541, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': '58a6151413f281143a9390852b017b82ff40d402cdbc8295aa58ae46c4c8424f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787542, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'a58c4fdb1c31100f4e9bb530af7d1ac57c715fee1c7c5e6c790e1e9cc863cfe4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787543, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'a8c656d12b10d4fae74efc4cc7e585f5569f1a9144ebf6cd56b1bfed0dd7a440', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787544, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'b8a06eae7d57a292dfea9000f76c6e3733b3567ef67d75b149dfd1d001ca9fb8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787545, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'dc21ee9606505222dbfe26d6bfc2a4dbebecf620d72fc39d298a5de519c3535f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787546, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'dfa9f4a054636750012e0ff56286a3c96c37062959c8ac5b2df52e349de69e65', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787547, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'e2caf75367ca300f616a96ff07769b1f80b69b1ae135fa27b79376a75a905b5e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3565787548, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-10-05T13:28:23', 'indicator': 'e5451de048d7b9d6d8e699da7a10c38079eda4e6328580a8ba259a22eeaaa71d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3566230914, 'role': None, 'type': 'YARA', 'title': '', 'content': 'rule CISA_10328929_02 : trojan webshell exploit HAFNIUM CVE_2021_27065 \n \n \t\t\t\t{ \n \n \t\t\t\tmeta: \n \n \t\t\t\t Author = "CISA Code & Media Analysis" \n \n \t\t\t\t Incident = "10328929" \n \n \t\t\t\t Date = "2021-03-17" \n \n \t\t\t\t Last_Modified = "20210317_2200" \n \n \t\t\t\t Actor = "n/a" \n \n \t\t\t\t Category = "Trojan WebShell Exploit" \n \n \t\t\t\t Family = "HAFNIUM CVE-2021-27065" \n \n \t\t\t\t Description = "Detects HAFNIUM webshell samples" \n \n \t\t\t\t MD5_1 = "ab3963337cf24dc2ade6406f11901e1f" \n \n \t\t\t\t SHA256_1 = "c8a7b5ffcf23c7a334bb093dda19635ec06ca81f6196325bb2d811716c90f3c5" \n \n \t\t\t\tstrings: \n \n \t\t\t\t $s0 = { 4F 66 66 6C 69 6E 65 41 64 64 72 65 73 73 42 6F 6F 6B 73 } \n \n \t\t\t\t $s1 = { 3A 20 68 74 74 70 3A 2F 2F [1] 2F } \n \n \t\t\t\t $s2 = { 45 78 74 65 72 6E 61 6C 55 72 6C 20 20 20 20 } \n \n \t\t\t\tcondition: \n \n \t\t\t\t $s0 and $s1 and $s2 \n \n \t\t\t\t}', 'created': '2022-10-05T13:28:23', 'indicator': 'c03e1fed06fb47617ab86491bfa455372def0d4a', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 51}

4fb13c52935553cba71705cba51a1feb3b390ab54a4365aaaca46407fe50e6bd

2026-06-04 16:17:12.408553+03:00

2026-06-04 16:17:12.408553+03:00

64b94d3cdec433c85b83c9a5

0ba224ecc2546d0a5ccc13bc8f929ec0035ca884fce44c8aebcfec185550169c

FileHash-SHA256

BYOS - Bundle Your Own Stealer

Check Point Research (CPR) provides an in-depth analysis of the new malware strain dubbed BundleBot spreading under the radar. BundleBot is abusing the dotnet bundle (single-file), a self-contained format that results in very low or no static detection at all. Commonly distributed via Facebook Ads and compromised accounts leading to websites masquerading as regular program utilities, AI tools, and games.

2023-07-20 15:05:32.334000+03:00

2023-08-19 15:00:18.436000+03:00

['bundlebot', 'infostealer']

['BundleBot']

['https://research.checkpoint.com/2023/byos-bundle-your-own-stealer/']

{'pulse_id': '64b94d3cdec433c85b83c9a5', 'indicators': [{'id': 3720119669, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '0ba224ecc2546d0a5ccc13bc8f929ec0035ca884fce44c8aebcfec185550169c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119670, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '0c5ef531c2d5be15ef2a031c381a9531db22e030b14a1c2de311c68da23fef48', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119671, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '0e2bb46c9cb2baa0263824f4a6725a2e4db2541eafd392f25bd9a4921a2e04f3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119672, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '1c27a31830946ca806be10d07dc67b185d3f1e2bbc76cd5365719055966600fb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119673, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '2038aa28b4e23806030f945aadcf5dbbfa2e3f7ae2b924bd987fda62f87773fc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119674, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '20b833c028322139b81e220cc165513ec2d4a490cfbd84e88e985a84d3173025', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119675, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '22bb60b0ea0d5bb57e105287843867880f336ddafa1545332e2de16d412cde12', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119676, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '230e5844ac0c767baf4d5d660f9ebcd0a9dd7f5a5ec5869387f53fa3eb902aa3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119677, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '25c0f65acb3ecfe435a39bed3f5013eadd85eca1e78a0dc754cb4b82389ee4bb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119678, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '26d0853adcec8b273346924e97170226abd7b800b5ee51f6768c58ac45f59d20', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119679, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '2e0492507ed4127b25e523444b205c58312902fa0bf2f5697c184049af5e4e18', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119680, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '303c6d0cea77ae6343dda76ceabaefdd03cc80bd6e041d2b931e7f6d59ca3ef6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119681, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '3198a613574a8ab84637bf80ebe5f6a56c851aa292973515c5de856f1e958d6d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119682, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '37a06e2e28d16096c45bfd3ef2679fe8dc722810b6f6119b7dc5f1483e66ec01', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119683, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '386189e521d431428157cf37b4653444f8c2116ee0a5229313012c43e5839edd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119684, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '41c884718ce264195d75695252b22021680c6d5470a303f999f3f333a5eef9c9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119685, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '4856cdb407d67ee82d44e1cd606e382cde7b6bcaf9127dd7924e2d604c1cad38', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119686, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '4b4f69b01edd2c96db6374a9d0d980f5023383d440914831301f19d1d29ae4d9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119687, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '4c39df6e78b110e4912f3cb543130297b9b3cc3d33daa2d613999a1b991ba763', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119688, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '50b7447d83715b8b7b36a15d0e7c7b8ae881a56dc0f39eb1aa22604e00f97d17', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119689, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '5ac212ca8a5516e376e0af83788e2197690ba73c6b6bda3b646a22f0af94bf59', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119690, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '5beb1ce875166ec47ee7fbcd9e48c891fe0b27ccec04edf3da82bf8b3b2ea04b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119691, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '601f888abbb545b003ed37e3835237de7915874893f22ee5bb6ebc9f5db618b5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119692, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '6552a05a4ea87494e80d0654f872f980cf19e46b4a99d5084f9ec3938a20db91', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119693, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '6632c655875279ed1c19937805416a716d9994db71c8e30d2c8b4a3a3c3f9620', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119694, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '67f24b507fe2f6dc06a294b85486cfa1dba6af188e59c51a74adc3b3f9ed29d8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119695, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '6834be1cbde6718d153a729f2e68e3f3b21bcbcb51a9f381e98f78b7a414969f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119696, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '7a0cd3cc214b312cda20a54f7e0e93509fbcf5f6e6d9f41fd95d6dfa3bb5bcdc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119697, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '84319f401994ca83d2659aef8fa5810224f4a0fef2d3ed6883a5a265d3a8c291', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119698, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '8d1aa8ca616afc7fdf3cd6552e94fb486196d67e062adf5c97ada05b7b176985', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119699, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '90b37f26d7574a23437a2f0ad75d3cce5ecf3928efb58beacedde289fd3568bf', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119700, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '953e1b59b2163ddafaafe7872033ae6351a46500b575a717c853b6393d2c7ef6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119701, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '97f777abfeada170c1caa625ffbf12b8d097ae5331f3f4c5b57dad4fc0c4f8c1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119702, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '9b0a6fdc188de6d80117f9f0894c456e9f541f19ba5b4ed8cfd03e86d8fb8af9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119703, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '9b4c6dcee2848e2c23cffe1b8925ebc37d4d98a441fe6b0ff82dc788595a68be', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119704, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '9e6175a02a129fe559f108f6dced7fb6bf66c468cfb3ca276f3621ab8c312e91', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119705, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': 'a1389d02c0b7892ffeae60b7869f3a761c2326629bd1c304839a1e8b7400744e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119706, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': 'a47d68411f64887300800cbe471f3cb24047e2e352bff74b810ad1940cfff85c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119707, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': 'a99dbc0cb0a051ec68bd89c468fd589b201380f47330bdedbb69f9b076099711', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119708, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': 'af92d0545ce01e5dcbe228a43babe6281a1631836e5631286908c7f0aa225f3d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119709, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': 'b47ac379cc23a059e1aaaba351f528c5a955fd56da35928c0bc0043c4ab8b38a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119710, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': 'bc1fceb2d6c5dc7bedfdf1790ac0f06ccf0a9777c79d831d037dff10ae4ace8f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119711, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': 'bfa7b12cc68b9cd26022a4c611ceaa473c84ffe36bb8008c67c1692b968b88d8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119712, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': 'cd1c00427973b7ff7bac1803d35c071ff0fdeb975c4eb5a54829bedf12c4d136', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119713, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': 'd0146a3bbed91d5680c9b44c0f0e69deabe4d6c0f114e50d9fdee9cd202242fc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119714, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': 'dfa9f39ab29405475e3d110d9ac0cc21885760d07716595104db5e9e055c92a6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720119715, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': 'fca477e3e0fe31dfc14a4bade9828da267b6f234c343f9fb654e6921ba71bd08', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720291662, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '03fb8b7e2c7b1baed7bb5cc04dc550d6d1496410', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3720291663, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2023-07-20T15:05:33', 'indicator': '9fa4ab23034950841ad33af76603efdcebf43541', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 49}

f89246fee6ded59c7f39ccd8b91fb4fcc87f36e2a510ae65cf1901731768b919

2026-06-04 16:17:12.090041+03:00

2026-06-04 16:17:12.090041+03:00

68219dbcc29dafb76bee4224

CVE-2025-31324

CVE

Threat Brief: CVE-2025-31324

CVE-2025-31324 is a critical vulnerability residing in the SAP NetWeaver Application Server Java's Visual Composer component (VCFRAMEWORK). While not installed by default, business analysts commonly use this component to create applications without coding, making it widely present in SAP deployments. following the public disclosure of this vulnerability, PaloAlto saw a variety of attacks exploiting this vulnerability and attempting to send different payloads to the server.

2025-05-12 07:05:31.676000+03:00

2025-06-11 06:04:36.233000+03:00

['sha256 hash', 'ipv4 address', 'sap netweaver', 'attempted get', 'suspected web', 'hosting', 'cve202531324', 'goreverse', 'visual composer', 'http', 'alliance', 'april', 'test']

[]

['https://unit42.paloaltonetworks.com/threat-brief-sap-netweaver-cve-2025-31324/']

{'pulse_id': '68219dbcc29dafb76bee4224', 'indicators': [{'id': 4063805247, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'CVE-2025-31324', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4064404038, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'http://47.97.42.177:3232', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067031719, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'f8a7ce4a8e2637565b18d6bb29b2bc6f', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 888e953538ff668104f838120bc4d801c41adb07027db16281402a62f6ec29ef'}, {'id': 4067031720, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'bfee2fb825a0a813a1243ae59bb0f4c9f3545008', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 888e953538ff668104f838120bc4d801c41adb07027db16281402a62f6ec29ef'}, {'id': 4067031721, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': '888e953538ff668104f838120bc4d801c41adb07027db16281402a62f6ec29ef', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489369, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': '1abf922a8228fd439a72cfddf1ed08ea09b59eaa4ae5eeba1d322d5f3e3c97e8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489370, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': '2e6f348f8296f4e062c397d2f3708ca6fdeab2c71edfd130b2ca4c935e53c0d3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489371, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': '3f5fd4b23126cb21d1007b479954af619a16b0963a51f45cc32a8611e8e845b5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489372, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': '427877aadd89f427e1815007998d9bb88309c548951a92a6e4064df001e327c2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489373, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': '4b17beee8c2d94cf8e40efc100651d70d046f5c14a027cf97d845dc839e423f9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489374, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': '598b38f44564565e0e76aa604f915ad88a20a8d5b5827151e681c8866b7ea8b0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489375, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': '5a8ddc779dcf124fe5692d15be44346fb6d742322acb0eb3c6b4e90f581c5f9e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489376, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': '69bb809b3fee09ed3ec9138f7566cc867bd6f1e8949b5e3daff21d451c533d75', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489377, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': '6c6c984727dc53af110ed08ec8b15092facb924c8ad62e86ec76b52a00a41a40', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489378, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': '7aab6ec707988ff3eec37f670b6bb0e0ddd02cc0093ead78eb714abded4d4a79', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489379, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': '9fb57a4c6576a98003de6bf441e4306f72c83f783630286758f5b468abaa105d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489380, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'b3e4c4018f2d18ec93a62f59b5f7341321aff70d08812a4839b762ad3ade74ee', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489381, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'b9ef95ca541d3e05a6285411005f5fee15495251041f78e715234b09d019b92c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489382, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'c7b9ae61046eed01651a72afe7a31de088056f1c1430b368b1acda0b58299e28', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489383, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'df492597eb412c94155a7f437f593aed89cfec2f1f149eb65174c6201be69049', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067489385, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'overseas-recognized-athens-oakland.trycloudflare.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067690276, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': '5919f2eab8a826d7ba84e6c413626f5d11ed412d7df0d3ab864f31d3a8db3763', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067690283, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'http://101.32.26.154/rymhNszS/ansgdhs.bat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067690284, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'http://108.171.195.163:8000/$FILE_NAME$.txt', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067690285, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'http://138.68.61.82/4544', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067690286, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'http://158.247.224.100:38205/EACA38DB.tmp', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067690287, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'http://31.192.107.157:38205/ReportQueue.exe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067690288, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'http://65.49.235.210/download/2.jpg', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4067690289, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2025-05-12T07:05:36', 'indicator': 'https://overseas-recognized-athens-oakland.trycloudflare.com/v2.js', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 29}

642d9114365a95c4d8eadebfa7f98d7908e7c57f1191386e40d36816acdb5057

2026-06-04 16:17:10.566101+03:00

2026-06-04 16:17:10.566101+03:00

666aeadf93cf3c7172c22f46

00287b8dfdc58c4b413a29042e32d86b

FileHash-MD5

Botnet Installing NiceRAT Malware

This analysis discusses the proliferation of botnets constructed through the distribution of malware disguised as legitimate software. These botnets are subsequently leveraged to install additional malware strains, including NiceRAT, a Python-based Remote Access Tool (RAT) capable of collecting system information, browser data, and cryptocurrency wallet details for exfiltration. The report highlights the persistent nature of these botnets, which have been operational since 2019, underscoring the importance of user vigilance when downloading software from untrusted sources.

2024-06-13 12:49:35.961000+03:00

2024-06-13 13:03:38.164000+03:00

['nicerat']

['NiceRAT']

['https://asec.ahnlab.com/en/66790/']

{'pulse_id': '666aeadf93cf3c7172c22f46', 'indicators': [{'id': 3899570933, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '00287b8dfdc58c4b413a29042e32d86b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570934, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '061ea0f42ce0a6840c692f6ee36578af', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570935, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '06e5bcc514f78794ba83779ea4c30841', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570936, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '0ff5ecbe655b0b5781700195d2e8475e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570937, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '16014adaf287779265e33c698287046a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570938, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '1c51a104abd02ad2b0b850ab37d44bde', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570939, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '20e2e1c6900aacb6ba529d148545c283', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570940, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '2800ebfde7f0a94f00494fc72a3f8149', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570941, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '28f08aa165f19b2efb9254f223512dee', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570942, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '4b44c4b3ab34a7946987fe7a601de5d6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570943, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '58678eb1df7e8bf574e67573a2beddaa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570944, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '5b72efdb6a374d4c35ab8ac88e519c9c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570945, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '691f894f028994a2553b2438ea011c34', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570946, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '6fcdf8ef4c409addf1ebf785440f32ee', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570947, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '76e232928e26a1929efe0302cce1cc88', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570948, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '7b4fe1a72a25163098827e9def8f497e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570949, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '8cf502f9a053a7f65dc83651c21ea9de', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570950, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '99df897a57e5d7dc8ecd11b73ee24726', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570951, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'a62bfe438f822cf369e434528325ed74', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570952, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'ba34c7a913b0fa18e434d6a96d612a2c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570953, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'c5e49e44495d09a523173e9656a496fc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570954, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'cfb73473df35a1fd6c3cd70d09ec8be3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570955, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'd387a15e4e0586d112b36ea75fe4d772', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570956, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'd94d7d20f2c88aaf8f84f6e771878fa7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570957, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'df9ef2b14a8d4e5ddf8ac1e03909e0a4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570958, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'fb5b169d0844dd9b6228599f313cf983', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570959, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'fc1333bdce23896e343f0fe6e9a30db8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118943, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '0381509cdc27013411ef944e4ea0656e65daaedc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118944, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '122980ee42c8a47300b1f52b6dd71f372f78d3b6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118945, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '31d93595e47d4e0bf05d9cc8f0ecb0c3f756668f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118946, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '3549ad22854a529c46c14efefa517503c52dfcf8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118948, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '3cd48d3c34d23c2de33418c5e37a7bb8a4dbd0f1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118949, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '42e9f0c04c055152e87ad11d76b808b5dee9dee1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118950, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '45866c7e70d6cc47e79941a1eee360a38a2d5fb0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118951, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '6f219d980c6e030143686c713daa1e9f4d802cd9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118952, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '72eb5813fd67bb1d358bf80f52c7ee3b83b7db0a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118953, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '74b33b6f04652ab0b852da1816953443285be3a7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118954, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '781181b002976004f6992b1c3b927cb7018adeb5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118955, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '79c281ed42edc273b80cc521874dfb758e7d7bc7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118956, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '7afcf1e31ffd4c8e453268f36df98d72f1b5fa78', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118957, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '815b0d0917bd5756431b49cfbd77b8d1bd86f309', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118958, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': '88287fb8ae38e8b4b3c7dad7ef72200f1ff6c20d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118959, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'b323893d6f30326b59ec219d802e6dc0961ae595', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118960, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'ccda207ce53b99e39e9f08deb6cdf48c93903bfc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118961, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'd354d9b53289c496dc4087564fb0c1180ce19cf0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118962, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'dbbc73a1fd9c56f18567bc19678a50922d04e34f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118963, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'e72f4574a6c69cf0bb8964554ffba9270a5ad2c3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118964, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'e9eee23e67edf1bd20400162765fad9723bb2d0f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118965, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'ead7519e7349641e67339e0a924916848531cf1a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118966, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-13T12:49:36', 'indicator': 'f185b9c1d1591ee0ab44985a93040768afe802c2', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 75}

18488488582f5abbb0eef87f52c301fd79dcf64761542bfe0f9e6c619257888d

2026-06-04 16:17:11.462594+03:00

2026-06-04 16:17:11.462594+03:00

666162acc519496e8fdc8a0b

linktoxic34.com

domain

Warning Against Phishing Emails Prompting Execution of Commands via Paste

This report details a phishing campaign distributing malicious HTML files through emails. The files prompt users to paste and run malicious PowerShell commands that initiate a multi-stage infection process. The campaign ultimately delivers the DarkGate malware, highlighting the importance of exercising caution with files from unknown sources.

2024-06-06 07:18:04.975000+03:00

2024-06-06 07:34:53.388000+03:00

['phishing', 'emails', 'malicious', 'darkgate', 'commands', 'powershell']

['DarkGate']

['https://asec.ahnlab.com/en/66300/']

{'pulse_id': '666162acc519496e8fdc8a0b', 'indicators': [{'id': 3882990116, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'linktoxic34.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3883492605, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'e0173741b91cabfecd703c20241c1108', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3883492611, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'http://dogmupdate.com/rdyjyany', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3883492612, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'http://dogmupdate.com/yoomzhda', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3883492613, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'https://linktoxic34.com/wp-content/themes/twentytwentytwo/dark.hta', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3883492614, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'dogmupdate.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3888634178, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'http://flexiblemaria.com/iinkqrwu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3888634179, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'http://flexiblemaria.com/umkglnks', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3888634181, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'flexiblemaria.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3888773951, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'www.rockcreekdds.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3888795521, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'https://www.rockcreekdds.com/wp-content/1.hta', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3889076896, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'a77becccca5571c00ebc9e516fd96ce8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3889076897, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'f2e4351aa516a1f2e59ade5d9e7aa1d6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3890084729, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'jenniferwelsh.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3890084733, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'https://jenniferwelsh.com/header.png', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3890157796, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'a66cc0139c199b37a32731592fb3ac0b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3890527432, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'mylittlecabbage.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3890527434, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': '0b77babfa83bdb4443bb3c5f918545ae', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3890527436, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': '404bd47f17d482e139e64d0106b8888d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891378684, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'http://mylittlecabbage.net/qhsddxna', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3891378685, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': 'http://mylittlecabbage.net/xcdttafq', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3894137348, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': '30e2442555a4224bf15bbffae5e184ee', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3895973993, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': '4b653886093a209c3d86cb43d507a53f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3895973994, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': '4d52ea9aa7cd3a0e820a9421d936073f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3895973995, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': '7484931957633b796f165061b0c59794', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3901108515, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': '318f00b609039588ce5ace3bf1f8d05f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3901108516, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:18:05', 'indicator': '8b788345fe1a3e9070e2d2982c1f1eb2', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 27}

acab6c3141204b6e462de663767ef4e5ace9f55109b216b8c2503b2f2c5f33aa

2026-06-04 16:17:11.462594+03:00

2026-06-04 16:17:11.462594+03:00

666165328cfbe947ee0a3fa9

gandigod1.ddns.net

hostname

Malware botnet installing NiceRAT

This report discusses a botnet that has been active since 2019, distributing various malware such as NiceRAT, Nitol, and NanoCore. The botnet is spread through disguised cracked programs, shared on domestic file-sharing sites and blogs, posing as genuine software activators or game server tools. Once infected, the malware connects to command-and-control (C&C) servers and installs additional payloads like NiceRAT, which is a Python-based open-source remote access trojan that steals system information, browser data, and cryptocurrency wallets.

2024-06-06 07:28:50.816000+03:00

2024-06-06 07:34:21.899000+03:00

['malware', 'botnet', 'nitol', 'nicerat', 'nanocore']

['NiceRAT', 'NanoCore - S0336', 'Nitol']

['https://asec.ahnlab.com/ko/66040/']

{'pulse_id': '666165328cfbe947ee0a3fa9', 'indicators': [{'id': 1609542316, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'gandigod1.ddns.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3226711551, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'gandigod.ddns.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3524515400, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'http://gandigod.ddns.net:54984', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570933, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '00287b8dfdc58c4b413a29042e32d86b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570934, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '061ea0f42ce0a6840c692f6ee36578af', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570935, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '06e5bcc514f78794ba83779ea4c30841', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570936, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '0ff5ecbe655b0b5781700195d2e8475e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570937, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '16014adaf287779265e33c698287046a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570938, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '1c51a104abd02ad2b0b850ab37d44bde', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570939, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '20e2e1c6900aacb6ba529d148545c283', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570940, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '2800ebfde7f0a94f00494fc72a3f8149', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570941, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '28f08aa165f19b2efb9254f223512dee', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570942, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '4b44c4b3ab34a7946987fe7a601de5d6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570943, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '58678eb1df7e8bf574e67573a2beddaa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570944, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '5b72efdb6a374d4c35ab8ac88e519c9c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570945, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '691f894f028994a2553b2438ea011c34', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570946, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '6fcdf8ef4c409addf1ebf785440f32ee', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570947, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '76e232928e26a1929efe0302cce1cc88', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570948, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '7b4fe1a72a25163098827e9def8f497e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570949, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '8cf502f9a053a7f65dc83651c21ea9de', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570950, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '99df897a57e5d7dc8ecd11b73ee24726', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570951, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'a62bfe438f822cf369e434528325ed74', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570952, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'ba34c7a913b0fa18e434d6a96d612a2c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570953, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'c5e49e44495d09a523173e9656a496fc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570954, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'cfb73473df35a1fd6c3cd70d09ec8be3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570955, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'd387a15e4e0586d112b36ea75fe4d772', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570956, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'd94d7d20f2c88aaf8f84f6e771878fa7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570957, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'df9ef2b14a8d4e5ddf8ac1e03909e0a4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570958, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'fb5b169d0844dd9b6228599f313cf983', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570959, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'fc1333bdce23896e343f0fe6e9a30db8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570960, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'http://gandigod.codns.com:2000', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570961, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'http://gandigod.codns.com:5407', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570962, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'http://gandigod.codns.com:7481', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570963, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'http://gandigod.ddns.net:3255', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570964, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'http://gandigod.ddns.net:5407', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570965, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'http://gandigod.ddns.net:8080', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570966, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'http://gandigod1.ddns.net:2000', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570967, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'http://gandigod1.ddns.net:3255', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3899570968, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'gandigod.codns.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118946, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '3549ad22854a529c46c14efefa517503c52dfcf8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118948, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '3cd48d3c34d23c2de33418c5e37a7bb8a4dbd0f1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118949, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '42e9f0c04c055152e87ad11d76b808b5dee9dee1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118950, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '45866c7e70d6cc47e79941a1eee360a38a2d5fb0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118955, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '79c281ed42edc273b80cc521874dfb758e7d7bc7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118957, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': '815b0d0917bd5756431b49cfbd77b8d1bd86f309', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118960, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'ccda207ce53b99e39e9f08deb6cdf48c93903bfc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118961, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'd354d9b53289c496dc4087564fb0c1180ce19cf0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118963, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'e72f4574a6c69cf0bb8964554ffba9270a5ad2c3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118964, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'e9eee23e67edf1bd20400162765fad9723bb2d0f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3900118966, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-06-06T07:28:51', 'indicator': 'f185b9c1d1591ee0ab44985a93040768afe802c2', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 63}

b024168f80aeffd14017db12c7dd9a692f885544e424c895fe98d019e30ab8b6

2026-06-04 16:17:11.462594+03:00

2026-06-04 16:17:11.462594+03:00

63a481d1b821012188699107

3eff7826b6eea73b0206f11d08073a68

FileHash-MD5

New Ransomware Strains Emerging from Leaked Conti’s Source Code

New ransomware strains are emerging based on the leaked source code of Conti ransomware, Cyble Research and Intelligence Labs (CRIL) has discovered, along with a new strain named Putin Team and BlueSky Meow.

2022-12-22 16:12:00.733000+03:00

2022-12-22 16:12:00.733000+03:00

['bluesky', 'scarecrow', 'meow', 'putin team', 'ransomware']

['Putin Team', 'Meow', 'BlueSky', 'ScareCrow']

['https://blog.cyble.com/2022/12/22/new-ransomware-strains-emerging-from-leaked-contis-source-code/']

{'pulse_id': '63a481d1b821012188699107', 'indicators': [{'id': 3599307344, 'role': None, 'type': 'FileHash-MD5', 'title': 'Ransom:Win32/Conti.ZC', 'content': '', 'created': '2022-12-22T16:12:02', 'indicator': '3eff7826b6eea73b0206f11d08073a68', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 578b1b0f46491b9d39d21f2103cb437bc2d71cac'}, {'id': 3599307346, 'role': None, 'type': 'FileHash-SHA1', 'title': 'Ransom:Win32/Conti.ZC', 'content': '', 'created': '2022-12-22T16:12:02', 'indicator': '578b1b0f46491b9d39d21f2103cb437bc2d71cac', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3599307352, 'role': None, 'type': 'FileHash-SHA256', 'title': 'Ransom:Win32/Conti.ZC', 'content': '', 'created': '2022-12-22T16:12:02', 'indicator': '7f6421cdf6355edfdcbddadd26bcdfbf984def301df3c6c03d71af8e30bb781f', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 578b1b0f46491b9d39d21f2103cb437bc2d71cac'}, {'id': 3603345781, 'role': None, 'type': 'FileHash-MD5', 'title': '#Exploit:NtQueryIntervalProfile', 'content': '', 'created': '2022-12-22T16:12:02', 'indicator': '033acf3b0f699a39becdc71d3e2dddcc', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 5949c404aee552fc8ce29e3bf77bd08e54d37c59'}, {'id': 3603345782, 'role': None, 'type': 'FileHash-MD5', 'title': 'Ransom:Win32/Conti.ZC', 'content': '', 'created': '2022-12-22T16:12:02', 'indicator': '1d70020ddf6f29638b22887947dd5b9c', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 987ad5aa6aee86f474fb9313334e6c9718d68daf'}, {'id': 3603345783, 'role': None, 'type': 'FileHash-MD5', 'title': 'Ransom:Win32/Conti.ZC', 'content': '', 'created': '2022-12-22T16:12:02', 'indicator': '4dd2b61e0ccf633e008359ad989de2ed', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 94a9da09da3151f306ab8a5b00f60a38b077d594'}, {'id': 3603345784, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-12-22T16:12:02', 'indicator': '8f154ca4a8ee50dc448181afbc95cfd7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603345785, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-12-22T16:12:02', 'indicator': '4f5d4e9d1e3b6a46f450ad1fb90340dfd718608b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603345786, 'role': None, 'type': 'FileHash-SHA1', 'title': '#Exploit:NtQueryIntervalProfile', 'content': '', 'created': '2022-12-22T16:12:02', 'indicator': '5949c404aee552fc8ce29e3bf77bd08e54d37c59', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603345787, 'role': None, 'type': 'FileHash-SHA1', 'title': 'Ransom:Win32/Conti.ZC', 'content': '', 'created': '2022-12-22T16:12:02', 'indicator': '94a9da09da3151f306ab8a5b00f60a38b077d594', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603345788, 'role': None, 'type': 'FileHash-SHA1', 'title': 'Ransom:Win32/Conti.ZC', 'content': '', 'created': '2022-12-22T16:12:02', 'indicator': '987ad5aa6aee86f474fb9313334e6c9718d68daf', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603345789, 'role': None, 'type': 'FileHash-SHA256', 'title': '#Exploit:NtQueryIntervalProfile', 'content': '', 'created': '2022-12-22T16:12:02', 'indicator': '222e2b91f5becea8c7c05883e4a58796a1f68628fbb0852b533fed08d8e9b853', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 5949c404aee552fc8ce29e3bf77bd08e54d37c59'}, {'id': 3603345790, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-12-22T16:12:02', 'indicator': '5a936250411bf5709a888db54680c131e9c0f40ff4ff04db4aeda5443481922f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603345791, 'role': None, 'type': 'FileHash-SHA256', 'title': 'Ransom:Win32/Conti.ZC', 'content': '', 'created': '2022-12-22T16:12:02', 'indicator': '7f624cfb74685effcb325206b428db2be8ac6cce7b72b3edebbe8e310a645099', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 987ad5aa6aee86f474fb9313334e6c9718d68daf'}, {'id': 3603345792, 'role': None, 'type': 'FileHash-SHA256', 'title': 'Ransom:Win32/Conti.ZC', 'content': '', 'created': '2022-12-22T16:12:02', 'indicator': 'fe311979cd099677b1fd7c5b2008aed000f0e38d58eb3bfd30d04444476416f9', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 94a9da09da3151f306ab8a5b00f60a38b077d594'}], 'indicators_count': 15}

a1ddb3881abfed3b6b7c14a3df5c7cc63368bc30e0313ab2dcee4f5d7f56e05f

2026-06-04 16:17:12.408553+03:00

2026-06-04 16:17:12.408553+03:00

6298718ccb0c8c00f0485af3

CVE-2017-11882

CVE

State-sponsored Attack Groups Capitalise on Russia-Ukraine War for Cyber Espionage

State-sponsored cyber-espionage groups around the world are using the ongoing Russia-Ukraine war as a bait for their attacks, according to research by Check Point Research and Kaspersky Technologies.

2022-06-02 08:15:08.016000+03:00

2022-07-02 00:05:39.094000+03:00

['el machete', 'lyceum', 'ukraine', 'sidewinder', 'apt', 'cve201711882', 'geopolitical conflict']

['Loki.Rat Backdoor']

['https://research.checkpoint.com/2022/state-sponsored-attack-groups-capitalise-on-russia-ukraine-war-for-cyber-espionage/']

{'pulse_id': '6298718ccb0c8c00f0485af3', 'indicators': [{'id': 200112887, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'CVE-2017-11882', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1386956027, 'role': None, 'type': 'FileHash-MD5', 'title': 'MS_Visual_Cpp_2008', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '2adef8c6699b0791a7636e8071e434fa', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 7115580f8235a0bbce61e8af79c3ed5cbe46900912eb0765ccaee82213a9275e'}, {'id': 2982276757, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'correomindefensagobvemyspace.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3260785249, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'kpt-pk.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3315385693, 'role': 'command_and_control', 'type': 'domain', 'title': 'TA457', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'cyberclub.one', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3391347628, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'news-spot.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3399347262, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'news-spot.live', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3399347264, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'science-news.live', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3399347265, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'news-reporter.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3399347266, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '13814a190f61b36aff24d6aa1de56fe2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3399347267, 'role': 'trojan', 'type': 'FileHash-MD5', 'title': 'TA457, DeviousDrone', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'd79687676d2d152aec4143c852bdbc4a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3399347269, 'role': 'trojan', 'type': 'FileHash-MD5', 'title': 'TA457, DeviousDrone', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '8b01dec07856a67db0e0d849bc84fd9e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3399347272, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '08fd3f4cdcb6e4c3cb28935c41781e5fe84bf0c6', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 13814a190f61b36aff24d6aa1de56fe2'}, {'id': 3399347273, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '221292a9f77f1a16fa0a7ed41b0eedbd312475dd9a5104c7923ed7889ea0f292', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 13814a190f61b36aff24d6aa1de56fe2'}, {'id': 3399347277, 'role': 'trojan', 'type': 'FileHash-MD5', 'title': 'TA457, DeviousDrone', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '8199f14502e80581000bd5b3bda250ee', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3399347278, 'role': 'trojan', 'type': 'FileHash-SHA1', 'title': 'TA457, DeviousDrone', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '0bc47b1044d1c795ab6cb9d51003e13ade567c6d', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 8199f14502e80581000bd5b3bda250ee'}, {'id': 3399347279, 'role': 'trojan', 'type': 'FileHash-SHA256', 'title': 'TA457, DeviousDrone', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'ba73116c7cf6faf3aa97b497cf7472b2a115a3b5ad7ad85f7919ff81a1ff2b9a', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 8199f14502e80581000bd5b3bda250ee'}, {'id': 3399347280, 'role': 'trojan', 'type': 'FileHash-SHA256', 'title': 'TA457, DeviousDrone', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '33da0540c8df2e9df4edb7293efb65781a3d10c6f5ff5763e654692c9639d5cc', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 8b01dec07856a67db0e0d849bc84fd9e'}, {'id': 3399347281, 'role': 'trojan', 'type': 'FileHash-SHA256', 'title': 'TA457, DeviousDrone', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '5f0e0f0abc28ccc1911533fd035e984b4183eb9838bb41c1f6589de84a617ca6', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of d79687676d2d152aec4143c852bdbc4a'}, {'id': 3399347282, 'role': 'trojan', 'type': 'FileHash-SHA256', 'title': 'TA457, DeviousDrone', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'd41fb37b5f32eb817801156d04df1384a2b9ad77deb6974ac73d212710e4f551', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of bcb465cc2257e5777bab431690ca5039'}, {'id': 3399347283, 'role': 'trojan', 'type': 'FileHash-SHA256', 'title': 'DeviousDrone', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '4181463d331dd7dd44bb170435f8f8f0ec2f6c4624e05332b19460365926ea23', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of f8c29040122cf892190bcf3665975d2f'}, {'id': 3399347284, 'role': None, 'type': 'FileHash-SHA256', 'title': 'GoLandBuildPE', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '964f04355d636c596e9b622f589d87c5818aa0ac9666012ed62b7819d2220c7a', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of a5dbfd729b6fd64a6c4fd77a3e356989'}, {'id': 3399347285, 'role': None, 'type': 'FileHash-SHA256', 'title': 'GoLandBuildPE', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'bebfa50ee48f0b77669ea57dee695d2f6a8b9956649c6bb94e350c92670a5a95', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 23d174e6a0905fd59b2613d5ac106261'}, {'id': 3399347286, 'role': 'trojan', 'type': 'FileHash-SHA256', 'title': 'DeviousDrone', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'd0ac165c22d01bd7864c1878d4c8ace83036b629e2121d14ebf118d8b8658fce', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of a437f997d45bc14e76d0f2482f572a34'}, {'id': 3399347294, 'role': 'trojan', 'type': 'FileHash-MD5', 'title': 'DeviousDrone', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'a437f997d45bc14e76d0f2482f572a34', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3399347295, 'role': 'trojan', 'type': 'FileHash-SHA1', 'title': 'DeviousDrone', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '1856532acc50f6d23cd6ef6863580d51fca9b3b3', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of a437f997d45bc14e76d0f2482f572a34'}, {'id': 3399347296, 'role': None, 'type': 'FileHash-MD5', 'title': 'GoLandBuildPE', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '23d174e6a0905fd59b2613d5ac106261', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3399347297, 'role': None, 'type': 'FileHash-SHA1', 'title': 'GoLandBuildPE', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'ad424730f19ca4276e39c5c3be7b72adf00c1452', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 23d174e6a0905fd59b2613d5ac106261'}, {'id': 3399347299, 'role': 'trojan', 'type': 'FileHash-MD5', 'title': 'TA457, DeviousDrone', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'bcb465cc2257e5777bab431690ca5039', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3399347300, 'role': 'trojan', 'type': 'FileHash-SHA1', 'title': 'TA457, DeviousDrone', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '8f6a891d5de2afefc2c9c6ce2747fe6daedaefeb', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of bcb465cc2257e5777bab431690ca5039'}, {'id': 3401147487, 'role': None, 'type': 'FileHash-MD5', 'title': 'SideWinder', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'bbc955b1289b4f90fdfb8906606597e9', 'is_active': 1, 'expiration': None, 'description': 'MD5 of f765b0b6e4a34eb95c6f0ddf058bc88d5ef9ec2b11a5f3504d1673f4f69aceca'}, {'id': 3401147489, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'maritimepakistan.kpt-pk.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3411977917, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '9fcad8f97eeae10f7a222eca94cb9a5f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3411977918, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '53542ec51daf61fba2d26fe91b7d701f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3411977919, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'f9fd9e32cb04c4fc93e65f48562ecad3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3411977920, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '1a5489147a888c4f5f32e97ffcb01733', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3411978018, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'd962dd55fde800d972a156f5c63a6243', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3411988036, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'd39fd8ddc0d4128d2bb52a1bc11254f0b6bb2533d94f1f386bd5b3e7455fbee2', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of f9fd9e32cb04c4fc93e65f48562ecad3'}, {'id': 3411988037, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '1649b9bb8f5979a5e14dd3f16e1279599b878f09be258962727464e88372ceb2', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 53542ec51daf61fba2d26fe91b7d701f'}, {'id': 3411988039, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '39f9774c56090341cc31590e4b33d8e1c8d2343f9981986a9173452b2e5fae18', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of d962dd55fde800d972a156f5c63a6243'}, {'id': 3412908170, 'role': 'rat', 'type': 'FileHash-MD5', 'title': 'Py/Cannibal', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '14d3040db6d97f13250c438e2acb64ac', 'is_active': 1, 'expiration': None, 'description': 'MD5 of ed09da9d48afe918f9c7f72fe4466167e2f127a28a7641ba80d6165e82f48431'}, {'id': 3412908171, 'role': 'rat', 'type': 'FileHash-SHA1', 'title': 'Py/Cannibal', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'c66d5875b5db70aad23c868449c3cabbf5d90d0f', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of ed09da9d48afe918f9c7f72fe4466167e2f127a28a7641ba80d6165e82f48431'}, {'id': 3412908172, 'role': 'rat', 'type': 'FileHash-SHA256', 'title': 'Py/Cannibal', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'ed09da9d48afe918f9c7f72fe4466167e2f127a28a7641ba80d6165e82f48431', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3412908173, 'role': None, 'type': 'FileHash-MD5', 'title': 'ConventionEngine_Term_Desktop', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '6d24fa95eb6cb3787024a842b0187988', 'is_active': 1, 'expiration': None, 'description': 'MD5 of b9bf3e9725696331916e32e5936111e1166867b1d2d3ab05e46b9fff8679cf8f'}, {'id': 3412908174, 'role': None, 'type': 'FileHash-MD5', 'title': 'LZMA', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'a5cdd225208381e2ecc6d820dce5c8b8', 'is_active': 1, 'expiration': None, 'description': 'MD5 of c6c794348d17d40c544487154ca72e8e6199b670f804ee25d7bcd9ff884d67b1'}, {'id': 3412908175, 'role': None, 'type': 'FileHash-SHA1', 'title': 'LZMA', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '4900ce4dbad498ed8245bbc5c1abadbf89180032', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of c6c794348d17d40c544487154ca72e8e6199b670f804ee25d7bcd9ff884d67b1'}, {'id': 3412908176, 'role': None, 'type': 'FileHash-SHA1', 'title': 'ConventionEngine_Term_Desktop', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '6961724417d2a011b65dcdbe2dfec8f75bf76b3f', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of b9bf3e9725696331916e32e5936111e1166867b1d2d3ab05e46b9fff8679cf8f'}, {'id': 3412908177, 'role': None, 'type': 'FileHash-SHA1', 'title': 'MS_Visual_Cpp_2008', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': 'adf0479481869f31d9e691cec3dc96689dc5bee9', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 7115580f8235a0bbce61e8af79c3ed5cbe46900912eb0765ccaee82213a9275e'}, {'id': 3412908178, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '4c22116b68732f8fe9e2fb5e56e9ff798f30805f9008e4f7a4be1e1c830162b8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3412908179, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-06-02T08:15:09', 'indicator': '65e48c986d185d156999adc762d7bff84ddbf44851419d66c2985a2ccc2e072d', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 143}

2bab2f9566149a7cc064e207014423dddca9f78e5638f71c1628b3e11b4eec2e

2026-06-04 16:17:12.734990+03:00

2026-06-04 16:17:12.734990+03:00

617bc3fe39fce40899c10840

32743ea620ff724d3065688add0e1b5d

FileHash-MD5

Almost 100 Organizations in Brazil Targeted with Banking Trojan

A new wave of Latin American banking Trojans targeting businesses and government institutions in Brazil has been identified, with as many as 98 targeted with the malware.

2021-10-29 09:50:53.562000+03:00

2021-10-29 09:51:55.423000+03:00

['latin america', 'banking trojan']

['ALF:TrojanSpy:Bancos']

['https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/banking-trojan-latam-brazil']

{'pulse_id': '617bc3fe39fce40899c10840', 'indicators': [{'id': 3275210822, 'role': None, 'type': 'FileHash-MD5', 'title': 'AdvancedInstaller', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '32743ea620ff724d3065688add0e1b5d', 'is_active': 1, 'expiration': None, 'description': 'MD5 of d5bb070c69c88f3e8de09d17c77dd57bad9adde8c03d625f4497d3a4bcc8892e'}, {'id': 3275210823, 'role': None, 'type': 'FileHash-MD5', 'title': 'AdvancedInstaller', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '3582ef8725d3486d7c10ea9f90057b09', 'is_active': 1, 'expiration': None, 'description': 'MD5 of b2c317529c7f95db85867bce6085878ed8db7bdb89f6283708b4261f73808b95'}, {'id': 3275210824, 'role': None, 'type': 'FileHash-SHA1', 'title': 'AdvancedInstaller', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '7e5813409c76486aabb5416459208b47c5f577db', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of d5bb070c69c88f3e8de09d17c77dd57bad9adde8c03d625f4497d3a4bcc8892e'}, {'id': 3275210825, 'role': None, 'type': 'FileHash-SHA1', 'title': 'AdvancedInstaller', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'c1bacc43a39596b807c0ba0619b313b3713a6e70', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of b2c317529c7f95db85867bce6085878ed8db7bdb89f6283708b4261f73808b95'}, {'id': 3275210826, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '0cb4baaaad8751fe293739ddd874437b5b3c6e4ad72747bb9327db6cc74317a8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210827, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '0ee61e700ce0c71afe9bb2c8d7c253b560ddf535c3fd1f633b67e27f68731963', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210828, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '160500920795f38338d2fa12be80fb7a52d804c3d843626832a42c93bd4d28ee', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210829, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '1f6bc4e5c07c3c74764581f1b35c401a5857228a15948402a9bde765d6d58cb3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210830, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '2081f9406af8936ff0c638df9191da763848bea0aae328c54f8e18419d9cd0df', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210831, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '2b85c92db126e93658f2e74da11b3a0ca8001a4f33f293b0e796d952c8d543d9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210832, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '2bb4f701a97222d52af5623dba6cd61cae37527a2dd866fe246bbb2f55bdceb4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210833, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '35bbbe15471d45d7abb9300576eaee8f2f4d68d469b2cfc816342847e8f91db2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210834, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '52c8236da569e448127dd0735943ae8ad16428e026883c78aae6b0853efc7ece', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210835, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '5516bfffad1229f65bee736bec6f121abcddab8b5f673d98836e9d68c67c8194', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210836, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '5e54d306f17f39b78ccc79cc19c12b0ff3ba1ea4e0785b58f9ff55e8b5578a07', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210837, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '5ee4719fc1be0238875ad3d79260d09677bf110b4add8057d767e34b5a3d716d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210838, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '61c0e242c7a959dd673a4abded8a47ab02b919319666d9e81f9ac213a08fc90e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210839, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '7cf033b0d80e07c2b5b0675c8aa09a3b3108135b9b2e1d053d52f19964eebc7d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210840, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '8240909d109da9fd2969ff56bf64a8d75de256539dc825c0c5739b7dc57d5eb5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210841, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '86bb40de9a98c277d29a677b1c1a54f88741ebe9418e7354ec65519102703fb9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210842, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '8cf0b8b993bba3b1aa3b4b7980d9d784b048dd45c47699a0e04121dd89f2152e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210843, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '939cdcfdd19b78ad35d1cad2af8baf31413d180639bb0022eb0796c82fcc64ef', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210844, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '993017c033afb58545d0f5d76288d54bf008cfbc10e19794a152adf3b59f5fbf', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210845, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': '9aeb864a3e587bee375c20eb953750c62ecd58d8f7c1feb2212d3d027c74232f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210846, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'a1e414d88df22263827233fc65fc8e4114ded43b8d14bd1c09956d834eba525e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210847, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'ad6116abb88fd0383cf6f5a9f66a6ad8dda2be06bdc02a0fc071584689b69055', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210848, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'b0c1c6ee59144ae7fbed50a4da8abf8a04510759699076728f2ccfa45ac6fa37', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210849, 'role': None, 'type': 'FileHash-SHA256', 'title': 'AdvancedInstaller', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'b2c317529c7f95db85867bce6085878ed8db7bdb89f6283708b4261f73808b95', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210850, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'c01cf8ad6e85743ed687e131b53b90e8cee72d20b50f7faebd7ac793df1d1c1d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210851, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'cd66d3f21ec3d4751df942e057e4cad548922f02a9d2253e402b5f7d878b3a39', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210852, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'cf7417c7dcaa27add45bfbba9984f40e0d11c24030a2036c44bd8591a54b4f8f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210853, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'cfe570c69f1794e9c6c950761f6f2cc1b553d53c82563982850ef8cb77442b35', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210854, 'role': None, 'type': 'FileHash-SHA256', 'title': 'AdvancedInstaller', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'd5bb070c69c88f3e8de09d17c77dd57bad9adde8c03d625f4497d3a4bcc8892e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210855, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'dee81a0164862d8be16e42177be61d78e82c8e903cbae3686c170b7a81e41f24', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210856, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'e0c2ce9a2f7ae075e2fee6960af3c69c45fc41ce101499e5697599389a35cb85', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210857, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'e118e0898e000e10c26376d73f5571e2b185c2c4789ed9b5d36bce166dc1dd17', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210858, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'feb86261d3d6551d92fc1e5554f22a1e9aeece4b5ed5737587580613b6a1d55d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210859, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'ff8897e5fff9f76bf8d84d478d476f5a9278cbe0a355781224b69c0a28ab4540', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210861, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'https://centralcfconsulta.net/index3.php?api=vFUMIfUzGz2QdjxTFKAMyTlh', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210863, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'https://centreldaconsulta.com/index3.php?api=ThMyMCAQEOLIC9nO', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210864, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'https://centreldaconsulta.com/index3.php?api=nJsdr1J3h0fsG18sRAVQt6JjVW', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210866, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'https://www.centralcfconsulta.net/index3.php?api=4DQSbdp3hLqPRGTbOGtl7jCD9FKNViKXmKd9Lv', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210867, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'https://www.centralcfconsulta.net/index3.php?api=r0ubnHRxDycEy5uFPViNA55Y3t', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3275210868, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2021-10-29T09:50:55', 'indicator': 'https://www.centralcfconsulta.net/index3.php?api=wen1eIFCeUh0jAS3mWIDUhSLt3sXMQ', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 44}

02461a0a4256c990b4c8ecff9b1454500dcfc8fdb8b89f08cb2fd7d9dfdfe3d2

2026-06-04 16:17:13.090022+03:00

2026-06-04 16:17:13.090022+03:00

628e427ec66c3cb798970270

http://aa.hostasa.org/config.rar

URL

Rise in XorDdos: A deeper look at the stealthy DDoS malware targeting Linux devices

A look at Microsoft's research into XorDdos, a malware that can cause distributed denial-of-service (DDoS) attacks on Linux-based systems and other internet-connected devices.

2022-05-25 14:51:42.194000+03:00

2022-05-25 14:51:42.194000+03:00

['XorDdos', 'DDoS']

['XorDdos', 'Xorddos']

['https://www.microsoft.com/security/blog/2022/05/19/rise-in-xorddos-a-deeper-look-at-the-stealthy-ddos-malware-targeting-linux-devices/']

{'pulse_id': '628e427ec66c3cb798970270', 'indicators': [{'id': 699200, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': 'http://aa.hostasa.org/config.rar', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759187, 'role': None, 'type': 'FileHash-MD5', 'title': 'Backdoor:Win32/Berbew', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': '2dc6225a9d104a950fb33a74da262b93', 'is_active': 1, 'expiration': None, 'description': 'MD5 of f05194fb2b3978611b99cfbf5e5f1dd44cd5e04b'}, {'id': 3453759188, 'role': None, 'type': 'FileHash-SHA1', 'title': 'Backdoor:Win32/Berbew', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': 'f05194fb2b3978611b99cfbf5e5f1dd44cd5e04b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759189, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': '175667933088fbebcb62c8450993422ccc876495299173c646779a9e67501ff4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759190, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': '2b4500987d50a24ba5c118f506f2507362d6b5c63c80b1984b4ae86641779ff3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759191, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': '359c41da1cbae573d2c99f7da9eeb03df135f018f6c660b4e44fbd2b4ddecd39', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759192, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': '360a6258dd66a3ba595a93896d9b55d22406d02e5c02100e5a18382c54e7d5cd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759193, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': '53f062a93cf19aeaa2f8481b32118a31b658a126624abb8a7d82237884f0a394', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759194, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': '6e506f32c6fb7b5d342d1382989ab191c6f21c2d311251d8f623814f468952cf', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759195, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': '798577202477c0c233d4af51c4d8fb2f574ddb3c9d1d90325d359a84cb1bd51c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759196, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': '932feef3ab6fccb3502f900619b1f87e1cb44a7adab48f2c927ecdd67ff6830a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759197, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': '9d6f115f31ee71089cc85b18852974e349c68fad3276145dafd0076951f32489', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759198, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': 'b5fba27a8e457c1ab6573c378171f057d151dc615d6a8d339195716fa9ac277a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759199, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': 'c8f761d3ef7cd16ebe41042a0daf901c2fdffce96c8e9e1fa0d422c6e31332ea', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759200, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': 'cbb72e542e8f19240130fc9381c2351730d437d42926c6e68e056907c8456459', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759201, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': 'd71ea3b98286d39a711b626f687f0d3fc852c3e3a05de3f51450fb8f7bd2b0d7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759202, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': 'dc2b1cee161ebe90be68561755d99e66f454ad80b27cebe3d4773518ac45cbb7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759203, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': 'e6c7eee304dfc29b19012ef6d31848c0b5bb07362691e4e9633c8581f1c2d65b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759204, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': 'ef0a4c12d98dc0ad4db86aadd641389c7219f57f15642ed35b4443daf3ff8c1e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759205, 'role': None, 'type': 'FileHash-SHA256', 'title': 'Backdoor:Win32/Berbew', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': 'f2df54eb827f3c733d481ebb167a5bc77c5ae39a6bda7f340bb23b24dc9a4432', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of f05194fb2b3978611b99cfbf5e5f1dd44cd5e04b'}, {'id': 3453759206, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': 'http://www.enoan2107.com:3306', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3453759207, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2022-05-25T14:51:43', 'indicator': 'http://www.gzcfr5axf6.com:3306', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 22}

4a83a44dc39267910027ef8a8c9949302b0d97f83e372c3875237b4aea0f7e18

2026-06-04 16:17:12.734990+03:00

2026-06-04 16:17:12.734990+03:00

624ffa7f0b7f6d64e74199d2

clickstat360.com

domain

Parrot TDS takes over web servers and threatens millions

Avast has identified a new traffic Direction System (TDS) that has infected tens of thousands of compromised websites and could infect millions of users by April 7, 2022, the latest in a series of attacks.

2022-04-08 09:03:59.130000+03:00

2022-05-08 00:03:14.586000+03:00

['fakeupdate', 'parrot tds', 'NetSupport']

['FakeUpdate', 'NetSupportManager RAT']

['https://decoded.avast.io/janrubin/parrot-tds-takes-over-web-servers-and-threatens-millions/']

{'pulse_id': '624ffa7f0b7f6d64e74199d2', 'indicators': [{'id': 1595943846, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'clickstat360.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1857668475, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'spillpalletonline.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2125230086, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': '8ad9c598c1fde52dd2bfced5f953ca0d013b0c65feb5ded73585cfc420c95a95', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2222916455, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'www.netsupportsoftware.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2230188782, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'srkpc.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2239475177, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': '2a77875b08d4d2bb7b654db33a88f16c', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 8ad9c598c1fde52dd2bfced5f953ca0d013b0c65feb5ded73585cfc420c95a95'}, {'id': 2239475185, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'e68dede6f9288e04eaf0359d5622d721fea7184d', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 8ad9c598c1fde52dd2bfced5f953ca0d013b0c65feb5ded73585cfc420c95a95'}, {'id': 2244874220, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'nuwealthmedia.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2607551153, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'wholesalerandy.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2704129459, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'syncadv.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2723968800, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'youbyashboutique.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2813540376, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'refinedwebs.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2838849920, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'statclick.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2845017958, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'altcoinfan.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2935106250, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'pocketstay.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3001632071, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'markbrey.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3008314012, 'role': None, 'type': 'FileHash-MD5', 'title': 'research_pe_signed_outside_timestamp', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': '252dce576f9fbb9aaa7114dd7150f320', 'is_active': 1, 'expiration': None, 'description': 'MD5 of b6b51f4273420c24ea7dc13ef4cc7615262ccbdf6f5e5a49dae604ec153055ad'}, {'id': 3008314013, 'role': None, 'type': 'FileHash-SHA256', 'title': 'research_pe_signed_outside_timestamp', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'b6b51f4273420c24ea7dc13ef4cc7615262ccbdf6f5e5a49dae604ec153055ad', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3008314015, 'role': None, 'type': 'FileHash-SHA1', 'title': 'research_pe_signed_outside_timestamp', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'c07f0a02c284b697dff119839f455836be39d10e', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of b6b51f4273420c24ea7dc13ef4cc7615262ccbdf6f5e5a49dae604ec153055ad'}, {'id': 3108567543, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'expresswayautopr.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3163493133, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'accountablitypartner.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3198840917, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'staticvisit.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3213893465, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'drpease.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3213893466, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'wwpcrisis.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3242290932, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'webcachestorage.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3381570692, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'ahrealestatepr.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3410080642, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'fioressence.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3410081061, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'windsorbongvape.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3411060905, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'hill-family.us', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3411970083, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'lawrencetravelco.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3414823615, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'integrativehealthpartners.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121491, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': '0046fad95da901f398f800ece8af479573a08ebf8db9529851172ead01648faa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121492, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': '15afd9eb66450b440d154e98ed82971f1b968323ff11b839b046ae4bec60f855', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121493, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': '4fffa055d56e48fa0c469a54e2ebd857f23eca73a9928805b6a29a9483dffc21', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121494, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'b63260c1f213c02fcbb5c1a069ab2f1d17031e598fd19673bb639aa7557a9bae', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121495, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'daabdec3d5a43bb1c0340451be466d9f90eaa0cfac92fb6beaabc59452c473c3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121496, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'e22e88c8ec0f439eebbb6387eeea0d332f57c137ae85cf1d8d1bb4c7ea8bd2f2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121506, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'https://www.netsupportsoftware.com/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121507, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': '2ctmedia.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121508, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'avanzatechnicalsolutions.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121509, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'codigodebarra.co', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121510, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'codingbit.co.in', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121511, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'craigconnors.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121512, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'fishslayerjigco.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121513, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'lilscrambler.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121514, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'mattingsolutions.co', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121515, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'maxxcorp.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121516, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'parmsplace.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121517, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'walmyrivera.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3419121518, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2022-04-08T09:04:00', 'indicator': 'webcachespace.net', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 52}

f4550fec393007895f3d3e4bb0949ddff88d15d056699242a1fccc3df5cac3f7

2026-06-04 16:17:12.734990+03:00

2026-06-04 16:17:12.734990+03:00

67d7eb546507ad4fb355245f

virtuehub.one

domain

Negative Exposure: Edimax Network Cameras Used to Spread Mirai

The Akamai Security Intelligence and Response Team (SIRT) has identified a critical command injection vulnerability, CVE-2025-1316, in Edimax IC-7100 IP cameras. This flaw allows attackers to execute arbitrary commands remotely, leading to the integration of these devices into Mirai-based botnets. The vulnerability stems from improper neutralization of special elements in OS commands, enabling remote code execution through specially crafted requests. Despite detection efforts, Edimax has not provided patches, leaving affected devices exposed to ongoing exploitation.

2025-03-17 09:28:52.308000+03:00

2025-04-16 09:03:27.836000+03:00

['botnet', 'sha256 hash', 'sha256', 'malware', 'mirai', 'exploit']

['Mirai']

['https://www.akamai.com/blog/security-research/2025/mar/march-edimax-cameras-command-injection-mirai']

{'pulse_id': '67d7eb546507ad4fb355245f', 'indicators': [{'id': 3832393432, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': 'virtuehub.one', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3887750229, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': '9f6bfe55961ae4b657dd1e7b3f488b49133cd2cd89d89d3f1052fc5d28287de6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3986331101, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': 'cnc.ziparchive.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3987958134, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': 'cnc.merisprivate.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3990268635, 'role': None, 'type': 'FileHash-MD5', 'title': 'is__elf', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': '16f4c9663432ad97a11595f03d08a796', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 4d577320b4875fcd7e7e65aece5bd4e3040772e4030a0d671570fcc9337fab72'}, {'id': 3990269369, 'role': None, 'type': 'FileHash-SHA1', 'title': 'is__elf', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': 'eb05d986935d9d71a701e5f817bb1d114e20ac3b', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 4d577320b4875fcd7e7e65aece5bd4e3040772e4030a0d671570fcc9337fab72'}, {'id': 3990269519, 'role': None, 'type': 'FileHash-SHA256', 'title': 'is__elf', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': '4d577320b4875fcd7e7e65aece5bd4e3040772e4030a0d671570fcc9337fab72', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3990270599, 'role': None, 'type': 'FileHash-MD5', 'title': 'SUSP_ELF_LNX_UPX_Compressed_File', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': '7ff7cdd806adaea6085384f85a736106', 'is_active': 1, 'expiration': None, 'description': 'MD5 of c792ce87ba1b0dc37cf3d2d2b4ad3433395ae93e0f1ae9c1140d097d093c1457'}, {'id': 3990270624, 'role': None, 'type': 'FileHash-MD5', 'title': 'SUSP_ELF_LNX_UPX_Compressed_File', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': 'd67ab8e2b66b87b5665333176583e552', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 4244ef7ff56a2dab17f06c98131f61460ec9ca7eec6f7cb057d7e779c3079a65'}, {'id': 3990270646, 'role': None, 'type': 'FileHash-SHA1', 'title': 'SUSP_ELF_LNX_UPX_Compressed_File', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': '07f7ee2a8c37722956faa1fe024b57b63732f808', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of c792ce87ba1b0dc37cf3d2d2b4ad3433395ae93e0f1ae9c1140d097d093c1457'}, {'id': 3990270674, 'role': None, 'type': 'FileHash-SHA1', 'title': 'SUSP_ELF_LNX_UPX_Compressed_File', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': '571fb2b837941d8d3fb4bef82a09d850696dd856', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 4244ef7ff56a2dab17f06c98131f61460ec9ca7eec6f7cb057d7e779c3079a65'}, {'id': 3990270769, 'role': None, 'type': 'FileHash-SHA256', 'title': 'SUSP_ELF_LNX_UPX_Compressed_File', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': '4244ef7ff56a2dab17f06c98131f61460ec9ca7eec6f7cb057d7e779c3079a65', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3990270814, 'role': None, 'type': 'FileHash-SHA256', 'title': 'SUSP_ELF_LNX_UPX_Compressed_File', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': 'c792ce87ba1b0dc37cf3d2d2b4ad3433395ae93e0f1ae9c1140d097d093c1457', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4001432369, 'role': None, 'type': 'FileHash-MD5', 'title': 'SUSP_ELF_LNX_UPX_Compressed_File', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': '81f3ac27b52eb37d8c49bee1381f106c', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 75ad7e1857d39eb1554c75d1f52aa4c14318896a7aebbc1d10e673aee4c2ca36'}, {'id': 4001434256, 'role': None, 'type': 'FileHash-SHA1', 'title': 'SUSP_ELF_LNX_UPX_Compressed_File', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': '266b65fc266c027494e8775bbfab92e08801d733', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 75ad7e1857d39eb1554c75d1f52aa4c14318896a7aebbc1d10e673aee4c2ca36'}, {'id': 4001438384, 'role': None, 'type': 'FileHash-SHA256', 'title': 'SUSP_ELF_LNX_UPX_Compressed_File', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': '75ad7e1857d39eb1554c75d1f52aa4c14318896a7aebbc1d10e673aee4c2ca36', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4026185678, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': 'bot.merisprivate.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4040586454, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': 'angela.spklove.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4046936182, 'role': None, 'type': 'FileHash-MD5', 'title': 'SUSP_ELF_LNX_UPX_Compressed_File', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': 'e04c8d9b695d13c831cc092617a3ed76', 'is_active': 1, 'expiration': None, 'description': 'MD5 of ba8d7017545747bc1bc609277af26a0c8c1fa92541c0290dd9d8570d59faca97'}, {'id': 4046936183, 'role': None, 'type': 'FileHash-SHA1', 'title': 'SUSP_ELF_LNX_UPX_Compressed_File', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': '01d34f5103d697d120fddddd9408f9dd2c519ee9', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of ba8d7017545747bc1bc609277af26a0c8c1fa92541c0290dd9d8570d59faca97'}, {'id': 4046936184, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': '40b87a40b2de80bc5a8cc40cd1667a3ded9b01211487a3aea8e11225994b0f21', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4046936185, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': '43896ed73bf5565dacacd3921af42b0d0f484f69695187c249ad40d86a3aec59', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4046936186, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': '555ca3b4a1e17f832d477f365a660775acc10d59a51d7cc194e6249b5c0ba58f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4046936187, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': '9111ad2a4bc21a6c6a45507c59b7e35151b8c909f4bb1238cc2b1d750fc6fe89', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4046936188, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': 'b8837d659bb88adc0348de027d33d9c17e6d1ee732b025928e477dc2802cb256', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4046936189, 'role': None, 'type': 'FileHash-SHA256', 'title': 'SUSP_ELF_LNX_UPX_Compressed_File', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': 'ba8d7017545747bc1bc609277af26a0c8c1fa92541c0290dd9d8570d59faca97', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4046936190, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': 'e2ce2a05d4b70ea4dfacbc60477f2f1fac7b521b28650fe726d77d7999f57759', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4046936191, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-03-17T09:28:54', 'indicator': 'ee6f9b6e8f2c0b37b906914cd640b7bde1a903545035eb4861dba5f1ec0317a9', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 28}

f7bacd57195dd266ef3073c55f8ea6b3622fe6f4c3fea9a4178d80d8d49fe4b8

2026-06-04 16:17:10.860473+03:00

2026-06-04 16:17:10.860473+03:00

5f15c3febd3a04ce5d10cc75

efbb681a61967e6f5a811f8649ec26efe16f50ae

FileHash-SHA1

ThiefQuest (EvilQuest), the Quickly-Evolving macOS Malware

New analysis by TrendMicro discussing their discoveries such as the differences between the old and new versions of the malware.

2020-07-20 16:19:10.325000+03:00

2020-08-19 00:09:01.459000+03:00

['thiefquest', 'applescript', 'ransomware', 'shlayer', 'MacOS', 'Apple', 'CVE-2020-10173']

['thiefquest', 'EvilQuest']

['https://blog.trendmicro.com/trendlabs-security-intelligence/updates-on-thiefquest-the-quickly-evolving-macos-malware/']

{'pulse_id': '5f15c3febd3a04ce5d10cc75', 'indicators': [{'id': 2282467717, 'role': None, 'type': 'FileHash-SHA1', 'title': 'Other:Malware-gen\\ [Trj]', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': 'efbb681a61967e6f5a811f8649ec26efe16f50ae', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 5a024ffabefa6082031dccdb1e74a7fec9f60f257cd0b1ab0f698ba2a5baca6b'}, {'id': 2282857952, 'role': None, 'type': 'FileHash-SHA256', 'title': 'Other:Malware-gen\\ [Trj]', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': '5a024ffabefa6082031dccdb1e74a7fec9f60f257cd0b1ab0f698ba2a5baca6b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2282857954, 'role': None, 'type': 'FileHash-MD5', 'title': 'Other:Malware-gen\\ [Trj]', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': '322f4fb8f257a2e651b128c41df92b1d', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 5a024ffabefa6082031dccdb1e74a7fec9f60f257cd0b1ab0f698ba2a5baca6b'}, {'id': 2289578010, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': 'c5a77de3f55cacc3dc412e2325637ca7a2c36b1f4d75324be8833465fd1383d3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2289578011, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': '06974e23a3bf303f75c754156f36f57b960f0df79a38407dfdef9a1c55bf8bff', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2289578012, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': 'd18daea336889f5d7c8bd16a4d6358ddb315766fa21751db7d41f0839081aee2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2289578013, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': '8dfaad76396328ebaff57545667f9a3f', 'is_active': 1, 'expiration': None, 'description': 'MD5 of d18daea336889f5d7c8bd16a4d6358ddb315766fa21751db7d41f0839081aee2'}, {'id': 2289578014, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': 'fd08e82271e3e54122cb603e268390b2', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 06974e23a3bf303f75c754156f36f57b960f0df79a38407dfdef9a1c55bf8bff'}, {'id': 2289578015, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': '13e598a6c38c7adacc5ab6efd8f10df0a9e2998a', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 06974e23a3bf303f75c754156f36f57b960f0df79a38407dfdef9a1c55bf8bff'}, {'id': 2289578016, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': 'bea7589ccc984ac1174d25e3ce6bca3f73ff0680', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of d18daea336889f5d7c8bd16a4d6358ddb315766fa21751db7d41f0839081aee2'}, {'id': 2297856496, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': 'f7efda39c80d68db168316732732d04a00fe6fb10f37d1013df1a8a4cde1f68a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2298457805, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': '851dfdbffd250523c5c7ff07b29778a04ebd44400b12f23d18a6ee5a3fcfbedc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2298457806, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': 'eeac57f7ca9df9199f0346ed9097e9f5482c06214cddc162d1500d15d045b4ed', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2298457807, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': '365a5c72f52de964b8dc134d2fc45f9c73ba045cebd9fd397b1e26fdb11bfec6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2298457808, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': 'bcdb0ca7c51e9de4cf6c5c346fd28a4ed28e692319177c8a94c86dc676ee8e48', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2298457809, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': 'effeeeadfdc3caf523635fcb86581a807f719fa5e322872854499f5270bc0eba', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2298457810, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': 'e69e9dc0d343165aa0f5df942d1b48ddd0337c8a79dcdf40f3c3b490d6e96a78', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2298457811, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': '41036e1b78a122e57f2125526d673ffe3358d7323fc577703662740b3e651dcc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2298457812, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': '7292004b57562223fed4ee122a956a8db38349c95d4dd8853b1ebc60ef7508b1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2298457813, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2020-07-20T16:19:11', 'indicator': '92ad2b0220f6903fb5fa48ce411af44a60c06031fee3aa682bd28f3f3fde1eda', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 20}

09dd868921d7ca50daeef8d29f1e15ed15acc6e596b611a42cc312fb139b601d

2026-06-04 16:17:13.458539+03:00

2026-06-04 16:17:13.458539+03:00

5d3092fc4cd930e8cd6b1f76

offlineearthquake.com

domain

Hard Pass: Declining APT34’s Invite to Join Their Professional Network

In late June 2019, FireEye identified a phishing campaign conducted by APT34, an Iranian-nexus threat actor.

2019-07-18 15:40:44.499000+03:00

2019-09-12 10:46:30.472000+03:00

['Backdoor', 'TONEDEAF', 'LONGWATCH', 'PICKPOCKET', 'VALUEVAULT']

[]

['https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html', 'https://twitter.com/kyleehmke/status/1151944337598668801']

{'pulse_id': '5d3092fc4cd930e8cd6b1f76', 'indicators': [{'id': 2115998718, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': 'offlineearthquake.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2117303593, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': 'http://offlineearthquake.com/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2117303610, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': '2175299818a00a5dbcc1d96c3ef4cdca4e94052a22f08fcf8e982d0548a7bff0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2117303631, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': 'http://www.cam-research-ac.com/Documents/Cambridge_employment_form.zip', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2117303645, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': 'caf418cbf6a9c4e93e79d4714d5d3b87', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2117303654, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': '6eca9c2b7cf12c247032aae28419319e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2117303657, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': 'b338baa673ac007d7af54075ea69660b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2117303658, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': '96feed478c347d4b95a8224de26a1b2c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2117303668, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': '9fff498b78d9498b33e08b892148135f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2117303673, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': 'd8abe843db508048b4d4db748f92a103', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2117303678, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': '50fb09d53c856dcd0782e1470eaeae35', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2117303690, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': '185.15.247.154', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119501293, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': 'http://offlineearthquake.com/download?id=LXq&n=000', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119501294, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': 'http://offlineearthquake.com/download?id=bom&n=000', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119501295, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': 'http://offlineearthquake.com/download?id=bov&n=000', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119501296, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': 'http://offlineearthquake.com/file/6H3/P86.dll?id=Zwh&n=000', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119501297, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': 'http://offlineearthquake.com/upload?id=bwd&n=\x12', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119501299, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': 'c.cdn-edge-akamai.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119501300, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': '021a0f57fe09116a43c27e5133a57a0a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119501301, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': 'http://185.15.247.154/free/second.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119501302, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2019-07-18T15:40:46', 'indicator': 'http://185.15.247.154/free/uploadFiles/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119737081, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2019-07-19T15:17:35', 'indicator': 'ebb2bd669f02831e2572635d22623fa691d03782bcc237b9b502a7ff6a578661', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119737082, 'role': None, 'type': 'email', 'title': '', 'content': '', 'created': '2019-07-19T15:17:35', 'indicator': 'somel.yurgilun@yandex.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119737083, 'role': None, 'type': 'email', 'title': '', 'content': '', 'created': '2019-07-19T15:17:35', 'indicator': 'samoel.reyenal@yandex.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119737084, 'role': None, 'type': 'email', 'title': '', 'content': '', 'created': '2019-07-19T15:17:35', 'indicator': 'res.kinmel@yandex.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119737085, 'role': None, 'type': 'email', 'title': '', 'content': '', 'created': '2019-07-19T15:17:35', 'indicator': 'poll.kerkolea@yandex.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119737086, 'role': None, 'type': 'email', 'title': '', 'content': '', 'created': '2019-07-19T15:17:35', 'indicator': 'melania.yurgil@yandex.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119737087, 'role': None, 'type': 'email', 'title': '', 'content': '', 'created': '2019-07-19T15:17:35', 'indicator': 'ilkoy.terlonge@yandex.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119737088, 'role': None, 'type': 'email', 'title': '', 'content': '', 'created': '2019-07-19T15:17:35', 'indicator': 'garbel.tom@yandex.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119737089, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2019-07-19T15:17:35', 'indicator': 'offturn.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119737090, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2019-07-19T15:17:35', 'indicator': 'hugebricks.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119737091, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2019-07-19T15:17:35', 'indicator': 'jobs-datastax.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119737092, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2019-07-19T15:17:35', 'indicator': 'wp.fuktheme.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2119737093, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2019-07-19T15:17:35', 'indicator': 'backup.goosegoosecome.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2127547269, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2019-09-12T10:46:30', 'indicator': 'sprhnz.p-e.kr', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 35}

e80cb654ee9a709b877f270b2f1efeb07c35e015fd76f2eb38ac03b3675e458e

2026-06-04 16:17:14.125803+03:00

2026-06-04 16:17:14.125803+03:00

65e0cc22a43a74523fa3eae6

makeyourpay.com

domain

DNS Used to Hide Fake Investment Platform Schemes

A threat actor known as Savvy Seahorse is using DNS techniques to create traffic distribution systems that direct victims to fake investment platforms through Facebook ads. The campaigns involve advanced social engineering including fake ChatGPT bots that convince victims to provide personal information and make deposits, with the funds ultimately transferred to Russia.

2024-02-29 18:25:38.126000+03:00

2024-02-29 18:29:54.448000+03:00

['facebook ads', 'chatgpt', 'social engineering', 'dns', 'investment fraud']

[]

['https://blogs.infoblox.com/cyber-threat-intelligence/beware-the-shallow-waters-savvy-seahorse-lures-victims-to-fake-investment-platforms-through-facebook-ads/']

{'pulse_id': '65e0cc22a43a74523fa3eae6', 'indicators': [{'id': 6822610, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'makeyourpay.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3014338541, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'satin1.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3053455880, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'auproject.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3053507061, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'mipinves.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3072356888, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'futtes.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3100504872, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'groovetonprogramz.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3125077948, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'duums.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3473938225, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'rslimess.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3476605892, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'newprogrms.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3489160188, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'esbopehan.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3784995066, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'sej.progmedisd.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3824147010, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'getyourapi.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3830383122, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'adin.czproftes.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3836681197, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'sun.autotrdes.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062095, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'badanie-pl.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062096, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'blog-vcnews.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062097, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'capital-inwest.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062098, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'crypto-payer.co', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062099, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'dasms.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062100, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'gernik.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062101, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'kingsman-adv.org', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062102, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'mixx-today.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062103, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'oksitepl.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062104, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'onlinedietslimm.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062105, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'prostprogr.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062106, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'sunproflts.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062107, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'ultra-vest.one', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062108, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'bwn.objectop.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062109, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'goiin.baltez-offic.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062110, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'hmz.coivalop.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062111, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'land-nutra.b36cname.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062112, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'new.xsdelx.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062113, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'news.beneffit.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062114, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'processing.betatransfer.io', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062115, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'qiwi.bppsa.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062116, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'sci.pointpayment.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062117, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'visa.lukzev.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3848062118, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2024-02-29T18:25:38', 'indicator': 'ymoney.bppsa.com', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 38}

e2cce3b692fc020a6594c07912e0769cb00e91d51bfe9977b6d4ccee2863ca6c

2026-06-04 16:17:11.783343+03:00

2026-06-04 16:17:11.783343+03:00

65b915078b79508127f170a9

2bcf087a676ec992ef9652a87b4dbce1

FileHash-MD5

Uncovering Atomic Stealer (AMOS) Strikes and the Rise of Dead Cookies Restoration

CRIL Analyzes An Ongoing Phishing Campaign Spreading An Updated Version Of Atomic Stealer Targeting Mac Users.

2024-01-30 15:25:58.946000+03:00

2024-02-29 15:01:48.793000+03:00

['amos', 'google chrome', 'atomic stealer', 'stealer', 'malware', 'grabber', 'xehook', 'md5 sha1', 'macos']

['AMOS', 'Xehook', 'Atomic']

['https://cyble.com/blog/uncovering-atomic-stealer-amos-strikes-and-the-rise-of-dead-cookies-restoration/']

{'pulse_id': '65b915078b79508127f170a9', 'indicators': [{'id': 3832529355, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': '2bcf087a676ec992ef9652a87b4dbce1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529356, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': 'ac1a958ea6449450fbfa5cb9a6bb197a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529357, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': 'd4e2a4bace502bfc1b7449fee9c9ba28', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529358, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': 'e54ed20eee6bd88883adb71856e49595', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529359, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': '0505a3b7683aaff50b9f4214e259b519bc27bc6c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529360, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': '27b6afc6f57850644f3ceffcb06406f5d699592e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529361, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': '34c66a2bb9e791dec6156f8bc7a41bf592cf47fd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529362, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': 'a2db69f7015a25bc5776d1db9235c38b8246ecda', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529363, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': '3805cb7589da01a978e899fd4a051adec083c8543343ce637e448716cbbbcef1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529364, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': '401c113bc24701e80468047974c19c3b7936e4d34a6625ce996c12d1639de3ba', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529365, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': '59060a3cf38453225891c7c9871d867340f95d027c910ede1f14947dda983a19', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529366, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': '705b899bcf83311187021a29369e5344bf4477579a3e7485055d1fe8e0efcbb3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529367, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': 'f81f1dfc07e5b84cd158ed24ec60ac43a2d2427835d4d1a21b8f8622b7b706a6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529368, 'role': None, 'type': 'YARA', 'title': '', 'content': 'rule Atomic_Stealer { meta: author = "Cyble Research and Intelligence Labs" description = "Detects Atomic_Stealer files" date = "2024-01-16" os = "MacOS" hash = "59060a3cf38453225891c7c9871d867340f95d027c910ede1f14947dda983a19" strings: $a1 = "FileGrab" ascii nocase $a2 = "find-generic-password -ga" ascii nocase $a3 = "Cookies.binarycookies" ascii nocase $a4 = "5.42.65." ascii nocase $a5 = "Binance" ascii nocase condition: uint32(0) == 0xbebafeca and all of them }', 'created': '2024-01-30T15:26:00', 'indicator': '1241ad4f8f667b7a733655b3805ab021486cbce0', 'is_active': 1, 'expiration': None, 'description': 'Detects Atomic_Stealer files'}, {'id': 3832529369, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': 'arcbrowser.pro', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529370, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': 'cleanmymac.pro', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529371, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': 'parallelsdesktop.pro', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3832529372, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2024-01-30T15:26:00', 'indicator': 'pixelmator.pics', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 18}

c9de8c31bc2f736674bba0f9ef6defe76ee11ce7efe75695a1af20dc4d457771

2026-06-04 16:17:11.783343+03:00

2026-06-04 16:17:11.783343+03:00

6634a8d8731e63a10976c584

5c430e2770b59cceba1f1587b34e686d586d2c8ba1908bb5d066a616466d2cc6

FileHash-SHA256

Graph: Growing number of threats leveraging Microsoft API

An increasing number of cyber threats have adopted the use of the Microsoft Graph API to facilitate covert communications with command-and-control infrastructure hosted on Microsoft cloud services. This technique helps attackers blend in with legitimate traffic to cloud platforms and obtain infrastructure at low cost.

2024-05-03 09:05:28.374000+03:00

2024-05-03 09:16:52.515000+03:00

['graphite', 'bluelight', 'espionage', 'ketrican', 'siestagraph', 'bs2005', 'graphican', 'onedrivebirdyclient', 'graphon', 'birdyclient']

['Graphite', 'Ketrican', 'SiestaGraph', 'Graphon', 'BirdyClient', 'Graphican', 'Bluelight']

['https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/graph-api-threats']

{'pulse_id': '6634a8d8731e63a10976c584', 'indicators': [{'id': 3190340782, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': '5c430e2770b59cceba1f1587b34e686d586d2c8ba1908bb5d066a616466d2cc6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3265503767, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': '470cd1645d1da5566eef36c6e0b2a8ed510383657c4030180eb0083358813cd3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3266121543, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': 'ff81a65150e318c1ffbeaba7a56bb09f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3266121545, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': 'a210fed76436c11d14629947f9918061d81d3263', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3363158951, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': 'f229a8eb6f5285a1762677c38175c71dead77768f6f5a6ebc320679068293231', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3363382337, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': '0ff09c344fc672880fdb03d429c7bda4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3363382338, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': '10d02cf4a73b73628c258d69dbd1a400631e0eb9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3602190548, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': '1a87e1b41341ad042711faa0c601e7b238a47fa647c325f66b1c8c7b313c8bdf', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3602190556, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': '7fc54a287c08cde70fe860f7c65ff71ade24dfeedafdfea62a8a6ee57cc91950', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3635619437, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': 'a78cc475c1875186dcd1908b55c2eeaf1bcd59dedaff920f262f12a3a9e9bfa8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3700277841, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': 'cc8882dfd58b69cbc341065d29f9c1e9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3700277854, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': 'c8fbb7c0522a092239ca1eacf7a08e850fbea630', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3700277858, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': '02e8ea9a58c13f216bdae478f9f007e20b45217742d0fbe47f66173f1b195ef5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3700277864, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': '4b78b1a3c162023f0c14498541cb6ae143fb01d8b50d6aa13ac302a84553e2d5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3700445061, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': '3bcdb533dd95f15cd3b6953829dc481e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3700445062, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': '5222eb4ee7842919dbc827ed1f83b61c32bf2a54', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3700445064, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': 'f4840cb32f5a10fb9930ffb48095df30', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3700445065, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': 'd100ed0899ad0a669bfce037d449687aa35b85ac', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3759653530, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': 'fe8f99445ad139160a47b109a8f3291eef9c6a23b4869c48d341380d608ed4cb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3882962621, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': 'e3886a3f4e671704e306c08d1de3601c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3882962622, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': '2da52586e89a60daf38d72fdcab6b4c4874f653a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3882962623, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2024-05-03T09:05:29', 'indicator': 'afeaf8bd61f70fc51fbde7aa63f5d8ad96964f40b7d7fce1012a0b842c83273e', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 22}

9d576151a3a7f27b638b9718d261b2b143ddff34ae244a109713fb309d972106

2026-06-04 16:17:11.462594+03:00

2026-06-04 16:17:11.462594+03:00

6a1a7e87ef88fc3d7707a033

oob.moika.tech

hostname

Malicious npm packages abuse dependency confusion to profile developer environments

Microsoft Threat Intelligence identified an active supply chain attack involving malicious npm packages that employ dependency confusion techniques. Between May 28-29, 2026, a threat actor using three maintainer aliases published malicious packages across nine organizational scopes that mirror real corporate namespaces. The packages execute obfuscated reconnaissance payloads through npm lifecycle hooks, collecting system information, environment variables, and developer credentials. All packages connect to the same command-and-control server and deploy a 17KB JavaScript dropper designed for environment fingerprinting. The campaign includes platform-specific payloads for Windows, macOS, and Linux, with CI/CD detection bypass capabilities. The architecture operates in reconnaissance-only mode but supports server-side toggling for full exploitation. Forensic analysis indicates all three accounts are operated by a single individual, evidenced by shared C2 infrastructure, identical hardcoded authentication toke...

2026-05-30 06:07:03.273000+03:00

2026-06-02 09:35:15.651000+03:00

['dependency confusion', 'reconnaissance payload', 'environment fingerprinting', 'lifecycle hooks', 'credential theft', 'npm supply chain', 'obfuscation', 'ci/cd targeting']

[]

['https://www.microsoft.com/en-us/security/blog/2026/05/29/33-malicious-npm-packages-abuse-dependency-confusion-profile-developer-environments/']

{'pulse_id': '6a1a7e87ef88fc3d7707a033', 'indicators': [{'id': 4383394475, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'oob.moika.tech', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385126227, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'https://oob.moika.tech/payload/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385127388, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'https://docs.cloudplatform-single-spa.io/platform/svp-baas', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385127389, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'https://github.cloudplatform-single-spa.io/platform/svp-baas.git', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385127391, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'https://oob.moika.tech/payload', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385127392, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'https://oob.moika.tech/payload/linux`', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385127393, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'https://oob.moika.tech/payload/mac`', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385127394, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'https://oob.moika.tech/payload/win`', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385127395, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'capibar.chat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385127396, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'cloudplatform-single-spa.io', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385127397, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'docs.cloudplatform-single-spa.io', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385127398, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'docs.t-in-one.io', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385127399, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'github.cloudplatform-single-spa.io', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385127400, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'jira.cloudplatform-single-spa.io', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385127401, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'jira.t-in-one.io', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385127402, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-30T06:07:04', 'indicator': 'npm.t-in-one.io', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 16}

d1f3c03a7afecc2282b3fbd53fdd3744ec60f3d909b53e56579c5e4651923e6a

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a1ac91f182b86c3c2bcfc15

helpdock.top

domain

Nimbus RAT: How Threat Actors Are Abusing Microsoft Teams and Google Drive to Deploy a Java RAT

In April 2026, threat actors deployed Nimbus RAT against a legal industry target using Microsoft Teams voice phishing. The attack began with email bombing (282 emails in 90 minutes), followed by a fake IT helpdesk contact via Teams who convinced the victim to grant Quick Assist remote access. Within 20 minutes, a Java-based RAT was deployed that uses Google Drive and Google Sheets for command-and-control, making network traffic appear benign. Analysis of 1,540 suspicious Teams messages across 172 customer environments over 12 months revealed 65% originated from throwaway onmicrosoft.com tenants with IT-themed names. The malware bundles its own Java runtime, implements two credential theft mechanisms, and allows in-memory second-stage code execution. Post-compromise targeting included Signal Desktop attachments and Outlook mailboxes.

2026-05-30 11:25:19.600000+03:00

2026-06-02 09:35:48.744000+03:00

['vishing', 'quick assist', 'email bombing', 'microsoft teams', 'google drive c2', 'java rat', 'social engineering', 'nimbus rat']

['Nimbus RAT']

['https://www.esentire.com/blog/nimbus-rat-how-threat-actors-are-abusing-microsoft-teams-and-google-drive-to-deploy-a-java-rat']

{'pulse_id': '6a1ac91f182b86c3c2bcfc15', 'indicators': [{'id': 4348910541, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-30T11:25:20', 'indicator': 'helpdock.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4348910542, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-30T11:25:20', 'indicator': 'scanseq.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4348910543, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-30T11:25:20', 'indicator': 'serviceprohub.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4348910544, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-30T11:25:20', 'indicator': 'system-clean.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385210256, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-30T11:25:20', 'indicator': '44f6101dd8171133f53317bfd752300e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385210257, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-30T11:25:20', 'indicator': 'fab69acd743f4111b749e3268690825c38822e62', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385210258, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-30T11:25:20', 'indicator': '91e523a46f3bb860ac2e5800b7e1ec89d75a2408410b9cd25eebc17c8d7a92bc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385210259, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-30T11:25:20', 'indicator': '99813f3d0625e880158c68039c0e2fbf488db0be3db77cd1ce6d382644193f0e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385210260, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-30T11:25:20', 'indicator': '9e5b1e10ad6904d3f5b48d38470cd57263974640a27d13cf793ef026d3d6b886', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385210261, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-30T11:25:20', 'indicator': 'info-secure.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385210263, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-30T11:25:20', 'indicator': 'scan-security.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385210264, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-30T11:25:20', 'indicator': 'updt-scansecurity.top', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 12}

dd404f9cc51891eaeb1b922adb80a7857cb86ec63147d8c8fd33f42b4e75cd7f

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

5c1a9473bd512e3218e08f1c

c1c80e237f6fbc2c61b82c3325dd836f3849ca036a28007617e4e27ba2f16c4b

FileHash-SHA256

Phishing Diplomacy

Beginning in April of 2015, Area 1 Security’s active sensors and research team began observing technical artifacts of a cyber campaign directed at Intergovernmental Organizations, Ministries of Foreign Affairs and Ministries of Finance, as well as trade unions and think tanks.

2018-12-19 18:56:51.830000+03:00

2018-12-19 18:56:51.830000+03:00

['china', 'plugx']

[]

['https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf']

{'pulse_id': '5c1a9473bd512e3218e08f1c', 'indicators': [{'id': 1593585168, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2018-12-19T18:56:53', 'indicator': 'c1c80e237f6fbc2c61b82c3325dd836f3849ca036a28007617e4e27ba2f16c4b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1593587828, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2018-12-19T18:56:53', 'indicator': '2ca739538e18ce6f881694d99f6e22e9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1593589021, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2018-12-19T18:56:53', 'indicator': '88222c4fe9b9af8300b135229ad7b3303c299aab', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1596418396, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2018-12-19T18:56:53', 'indicator': '205408245657-eg0r569euk8qef5nkab52b01cl5i3nn5.apps.googleusercontent.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1596418397, 'role': None, 'type': 'YARA', 'title': '', 'content': 'rule Area1_SSF_GoogleSend_Strings { \n strings: \n $conf = "RefreshToken.ini" wide \n $client_id = "Enter your client ID here" wide \n $client_secret = "Enter your client secret here" wide \n $status = "We are going to send" wide \n $s1 = { b8 00 01 00 00 f0 0f b0 23 74 94 f3 90 80 3d ?? ?? ?? ?? 00 75 ?? 51 52 \n 6a 00 e8 ?? ?? ?? ?? 5a 59 b8 00 01 00 00 f0 0f b0 \n 23 0f ?? ?? ?? ?? ?? 51 52 6a 0a e8 ?? ?? ?? ?? 5a 59 eb c3 } \n condition: \n uint16(0) == 0x5a4d and all of them \n }', 'created': '2018-12-19T18:56:53', 'indicator': '6d867465d69cb1eab1320ee33e480837edd202e9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1596418398, 'role': None, 'type': 'YARA', 'title': '', 'content': 'rule Area1_SSF_PlugX { \n strings: \n $feature_call = { 8b 0? 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6a 07 6a \n ff ff d0 8b f0 85 f6 74 14 } \n $keylogger_reg = { 8b 4d 08 6a 0c 6a 01 8d 55 f4 52 c7 45 f4 01 00 06 00 c7 45 f8 \n 00 01 00 00 89 4d fc ff d0 85 c0 75 1d } \n $file_op = { 55 8b ec 83 ec 20 0f b7 56 18 8b 46 10 66 8b 4e 14 89 45 e4 8d 44 32 \n 10 66 89 4d f0 0f b7 4e 1a 57 89 45 e8 33 ff 8d 45 e0 8d 54 31 10 50 89 7d e0 89 55 \n ec c7 45 fa ?? ?? ?? ?? 89 7d f2 89 7d f6 ff 15 1c 43 02 10 } \n $ver_cmp = { 0f b6 8d b0 fe ff ff 0f b6 95 b4 fe ff ff 66 c1 e1 08 0f b7 c1 0b c2 \n 3d 02 05 00 00 7f 2c } \n $regedit = { c7 06 23 01 12 20 c7 46 04 01 90 00 00 89 5e 0c 89 5e 08 e8 51 fb ff \n ff 8b 4d 08 8b 50 38 68 30 75 00 00 56 51 ff d2 } \n $get_device_caps = { 8b 1d ?? ?? ?? ?? 6a 08 50 ff d3 0f b7 56 12 8b c8 0f af ca \n b8 1f 85 eb 51 f7 e9 c1 fa 05 8b c2 c1 e8 1f 03 c2 89 45 f8 8b 45 f0 6a 0a 50 ff d3 \n 0f b7 56 14 8b c8 0f af ca b8 1f 85 eb 51 } \n condition: \n 3 of them \n }', 'created': '2018-12-19T18:56:53', 'indicator': 'bd0b59e95d5fb3609f465496508ccac0cf4e9843', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1596418399, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2018-12-19T18:56:53', 'indicator': 'b65c57a380a1df69e61462e814575bf93a8ea5772621c1f19ccfff5bdd6a3e8f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1596418400, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2018-12-19T18:56:53', 'indicator': 'updates.organiccrap.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1596418401, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2018-12-19T18:56:53', 'indicator': '1d8f21039c629d08c65e9766691483fd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1596418402, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2018-12-19T18:56:53', 'indicator': '232c85f65de1ef2cab812f01f3761d49', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1596418403, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2018-12-19T18:56:53', 'indicator': 'cba2271cc819101718a9460886ae47c2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1596418404, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2018-12-19T18:56:53', 'indicator': '46836a597b3213683986d68c2a7df6027fd4e1f1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1596418405, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2018-12-19T18:56:53', 'indicator': 'ccfa460974d270e26688de917811cc483035e09e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1596418406, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2018-12-19T18:56:53', 'indicator': 'd6e884fb2021f7852a68b84ddedd7e3764f4f1d7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1596418407, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2018-12-19T18:56:53', 'indicator': 'dce0f3d5a537b722efaa0f4f6f817e1b5b97248b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1596418408, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2018-12-19T18:56:53', 'indicator': 'ed8b0b999b516b2488991f763894199e7a1447d7', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 16}

92bd31c29ddc1501244e831757265f6ae4114c5e47336ce04c9abfafa56e487c

2026-06-04 16:17:14.448989+03:00

2026-06-04 16:17:14.448989+03:00

6a1dde5fb26dd1b1cbbdb913

ztds.info

domain

A New Threat Actor Using ClickFix and Fake Update Drive-By Attacks in Thousands of Compromised Sites

A sophisticated threat actor named DriveSurge operates as an Initial Access Broker using a Pay-Per-Install model to deliver malware at scale. The actor compromises thousands of legitimate websites and uses zTDS (Traffic Distribution System) to silently redirect visitors to malicious content. Victims encounter either FakeUpdates campaigns that impersonate browser update prompts for 11 different browsers, or ClickFix attacks that trick users into executing malicious commands through fake error messages. DriveSurge's infrastructure utilizes bulletproof hosting services, primarily NiceNIC registrar, and has been operating since at least 2015. The campaigns target both Windows and macOS systems, employing sophisticated obfuscation techniques and clipboard hijacking to achieve infection. Eight technical fingerprints have been identified to track this actor's infrastructure and activities.

2026-06-01 19:32:47.991000+03:00

2026-06-02 09:31:04.934000+03:00

['initial access broker', 'fakeupdates', 'ztds', 'browser impersonation', 'clickfix', 'bulletproof hosting']

[]

['https://www.silentpush.com/blog/drivesurge/?utm_source=rss&utm_medium=rss&utm_campaign=drivesurge']

{'pulse_id': '6a1dde5fb26dd1b1cbbdb913', 'indicators': [{'id': 3040723656, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'ztds.info', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3807580502, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': '91.92.240.127', 'is_active': 1, 'expiration': '2026-07-01T19:00:00', 'description': ''}, {'id': 3990416616, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': '46.226.166.57', 'is_active': 1, 'expiration': '2026-07-01T19:00:00', 'description': ''}, {'id': 4178418242, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'cptoptious.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4183727182, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'captioto.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4237422277, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'newtdsone.shop', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4278931974, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'maxintora.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4284342489, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'check.first-node.rocks', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4284342603, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'testio.ecartdev.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4294974471, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'webgleam.info', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4299628963, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'brightson.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4299628965, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'datumprobe.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4299628966, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'keyview.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4299628968, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'traceglimpse.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4299628969, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'coverlink.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4299628970, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'tracekey.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134215, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': '0ca424475803a1cb54908a81a00bd93f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134216, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'f3926add1a4531ff324a6acb57d40769', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134217, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'a4f0014474278238b5fe78fc2c4182b498012a33', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134218, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': '0c62c11e910d7c0d6b6c9800b70e78bfd9220e1f78bd7bb34ae4c3646d05f6e5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134219, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': '29ac78c51bcdfe68c64830bdeb6e41437dd55e2691149741c9b78be03b6c82ea', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134220, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': '428bd0b0ac36dfdd223b3953dbe61c0baf227f893310b03e7afe3111462019c6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134221, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': '7aa15de93cf85729ddf970e8d7897f69ece3ca29608f73e784a9ba40c9cea18d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134222, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': '90aecb370dfb1a99a1f7de0a9c6842ab1b664521fddea16b0ec9a91f322646fc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134223, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'a84b032b49773c2318b11b1164d1aada69e940229aedbf8185c33fc7dd1d2cdf', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134224, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': '147.45.42.200', 'is_active': 1, 'expiration': '2026-07-01T19:00:00', 'description': ''}, {'id': 4385134225, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': '147.45.42.205', 'is_active': 1, 'expiration': '2026-07-01T19:00:00', 'description': ''}, {'id': 4385134226, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'http://bseolized.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134228, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'beacontrace.bond', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134229, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'bseolized.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134230, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'eraggifts.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134231, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'jcdlforwarding.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134232, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'jclforwarding.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4385134233, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:32:48', 'indicator': 'ycyfugihih.cfd', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 34}

7e2773d70b1c33bbaecd305052f3d78b723362b3cad069acaed8f6041a544250

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a1dde0927ce7587f79534ee

CVE-2018-20250

CVE

FSB’s matryoshka #1/3 – Gamaredon’s gifts that keeps unpacking – GammaPhish and GammaWorm

Gamaredon, a cyberespionage group operated by Russia's FSB, conducts long-term intrusion operations targeting Ukrainian government, military, and critical infrastructure. This analysis documents their 2026 infection chain, which uses HTML smuggling with weaponized xHTML files delivering RAR archives that exploit CVE-2025-8088 to extract HTA files into Windows Startup directories. The chain deploys GammaPhish for initial access, GammaLoad for staging, GammaWorm for propagation via USB and network drives, and GammaSteal for exfiltration. The architecture is nearly fileless, leveraging NTFS Alternate Data Streams to conceal modules and using Dead Drop Resolvers on legitimate platforms like Telegram and Cloudflare for C2 infrastructure. Every stage functions as an independent backdoor capable of executing arbitrary VBScript, representing a shift from their historical Pteranodon framework to a modular ecosystem designed for persistent espionage.

2026-06-01 19:31:21.077000+03:00

2026-06-02 09:24:58.011000+03:00

['gammaworm', 'gammaload', 'pteranodon', 'gamaredon', 'gammasteal', 'gammaphish', 'fsb']

['GammaPhish', 'GammaLoad', 'GammaWorm', 'GammaSteal', 'Pteranodon - S0147', 'Pterodo']

['https://blog.sekoia.io/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm/']

{'pulse_id': '6a1dde0927ce7587f79534ee', 'indicators': [{'id': 1678504708, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-06-01T19:31:21', 'indicator': 'CVE-2018-20250', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4118610414, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-06-01T19:31:21', 'indicator': 'CVE-2025-8088', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4160731132, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-06-01T19:31:21', 'indicator': 'iiwdsxwamylbwwsoyrmj.supabase.co', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4172308707, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-06-01T19:31:21', 'indicator': 'quitethepastry.ru', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4389548584, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-06-01T19:31:21', 'indicator': '1794369214b7f62e70a0485e61335c61', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4389548585, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-06-01T19:31:21', 'indicator': '8e1624d110c090ff57d4b493a9107c66', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4389548586, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2026-06-01T19:31:21', 'indicator': '104.194.140.6', 'is_active': 1, 'expiration': '2026-07-01T19:00:00', 'description': ''}, {'id': 4389548587, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-06-01T19:31:21', 'indicator': 'https://efficiency-planes-emotions-fascinating.trycloudflare.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4389548589, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-06-01T19:31:21', 'indicator': 'https://moment-cat-qld-place.trycloudflare.com/sylvilagus', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4389548590, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-06-01T19:31:21', 'indicator': 'https://quitethepastry.ru', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4389548591, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-06-01T19:31:21', 'indicator': 'efficiency-planes-emotions-fascinating.trycloudflare.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4389548592, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-06-01T19:31:21', 'indicator': 'moment-cat-qld-place.trycloudflare.com', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 12}

5e971487bc8d098e71dbb932eb13a8d1b400723b6ea02d0f77257f208cd7b997

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a1dde0e4e662ca1f8b4b0b2

2bec18af5f0f9cbe8949cc2bf5466dc6

FileHash-MD5

Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages

A supply chain attack compromised multiple @redhat-cloud-services npm packages, executing malicious payloads automatically during installation via preinstall hooks. The attack uses AES-GCM encrypted payloads and obfuscated JavaScript loaders to harvest GitHub Actions secrets, npm tokens, cloud credentials (AWS, Azure, GCP), Kubernetes and Vault material, SSH keys, Git credentials, and cryptocurrency wallet files. The payload can daemonize on developer workstations, includes Russian-locale avoidance mechanisms, and exfiltrates stolen data through encrypted HTTPS channels with GitHub API fallback mechanisms. The campaign employs tactics similar to the publicly released Shai-Hulud toolkit, though attribution remains unclear due to the availability of open-source attack tooling.

2026-06-01 19:31:26.541000+03:00

2026-06-02 09:20:56.597000+03:00

['supply chain attack', 'npm compromise', 'ci/cd targeting', 'shai-hulud']

['Shai-Hulud', 'TrapDoor']

['https://socket.dev/blog/mini-shai-hulud-campaign-hits-red-hat-cloud-services-npm-packages']

{'pulse_id': '6a1dde0e4e662ca1f8b4b0b2', 'indicators': [{'id': 4389548603, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-06-01T19:31:27', 'indicator': '2bec18af5f0f9cbe8949cc2bf5466dc6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4389548604, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-06-01T19:31:27', 'indicator': 'd07ec47042a05fe3d684f72d2155d180', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4389548605, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-06-01T19:31:27', 'indicator': '0dc06ecdaa63fe24859cfd955053c23245c536e4733480239d14bebf12688e35', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4389548606, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-06-01T19:31:27', 'indicator': '21b6409a7b84446310daca5409ad6112ac60a1e4bef97736e53fff5f63bfdef4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4389548607, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-06-01T19:31:27', 'indicator': '88896d478986d453f5da79b311de39d9b4b1bea95c21af1d8ef181b0f4e52fe9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4389548608, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-06-01T19:31:27', 'indicator': 'ac2a2208e1726e008be6c73dc0872d9bba163319259dff1b62055ac933ca46b6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4389548609, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-06-01T19:31:27', 'indicator': 'ee262510cb246d2b904991aee7fc61162bdae34463439ec6383bd5356479d362', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 7}

fcf261def0d9d70d1d013cb2c81b313cfd57ee5d08801beee62f3317b49dc8ff

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a19acf8d896b3c89d4bab6f

4479c73e0c28a00debd8fae5963d5af0

FileHash-MD5

Operation Dragon Weave: Uncovering a China-Linked Campaign Targeting Czech Republic and Taiwan Using Azure Cloud C2

A sophisticated cyber-espionage campaign attributed to China-linked actors targets officials and citizens in Czech Republic and Taiwan through spearphishing attacks. The operation deploys malicious ZIP archives containing dual infection paths that ultimately deliver AZUREVEIL, an Adaptix C2 agent. The campaign uniquely leverages Microsoft Azure Blob Storage as a dead-drop command-and-control channel, bypassing traditional C2 infrastructure. A multi-stage infection chain employs RUSTCLOAK, a Rust-based loader implementing triple-layer encryption using modified RC4, Base64, and SM4-CBC algorithms. The final payload supports 36 post-exploitation commands including Beacon Object File execution in memory, file system manipulation, process control, network pivoting, and data exfiltration. Lure documents impersonate official communications from Taiwanese research institutions and Czech Social Security Administration, demonstrating targeted social engineering tailored to each region.

2026-05-29 15:12:56.411000+03:00

2026-06-01 09:49:14.439000+03:00

['china-linked', 'taiwan', 'dll sideloading', 'spearphishing', 'azureveil', 'adaptix agent', 'rustcloak', 'adaptix', 'czech republic', 'bof execution', 'azure cloud c2']

['RUSTCLOAK', 'AZUREVEIL', 'Adaptix']

['https://www.seqrite.com/blog/operation-dragon-weave-uncovering-a-china-linked-campaign-targeting-czech-republic-and-taiwan-using-azure-cloud-c2/']

{'pulse_id': '6a19acf8d896b3c89d4bab6f', 'indicators': [{'id': 4384468278, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': '4479c73e0c28a00debd8fae5963d5af0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384468279, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': '9378a8075f26ab0f2a3add6d97eb0533', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384468280, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': '04f7126031fe11475e0b24ce5298ecd6e56ec363', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384468281, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': '6f569139805e4ca507dc6fc2f1cb880beb3d7ac7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384468282, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': '02542a49b3bd6bd2795afb67840acb4557b17e017f7503dd03ebe3aeeb28720e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384468283, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': '047687548605734348792e2a9d771b6cba42facd0d0d7d44d778290a25848574', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384468284, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': '080ab9bc2893ba7bad354551604a667af40ed2ae2d042d2323c2bd9ad3122192', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384468285, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': '096372d19b4787e989f44e04c5ecc29885aa927c34ae8666628d6c0eb20bb447', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384468286, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': '1c56228cbd1bdebb9e5ea55c2749150fee06c865ede4a3754e8bd6843e51d2d4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384468287, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': '24aa4e780ccd66cef13da9ef98c32954105cf2a32ec643efab0ba1aa2d6352f4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384468288, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': '5ed14c2b7f7433a1a72dd6b668413f935a217ba10b69d89b774a82990fa12fe1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384468289, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': '61f7d9cd2d8ce7df950639b23ce90085b300b0c6dd0d8d934bba8fdecb670f15', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384468290, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': '783661d0f7edb338d2d50be087764d82dbbc9ee7989ddc57db1801e4ec9045b0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384468291, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': '823d5969db3f3b72ebbdce1b78752717ea849884a0fb40d86146416c38e128de', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384468292, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': '8ae7c82a3e4f742777e590b25a1c563d19bd9bcba2a387d004aae72c4b2828f9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384468293, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-29T15:12:57', 'indicator': 'a4e9f9919d62589b57cfa08c9ccb89e386b09f683271373413cd8e8c8c7d1c5a', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 16}

8ce1dfd23f79cf3b3f9a6df102556fa8036723e94a8e3f4c6561a1cf345cd9a8

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a1a2dd905d9f8c4474cb45e

5b3089eefab0e043af8894de86022bdc6df2f42f7098dbd530f42c0ec861d5d8

FileHash-SHA256

Reloaded in a modern Remcos RAT Infection

Analysts discovered a new Remcos RAT infection chain starting with a batch file executing encoded commands that creates hidden directories and retrieves encrypted payloads. Unlike earlier campaigns relying on PowerShell-hosted .NET loaders, this variant incorporates DonutLoader shellcode and AutoIt-based staging for in-memory payload delivery. The infection begins with a phishing email containing a malicious batch file named Bestellung.CMD. The chain abuses legitimate Windows utilities including cscript.exe and SyncAppvPublishingServer.vbs to execute Base64-encoded payloads. Additional components are downloaded from cloud storage, including 7Zip tools and password-protected archives containing obfuscated JScript. The final payload consists of DonutLoader shellcode that injects Remcos RAT version 7.2.1 Pro into colorcpl.exe, enabling remote control, credential harvesting, keystroke logging, and additional payload deployment.

2026-05-30 00:22:49.162000+03:00

2026-06-01 09:47:07.737000+03:00

['shellcode', 'autoit', 'process injection', 'donutloader', 'lolbins', 'in-memory execution', 'phishing', 'remcos rat']

['Remcos RAT', 'DonutLoader']

['https://blog.gdatasoftware.com/2026/05/38426-donutloader-remcos-rat']

{'pulse_id': '6a1a2dd905d9f8c4474cb45e', 'indicators': [{'id': 4288057056, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-30T00:22:49', 'indicator': '5b3089eefab0e043af8894de86022bdc6df2f42f7098dbd530f42c0ec861d5d8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384991938, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-30T00:22:49', 'indicator': '14a0d7978872a2739ac31ef42539e8c708af6afccc5eb74f22fe2b676bfa2df7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384991939, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-30T00:22:49', 'indicator': '48bd36c3b8d6a3bf5db4e7b0bbc1692e8cb900475dc7ae16e9f1fa7ba97c8adf', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4384991940, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-30T00:22:49', 'indicator': 'b9da295c34accf3632c2c4b6d9e3c74791b4514d27814f79e9bcb77ce168a347', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 4}

62a69f0cf85d39b2444dacae941a6b7714b294c12dc1271b7899ce763bd3187c

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69f06bcd55d11c96e260dbdd

eb89f018e6c3a8e9de0a0452acb16e76

FileHash-MD5

OT-Focused Malware Highlights Emerging Risk to Water Infrastructure Systems

ZionSiphon is operational technology-focused malware targeting water treatment and desalination facilities in Israel. The sample demonstrates ICS-awareness through industrial protocol interaction capabilities including Modbus, with incomplete support for DNP3 and S7comm. It incorporates geographic and environmental validation controls designed to restrict execution to Israeli water infrastructure systems. The malware attempts persistence through registry autorun entries, privilege escalation, and removable media propagation. Functionality includes network discovery of industrial devices, process manipulation targeting chlorine dosing and flow control, and configuration file modification. A critical validation flaw prevents successful execution, suggesting the analyzed sample represents incomplete development or testing. Embedded pro-Iran and anti-Israel messaging indicates politically motivated intent, though no specific threat actor attribution exists.

2026-04-28 08:11:57.757000+03:00

2026-04-28 13:54:13.697000+03:00

['desalination', 'modbus', 'removable_media_propagation', 'ics_targeting', 'water_treatment', 'dnp3', 'geographic_filtering', 'zionsiphon', 'chlorine_dosing', 's7comm', 'process_control']

['ZionSiphon']

['https://blog.polyswarm.io/zionsiphon-ot-focused-malware-highlights-emerging-risk-to-water-infrastructure-systems']

{'pulse_id': '69f06bcd55d11c96e260dbdd', 'indicators': [{'id': 4314808398, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-28T08:11:58', 'indicator': 'eb89f018e6c3a8e9de0a0452acb16e76', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4314808399, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-28T08:11:58', 'indicator': '7cdcb8f372ceb7f5d3c178d9649080106a932f9e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4314808400, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-28T08:11:58', 'indicator': '07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 3}

08cf43c4083382ac2e99fe1f787ba8f52a46a7ba53c57ef44f77ed9dbfd70f9d

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a1cc51d7c8f832f819a0a43

191.96.225.241

IPv4

A stealthy RAT burrowing deep into Android devices

BTMOB is an Android remote access trojan that evolved from SpySolr malware and poses significant threats beyond traditional banking trojans. The malware combines phishing-led delivery with an APK builder interface that enables rapid payload generation without coding skills. Distributed through fake app stores impersonating streaming services, cryptocurrency platforms, and government agencies, BTMOB abuses Android Accessibility Services to gain elevated permissions. Marketed as malware-as-a-service with a reported $5,000 lifetime license, it provides adversaries with capabilities to exfiltrate sensitive data, capture screenshots, record device activity, and establish remote control. The tool's customizable phishing lures have been adapted for specific regions, including campaigns impersonating Argentine tax authorities, making it a rapidly evolving threat with global reach.

2026-05-31 23:32:45.408000+03:00

2026-06-01 08:34:17.132000+03:00

['android rat', 'latin america', 'phishing campaigns', 'spysolr evolution', 'apk builder', 'remote access', 'brazil', 'accessibility abuse', 'malware-as-a-service', 'spysolr', 'btmob']

['BTMOB', 'SpySolr']

['https://www.welivesecurity.com/en/malware/btmob-stealthy-rat-burrowing-deep-android-devices/']

{'pulse_id': '6a1cc51d7c8f832f819a0a43', 'indicators': [{'id': 3493184913, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '191.96.225.241', 'is_active': 1, 'expiration': '2026-06-30T23:00:00', 'description': ''}, {'id': 3495353320, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '191.96.79.41', 'is_active': 1, 'expiration': '2026-06-30T23:00:00', 'description': ''}, {'id': 3495353422, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '191.96.79.133', 'is_active': 1, 'expiration': '2026-06-30T23:00:00', 'description': ''}, {'id': 3507825804, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '200.9.155.153', 'is_active': 1, 'expiration': '2026-06-30T23:00:00', 'description': ''}, {'id': 3507888353, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '191.96.224.87', 'is_active': 1, 'expiration': '2026-06-30T23:00:00', 'description': ''}, {'id': 3636019050, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '191.96.78.172', 'is_active': 1, 'expiration': '2026-06-30T23:00:00', 'description': ''}, {'id': 4054717688, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '195.160.221.203', 'is_active': 1, 'expiration': '2026-06-30T23:00:00', 'description': ''}, {'id': 4151383496, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '25e3c200de4868d754a3b4f4f09ec2bf', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4151383499, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '0a542751724a432a8448324613e0ce10393e41739a1800cbb7d5a2c648fcdc35', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4158080617, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '191.96.79.179', 'is_active': 1, 'expiration': '2026-06-30T23:00:00', 'description': ''}, {'id': 4176622433, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': 'arbsniper.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4176622435, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '191.101.131.250', 'is_active': 1, 'expiration': '2026-06-30T23:00:00', 'description': ''}, {'id': 4176622436, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '191.96.78.28', 'is_active': 1, 'expiration': '2026-06-30T23:00:00', 'description': ''}, {'id': 4261460206, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': 'aa56f350882ce63429c6626567487b041f06168bb60f4fc371a262eabadfa660', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4266978241, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '0628ad6d1fd836b13b22e75fa169502d8ce78b7ad20f0261eb5151da98437bca', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200435, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '0f22e6ed962180838c03cb70af8bd66a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200436, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '1011ac97559249522143d32338b08036', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200437, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '26ce4d8ea691bb54864c3455ed6b7620', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200438, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '3673d505d3050503be6f30eb235afcc4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200439, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '38fe4db3b191c2ccb3cd71a36a38b9d6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200440, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '516e0f3e44924d0a5595b4e28728d291', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200441, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '53d007e850871473321f3a4f68ab3615', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200442, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '54ce4a5145402b10b4660312ffe8385f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200443, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '54d37f09251cbe283f42f64964083ca8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200444, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '5652ea26835619fdd6b3609326ba9ea0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200445, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '61c30bd7eb4914eb9419661af821944c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200446, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '7881c012c247d29dbf43b05c8b042cc1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200447, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '7db5fb56b60db0077b86e00eeff37394', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200448, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '7e2ab284b1068420178f0ced7895c064', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200449, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '7f493c8b8c3a1117c90e1f679c782d42', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200450, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '9989b5cf30f42f3ac013b5fb4c898b07', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200451, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': 'a4bd7b38313d8cd94e76a48b83683f57', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200452, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': 'a7a5c56f3549a65fe18ed356c56c595a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200453, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': 'bb02daf9c37f7cd0df5a2ca0c0c1790f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200454, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': 'bfd7d041bdfb28b62921b64af068ccab', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200455, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': 'c09e71fca97d609f48b0de1ffd669454', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200456, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': 'cd882f00cb63cfb382a4fa6013705ca6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200457, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': 'd15a9b899b55b379933871ffb303613a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200458, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': 'd46ba296b0a3894b04597a7c4cd731c7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200459, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': 'dbd8934e2e80890a7067097079a40182', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200460, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '015259747ddb8f227fe56a6d12b0fc7f0dadd20e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200461, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '0198883f685b52ff5adf0f7d2e64adbbf3c9c9da', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200462, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '1cb0d3de945cec63dc0cd00cb4404d48079e565b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200463, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '2de67a7c23d3b96b3dbec9a81cf3e01ebefdeee9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200464, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '3544b924c689b5d93b9452ad4e53bdfe86aef3c3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200465, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '4038a93e767eac600e344ad9707a1c4643f0cb4b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200466, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '5798d4eeb49cb3da09e2236ed3606332412e93e9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200467, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '5c9d9649b439b86cf18987865b32dab228ace037', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200468, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '5cf24613f0c98f8bf7f90a8da6e028c62a2d0a76', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4383200469, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-31T23:32:46', 'indicator': '606c4427da725b5dd7d399cb3177009e66432cc7', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 109}

2eb952db0cd22dded13942c025f45b778b02426e5a5236053d7d3b8f11118a31

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69f36a0940fe2fa665ebe32e

trindastal.com

domain

ClickFix Removes Your Background but Leaves the Malware

BackgroundFix masquerades as a free image-editing tool but functions as a ClickFix social engineering lure. The fake service prompts users to verify they are human, copying malicious commands to their clipboard that invoke finger.exe to retrieve additional payloads. This chain delivers CastleLoader, which subsequently drops NetSupport RAT and a custom .NET stealer dubbed CastleStealer. The loader uses reflective PE injection, API hashing, and ChaCha20-encrypted C2 communications. CastleStealer targets browser credentials, cryptocurrency wallet extensions, and Telegram sessions through DPAPI decryption and Restart Manager APIs. The campaign leverages BYOI tactics with embedded Python interpreters and multiple shellcode stages. A notable implementation flaw exists where launch method 4 references regsrv32.exe instead of the correct regsvr32.exe, causing silent failures.

2026-04-30 14:41:13.982000+03:00

2026-05-30 14:14:55.510000+03:00

['netsupport rat', 'clickfix', 'reflective loader', 'castleloader', 'social engineering']

['CastleLoader', 'NetSupport RAT', 'CastleStealer']

['https://www.huntress.com/blog/clickfix-castleloader-backgroundfix']

{'pulse_id': '69f36a0940fe2fa665ebe32e', 'indicators': [{'id': 4322740300, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'trindastal.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4332245057, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'poronto.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4334031977, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'brionter.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674785, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674786, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'ed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674787, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'f5dbaa09e60343f252a80d4a313a36ac11442d96b0896022d1a83744e3c11feb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674789, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'http://giovettiadv.com:688', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674790, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'http://poronto.com:688', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674791, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'https://brionter.com/4ba0af68-0037-5f6e-afd1-64f89fc0f554/net40.bin', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674792, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'https://obelnamevalf.org/OaTS7yE9zd/default', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674793, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'https://trindastal.com/8250d149-9bf8-566d-9d7d-ea925eae0a4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674795, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'ai-scan.digital', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674796, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'background-off.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674797, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'background-ready.online', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674798, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'backgroundformat.online', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674799, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'bg-go.online', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674800, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'bg-ready.online', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674801, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'bg-removerok.online', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674802, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'bg-transparency.online', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674803, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'cheeshomireciple.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674804, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'giovettiadv.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335674805, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T14:41:14', 'indicator': 'obelnamevalf.org', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 22}

738ac016b1f3447289d63b1aaad08f618295b9f4baa5a0bce612bd7f4e07b4c8

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69f32ac81834d5a878e8fac0

4ec3c90846af6b79ee1a5188eefa3fd21f6d4cf6

FileHash-SHA1

Energy Sector Incident Report

On December 29, 2025, coordinated destructive cyberattacks targeted Poland's energy infrastructure during severe winter weather. Approximately 30 wind and solar farms, a manufacturing company, and a combined heat and power plant serving nearly 500,000 customers were affected. Attackers exploited vulnerable FortiGate perimeter devices using stolen credentials and default passwords to access industrial control systems. Multiple types of wiper malware, including DynoWiper and LazyWiper, were deployed to destroy data across IT and OT environments. While renewable facilities lost communication with distribution operators without affecting electricity generation, the incidents demonstrated significant capability to cause physical disruption. Infrastructure analysis revealed connections to threat clusters known as Static Tundra, Ghost Blizzard, and potentially Sandworm, marking a notable escalation in cyber-sabotage operations.

2026-04-30 10:11:20.255000+03:00

2026-05-30 10:03:42.474000+03:00

['energy sector', 'cve-2024-2617', 'rubeus', 'dynowiper', 'lazywiper', 'destructive operations', 'fortigate exploitation', 'combined heat power', 'impacket', 'renewable energy', 'poland infrastructure', 'industrial control systems', 'wiper attack']

['DynoWiper', 'LazyWiper', 'Impacket', 'Rubeus']

['https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf']

{'pulse_id': '69f32ac81834d5a878e8fac0', 'indicators': [{'id': 4185212586, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '4ec3c90846af6b79ee1a5188eefa3fd21f6d4cf6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200310, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '033cb31c081ff4292f82e528f5cb78a5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200311, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '03816462daba8cc18a6c4531009602c2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200312, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '3b0547c444735dba54ea6fce8539cf15', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200313, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '60c70cdcb1e998bffed2e6e7298e1ab6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200314, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '65099f306d27c8bcdd7ba3062c012d24', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200315, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '68192ca0fde951d973eb41a07814f402', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200316, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '71812ec5e06678096394b238210f0f7c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200317, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '835b0d87ed2d49899ab6f9479cddb8b4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200318, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '8398699ddfc87ddd3e26adb201242160', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200319, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '8759e79cf3341406564635f3f08b2f33', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200320, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'abd2f1b89b2c676d3441a793f65ffaee', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200321, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'bb3d90df04e437486c04e77c411cae4b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200322, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'd1389a1ff652f8ca5576f10e9fa2bf8e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200323, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'e03f5aeb2365c50a51f9088dcede68d5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200324, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'f2b46e610889224bd54583d8a332a464', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190200325, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'f4e9a3ddb83c53f5b7717af737ab0885', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190216979, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190216980, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190216981, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '65099f306d27c8bcdd7ba3062c012d2471812ec5e06678096394b238210f0f7c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4190216982, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'd1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4192840890, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'http://31.172.71.5:44445/TCP', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4192840891, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'http://31.172.71.5:50443/TCP', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4192840892, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'http://31.172.71.5:8008/TCP', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4193021693, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '75fec5afb2deebab6dd9c16d9de35032', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4193021695, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'a727362416834fa63672b87820ff7f27', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4193021696, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'c4379da51e8b9e86ec3de934f9373f4a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4193021700, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '69ede7e341fd26fa0577692b601d80cb44778d93', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4193021701, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '86596a5c5b05a8bfbd14876de7404702f7d0d61b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4193035677, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'http://31.172.71.5:8008', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4193821603, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '033cb31c081ff4292f82e528f5cb78a503816462daba8cc18a6c4531009602c2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335647165, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '4cb091e1adf824f406a315a087fa75fa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335647166, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'ed98c116d49c959383451097ec65c203', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335647167, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '0e7dba87909836896f8072d213fa2da9afae3633', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335647168, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '608a0b34ab3a1625cb88fcbc9a5e4be809519390', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335647169, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': '8759e79cf3341406564635f3f08b2f333b0547c444735dba54ea6fce8539cf15', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335647170, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'f4e9a3ddb83c53f5b7717af737ab0885abd2f1b89b2c676d3441a793f65ffaee', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335647175, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-30T10:11:21', 'indicator': 'http://31.172.71.5:50443', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 38}

1e9e3a1f2e1accb061d602b1cc046bca5e2c0e78a90b795def4aad7378178caa

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69f3241b2759ee934874df9f

obfuscate.io

domain

Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India

The Silver Fox threat group conducted phishing campaigns in December 2025 and January 2026, impersonating tax authorities in India and Russia. Malicious emails contained archives with a modified Rust-based RustSL loader that deployed ValleyRAT backdoor. Over 1600 malicious emails targeted organizations across industrial, consulting, retail, and transportation sectors. During investigation, a previously undocumented Python-based backdoor named ABCDoor was discovered, active since late 2024. The attacks utilized multi-stage infection chains involving encrypted payloads, custom ValleyRAT modules, and various persistence mechanisms including Phantom Persistence technique. ABCDoor features remote control capabilities, screen broadcasting using ffmpeg, and file manipulation functions. The group employed sophisticated evasion techniques including geofencing, string encryption, and mimicking legitimate VPN services.

2026-04-30 09:42:51.123000+03:00

2026-05-30 09:04:01.553000+03:00

['python backdoor', 'silver fox', 'winos 4.0', 'valleyrat', 'ABCDoor']

['ABCDoor', 'ValleyRAT', 'RustSL', 'Winos 4.0']

['https://securelist.com/silver-fox-tax-notification-campaign/119575/']

{'pulse_id': '69f3241b2759ee934874df9f', 'indicators': [{'id': 4068785910, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': 'obfuscate.io', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4166983499, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '3296bd88e0a85ebad4f429878bf8bca16ac43e609133b4781f88a339c37bfe9f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4172139847, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '4fc5ec1de89ce3fcdd3e70db4a9c39d1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4172139849, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '70ae9ca2a285da9005a8acb32dd31ace', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4172139854, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '1d28c9073fb89c09cd34ea3592d6654832e45a14', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4172139863, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': 'fd4dba4c4493e6fe3045f9e47f63b6f8b256ac32', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4172139927, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '4518249127a023adb81d232452395e1506a3766eac1664b8a63c3d0e7dcc2dc2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4172139934, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '4b4dcbd26f08dca7e3e5721f0f5bdc6274e1edc0556e0749a426ec22ff83ca10', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4172139996, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '949b0bea5bd7feab58e280dde49310521920b655714c5f1b7d9de8719373dcd7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4176640019, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': 'b0e06925db5416dfc90babf46402cd6f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4176640034, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': 'a00e86ee1c4a1318ae394d3927d01f5aec74f861', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4176640228, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': 'f0e4d25b9b707be029e915ecb9fe61132cce89e138de36fef5e1edef551d7c25', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4176640241, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': 'http://154.82.81.205/YD20251001143052.zip', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4183410047, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '2c5a1dd4cb53287fe0ed14e0b7b7b1b7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4183410050, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '3c6aec25ebb2d51e1f16c2eef181c82a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4183410060, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '25818cdcfb39eaa22d999d214e6159417cfba72e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4183410069, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': 'bb88f63ba7762b7307251ab0e8bb544ccbaf9b52', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4183410139, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '5d8c7fffc0992639edbca893366f19d5784af2d77e3cfcbaa445a10c503f935a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4183410162, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '795f939f8b9a2d56a3e8a609cab81032d9122a7d56ea852d95cd668f09139a3a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4186644370, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '70016ddbcb8543bdb06e0f8c509ee980', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4186644376, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '8fc911ca37f9f451a213b967f016f1f8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4186644381, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': 'dd0114ffacc6610b5a4a1cb0e79624cc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4186644384, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '0e8c2c75d3dd4b670b8d035d5f645c74f5455c02', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4186644386, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '34d7aa9cf1fceab7f221891f7fbc23157bd9f65b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4186644392, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '9a6c59eaa1d467029c8e1fee651b6d09ddde91e4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4186644470, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '5be9fc4ad9ae3e791d18427f4592c234dfb612aec39b219e8ec57424f61cbab3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4186644500, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '905efac09785631ed57e57a6236b87c04f53b9e0a3bf697df71365814dee6362', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4186644556, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': 'dbfa683cd8c600ed0e90f58eb965ca38b1561fa99d12cb7f252e8608da217df2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4200830131, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '67c87dafb26de3b2b15b93a4ccd291e95682b9adf4ecb083b7c54286245ebd87', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4216642268, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': 'abc.doublemobile.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4228125472, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '44299a368000ae1ee9e9e584377b8757', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4228125474, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': 'a0d1223ca4327aa5f7674bda8779323f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4228125485, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '895aebe2d281e66f87963c01de570286561a0de2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4228125486, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '96ea4a649f67272e305b75401a4045efae91c926', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4241100602, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '1d1f71936db05f67765f442feb95f3fd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4241100621, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': 'd1d78cd1436991adb9c005cc7c6b5b98', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4260940318, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': 'guard.rs', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335639148, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '039e93b98ef5e329f8666a424237ae73', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335639149, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '04194f8ddd0518fd8005f0e87ae96335', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335639150, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '043e457726f1bbb6046cb0c9869dbd7d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335639151, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '06130dc648621e93acb9efb9fabb9651', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335639152, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '0b9b420e3edd2ade5edc44f60ca745a2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335639153, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '0c3b60ffc4ea9ccce744bfa03b1a3556', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335639154, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '1020497bef56f4181aefb7a0a9873fb4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335639155, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '11705121f64fa36f1e9d7e59867b0724', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335639156, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '13669b8f2bd0af53a3fe9ac0490499e5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335639157, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '1aa72cd19e37570e14d898dff3f2e380', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335639158, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '202a5bcb87c34993318cfa3fa0c7ecb0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335639159, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '2375193669e243e830ef5794226352e7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335639160, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-30T09:42:52', 'indicator': '27a3c439308f5c4956d77e23e1aad1a9', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 144}

690e7a62a6af3ef54bb839ed8f6d3bf3bed2e6e5cadf046c7066d243bbd2c2e0

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

645bd040e088b2efacc1d5a3

careitservices.paknvay-pk.net

hostname

SideWinder Uses Server-side Polymorphism to Attack Pakistan Government Officials — and Is Now Targeting Turkey

BlackBerry’s Threat Research and Intelligence team has discovered a new malware campaign by the SideWinder advanced persistent threat group, which has targeted Pakistan government organizations since 2012 and is believed to be targeting Turkey.

2023-05-10 17:11:27.163000+03:00

2023-05-10 17:11:27.163000+03:00

['sidewinder', 'APT', 'phishing', 'polymorphic', 'CVE-2017-0199', 'remote template injection', 'javascript', 'pakistan']

[]

['https://blogs.blackberry.com/en/2023/05/sidewinder-uses-server-side-polymorphism-to-target-pakistan']

{'pulse_id': '645bd040e088b2efacc1d5a3', 'indicators': [{'id': 3349572327, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'careitservices.paknvay-pk.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3383890673, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'mohgovsg.bahariafoundation.live', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3383891040, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'cabinet-gov-pk.ministry-pk.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3432062484, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'mofabn.ksewpk.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3435085816, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'paknavy.paknavy.live', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3461776253, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'paknavy.comsats.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3461776254, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'mofa-gov.interior-pk.org', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3465207313, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'mailaplf.cvix.live', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3473202780, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'navy-mil-bd.jmicc.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3552218554, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'mofadividion.ptcl-gov.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3566661536, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '5.255.104.32', 'is_active': 1, 'expiration': '2023-06-09T16:00:00', 'description': 'CC=NL ASN=AS60404 The Infrastructure Group B.V.'}, {'id': 3595452111, 'role': None, 'type': 'FileHash-MD5', 'title': 'SLF:SCPT:OffRelOleObjectHttp.A', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '666b2b178ce52e30be9e69de93cc60a9', 'is_active': 1, 'expiration': None, 'description': 'MD5 of cd09bf437f46210521ad5c21891414f236e29aa6869906820c7c9dc2b565d8be'}, {'id': 3598111430, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '5.230.73.106', 'is_active': 1, 'expiration': '2023-06-09T16:00:00', 'description': 'CC=DE ASN=AS12586 GHOSTnet GmbH'}, {'id': 3598111431, 'role': None, 'type': 'FileHash-SHA256', 'title': 'SLF:SCPT:OffRelOleObjectHttp.A', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'cd09bf437f46210521ad5c21891414f236e29aa6869906820c7c9dc2b565d8be', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3598682159, 'role': None, 'type': 'FileHash-SHA1', 'title': 'SLF:SCPT:OffRelOleObjectHttp.A', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'fcc2d69a02f091593bc4f0b7d4f3cb5c90b4b011', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of cd09bf437f46210521ad5c21891414f236e29aa6869906820c7c9dc2b565d8be'}, {'id': 3598682160, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'pnwc.bol-north.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3603318851, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'paknavy-gov-pk.downld.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3605396163, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '3b853ae547346befe5f3d06290635cf6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3634235974, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'slpa.mod-gov.org', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3642858290, 'role': None, 'type': 'FileHash-MD5', 'title': 'SLF:SCPT:OffRelOleObjectHttp.A', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '5efddbdcf40ba01f1571140bad72dccb', 'is_active': 1, 'expiration': None, 'description': 'MD5 of a45258389a3c0d4615f3414472c390a0aabe77315663398ebdea270b59b82a5c'}, {'id': 3642863755, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'b7e63b7247be18cdfb36c1f3200c1dba', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3642863918, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'cstc-spares-vip-163.dowmload.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3642863920, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'mtss.bol-south.org', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3654668618, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'ksew.kpt-gov.org', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3654668623, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'promotionlist.comsats-net.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3654668624, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'srilanka-navy.lforvk.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3654678872, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'forecast.comsats-net.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3654679011, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'mailnavybd.govpk.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3654679016, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'moma.comsats-net.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3654698977, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '8af93bed967925b3e5a70d0ad90eae1f13bc6e362ae3dac705e984f8697aaaad', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3654698988, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'bc9d4eb09711f92e4e260efcf7e48906dca6bf239841e976972fd74dac412e2f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3669560175, 'role': None, 'type': 'IPv4', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '62.113.255.80', 'is_active': 1, 'expiration': '2023-06-09T16:00:00', 'description': 'CC=DE ASN=AS47447 23M GmbH'}, {'id': 3677073611, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '16341fcff1bc7388387fd17b4b3a7a50', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3677073612, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '1c62441de076eb5a5b2e1f8146767777', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3677073613, 'role': None, 'type': 'FileHash-MD5', 'title': 'SUSP_INDICATOR_RTF_MalVer_Objects', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '6c7d24b90f3c6b4383bd7d08374a0c6f', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 4db0a2d4d011f43952615ece8734ca4fc889e7ec958acd803a6c68b3e0f94eea'}, {'id': 3677073614, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '709e6a64735432c25cafb89951cc149c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3677073615, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '73750f08265bbe80c3f235318bcef6fe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3677073616, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '8934f22ed2d4390f2e6170e4cfdbd483', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3677073617, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'dacdb33b6e9de4c1fe8591bb5a65c55c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3677073618, 'role': None, 'type': 'FileHash-MD5', 'title': 'SUSP_INDICATOR_RTF_MalVer_Objects', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'ef00004a1ebc262ffe0fb89aa5524d42', 'is_active': 1, 'expiration': None, 'description': 'MD5 of a3283520e04d7343ce9884948c5d23423499fa61cee332a006db73e2b98d08c3'}, {'id': 3677073619, 'role': None, 'type': 'FileHash-SHA1', 'title': 'SUSP_INDICATOR_RTF_MalVer_Objects', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '05ebfd620475269c1228f87048c237a276745f1f', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of a3283520e04d7343ce9884948c5d23423499fa61cee332a006db73e2b98d08c3'}, {'id': 3677073620, 'role': None, 'type': 'FileHash-SHA1', 'title': 'SUSP_INDICATOR_RTF_MalVer_Objects', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '33657ac7b0b7793c21a5a1ea6a78c72fa48857e1', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 4db0a2d4d011f43952615ece8734ca4fc889e7ec958acd803a6c68b3e0f94eea'}, {'id': 3677073621, 'role': None, 'type': 'FileHash-SHA1', 'title': 'SLF:SCPT:OffRelOleObjectHttp.A', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '59f1d4657244353a156ef8899b817404fd7fedad', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of a45258389a3c0d4615f3414472c390a0aabe77315663398ebdea270b59b82a5c'}, {'id': 3677073622, 'role': None, 'type': 'FileHash-SHA256', 'title': 'SUSP_INDICATOR_RTF_MalVer_Objects', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '4db0a2d4d011f43952615ece8734ca4fc889e7ec958acd803a6c68b3e0f94eea', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3677073623, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '75079e408ca9517825ffac396680a2d2169d691be3f1adbbd797e05e665c6fde', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3677073624, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': '8b718a15f76768ba29849a5f4a6ca0ff1d9c8ba7bcdc9d89efc792fe20e9fdb5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3677073625, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'a2a9fd1db7f1dc196fa8af0669ea72d1f8ae48bf4775108ee746e0f83c5a7498', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3677073626, 'role': None, 'type': 'FileHash-SHA256', 'title': 'SUSP_INDICATOR_RTF_MalVer_Objects', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'a3283520e04d7343ce9884948c5d23423499fa61cee332a006db73e2b98d08c3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3677073627, 'role': None, 'type': 'FileHash-SHA256', 'title': 'SLF:SCPT:OffRelOleObjectHttp.A', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'a45258389a3c0d4615f3414472c390a0aabe77315663398ebdea270b59b82a5c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3677073628, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2023-05-10T17:11:29', 'indicator': 'bc3c6f9d51e2bdb37e03b01e2949f72836ecee4230e2320c5dc33a83b55b062f', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 61}

1295f4a30e147bfeafc688fdbe8e5a61528bca5ebc20473ee0a00954793c9b83

2026-06-04 16:17:12.090041+03:00

2026-06-04 16:17:12.090041+03:00

69f29e7612b827a15dfc7787

039e659ade3aa8ee7758c11fdb8fbfffd2491920046d638413cea2042f6d584c

FileHash-SHA256

Komari Red: The Monitoring Tool with a Built-in Reverse Shell

On April 16, 2026, a threat actor leveraged stolen VPN credentials to access a Windows workstation and deployed a SYSTEM-level backdoor using the Komari agent, an open-source monitoring tool with built-in command-and-control capabilities. The attacker authenticated through an SSLVPN session from IP 45.153.34[.]132 and used Impacket smbexec.py to enable RDP on the target system. The Komari agent was installed as a persistent Windows service named 'Windows Update Service' using NSSM, pulling the installer directly from the official GitHub repository. Komari provides bidirectional control through WebSocket connections, offering arbitrary command execution, interactive reverse shell access, and network probing capabilities by default. Microsoft Defender quarantined an earlier registry dump attempt, forcing the adversary to pivot to this GitHub-based approach. This represents the first publicly documented case of Komari being abused in a real-world intrusion.

2026-04-30 00:12:38.898000+03:00

2026-05-30 00:28:12.957000+03:00

['rdp-enablement', 'credential-theft', 'sslvpn-compromise', 'impacket', 'nssm-persistence', 'reverse-shell', 'komari', 'github-infrastructure']

['Komari']

['https://www.huntress.com/blog/komari-c2-agent-abuse']

{'pulse_id': '69f29e7612b827a15dfc7787', 'indicators': [{'id': 4335424651, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-30T00:12:39', 'indicator': '039e659ade3aa8ee7758c11fdb8fbfffd2491920046d638413cea2042f6d584c', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 1}

dfd57a141b8f7a971a3562196849bd767714b0904e625defa8842a0b5ce5cd5a

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69f25f09e5c3a33611f7cb16

f962cb443975065b91d4512a42a529a091726e1815be28ced0ebb9dff997931d

FileHash-SHA256

DDoS-for-Hire Operation Exposed: How an Operator's Debug Build Unraveled a Commercial Game-Server Botnet

An exposed open directory on a Netherlands-hosted server revealed the complete operational toolkit of xlabs_v1, a Mirai-derived IoT botnet operated by an actor using the handle Tadashi. The operation provides DDoS-for-hire services specifically targeting game servers and Minecraft hosts through 21 distinct flood attack variants. The botnet exploits Android Debug Bridge (ADB) on TCP/5555 to compromise over 4 million potentially vulnerable IoT devices including Android TV boxes, smart TVs, and routers. The operation features bandwidth profiling to price-tier infected devices, ChaCha20 string encryption with cryptographic weaknesses, and competitor-eradication routines. Infrastructure analysis consolidated the entire operation within a single bulletproof /24 netblock in the Netherlands, with co-located cryptojacking infrastructure also identified.

2026-04-29 19:42:01.411000+03:00

2026-05-29 19:04:23.918000+03:00

['minecraft', 'game server targeting', 'ddos-for-hire', 'mirai-derived', 'vltrig', 'xlabs_v1', 'mirai', 'bandwidth profiling', 'iot botnet', 'adb exploitation']

['xlabs_v1', 'Mirai', 'VLTRig']

['https://hunt.io/blog/xlabs-v1-ddos-for-hire-operation-exposed']

{'pulse_id': '69f25f09e5c3a33611f7cb16', 'indicators': [{'id': 4294973364, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-29T19:42:02', 'indicator': 'f962cb443975065b91d4512a42a529a091726e1815be28ced0ebb9dff997931d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4294973365, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-29T19:42:02', 'indicator': 'a03705fc225dbcec7e3c2f06a258afe81b5d88aaff1368d10dd6ba4f0932be7c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335268943, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-29T19:42:02', 'indicator': '5c3468e3c7a535b74fa91927fb1572d8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335268944, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-29T19:42:02', 'indicator': '78774672884f8cd7593fced3c7d1faa4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335268945, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-29T19:42:02', 'indicator': 'fac068afc5a0361f323f8b2fdbcbfd41', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335268946, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-29T19:42:02', 'indicator': '98182f78f2ee76f3dffa58c268dd9e653c711ce5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335268947, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-29T19:42:02', 'indicator': 'da365650e77eaf9d79801d475de7bf2b2a031251', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335268948, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-29T19:42:02', 'indicator': 'dbcf1c93634010c7e6131bcdfffa72e30da2376a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335268949, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-29T19:42:02', 'indicator': '079ae4f813939dd96b961ae288fb7f930649dfebb4884c13af95309a71f986f5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335268950, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-29T19:42:02', 'indicator': '31a60f9e0b5b4f0371f4130a184e27f79cefacb080a6273ccb1c9a908dc6ca9d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335268951, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-29T19:42:02', 'indicator': '8367daa8ce633724157b8edd21d625de5ac56b8c2d983bbb283836162037f3c1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4335268952, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-29T19:42:02', 'indicator': 'fa965ed784f7ec99e21475205cc177bb71ac7550b4015b4a4b3e232f032dcb91', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 12}

fe8568f6945688404c70d1b4ff7efa650f6739f19af4c1d252349bfdeffb5227

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69f1f50b6a5e5d1ca31204bb

d21a5d08b4614005c8fcd9d0068f0190

FileHash-MD5

LofyStealer: Malware targeting Minecraft players.

A sophisticated two-stage infostealer named LofyStealer, also known as GrabBot/Slinky, targets Minecraft players through social engineering. The malware comprises a 53.5MB Node.js-based loader disguised within legitimate libraries and a 1.4MB native C++ payload that executes directly in memory. It extracts cookies, passwords, tokens, credit cards, and IBANs from eight different browsers including Chrome, Edge, Brave, Opera GX, and Firefox. The loader uses GitHub Actions for automated compilation while the payload employs direct syscalls to bypass EDR detection. Data is compressed via PowerShell, Base64-encoded, and exfiltrated to a Brazilian-hosted C2 server at 24.152.36.241. The operation is attributed with high confidence to the Brazilian cybercrime group LofyGang, operating a Malware-as-a-Service platform with Free and Premium tiers through a web panel branded as LofyStealer Advanced C2 Platform V2.0.

2026-04-29 12:09:47.279000+03:00

2026-05-29 12:25:38.288000+03:00

['browser data', 'infostealer', 'chromelevator', 'grabbot', 'node.js loader', 'credential theft', 'syscalls evasion', 'lofystealer', 'slinky', 'minecraft']

['LofyStealer', 'GrabBot', 'chromelevator']

['https://zenox.ai/en/lofystealer-malware-mirando-jogadores-de-minecraft']

{'pulse_id': '69f1f50b6a5e5d1ca31204bb', 'indicators': [{'id': 4334022485, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-29T12:09:48', 'indicator': 'd21a5d08b4614005c8fcd9d0068f0190', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4334022486, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-29T12:09:48', 'indicator': 'fb203c0ac030a97281960d7c28d86ebf', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4334022487, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-29T12:09:48', 'indicator': '9b1264eb4ff5ee8f00b8b80341fb6917dc3d3148', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4334022488, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-29T12:09:48', 'indicator': 'f9fe23f24d45eae418c60819c523a83ddba4ca50', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4334022489, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-29T12:09:48', 'indicator': '293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4334022490, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-29T12:09:48', 'indicator': '45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 6}

168ddad9cd11adfabfff9bb203ca8a79775179d6544998bcf3e3ddbac66321e7

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a189defc88ad66cd0a9d87d

22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67

FileHash-SHA256

The Gentlemen ransomware: Dissecting a self-propagating Go encryptor

The Gentlemen is a ransomware-as-a-service operation tracked as Storm-2697, distinguished by combining robust per-file encryption using Curve25519 with XChaCha20 stream cipher alongside aggressive self-propagation capabilities designed for broad network compromise. Emerging in mid-2025 and transitioning to RaaS by September 2025, the operation recently partnered with BreachForums to recruit affiliates including penetration testers and initial access brokers. Written in Go and obfuscated with Garble, the ransomware employs double extortion tactics, encrypting data while exfiltrating sensitive information. It utilizes 21 distinct lateral movement techniques per target host, including PsExec, WMI, scheduled tasks, services, and PowerShell remoting. The malware disables defenses, deletes shadow copies and forensic artifacts, and can optionally wipe free disk space to prevent recovery, impacting organizations globally across education, transportation, healthcare, and finance sectors.

2026-05-28 19:56:31.232000+03:00

2026-05-29 10:37:45.345000+03:00

['go language', 'kazuar', 'ransomware-as-a-service', 'the gentlemen']

['The Gentlemen', 'Kazuar - S0265']

['https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/']

{'pulse_id': '6a189defc88ad66cd0a9d87d', 'indicators': [{'id': 4319567638, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-28T19:56:32', 'indicator': '22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4319567656, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-28T19:56:32', 'indicator': 'fe1033335a045c696c900d435119d210361966e2fb5cd1ba3382608cfa2c8e68', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322484156, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-28T19:56:32', 'indicator': '7a262d4cbbc4808932b6af42c4041f06', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322484172, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-28T19:56:32', 'indicator': '9e951cf2f868b71aaaa05966d8eb96d333b80106', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 4}

a5d544c848c73e343d9844ee05f5e1835a4501aae06949c8b1b4ac5cd47bd8fd

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a185cd579d639bcc6ece4ac

CVE-2026-35616

CVE

FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet Patch

In May 2026, threat actors exploited CVE-2026-35616, an improper access control vulnerability in FortiClient Endpoint Management Server (EMS), to bypass API authentication and execute privileged requests without credentials. Attackers leveraged trusted endpoint management infrastructure to push malicious PowerShell scripts disguised as legitimate Fortinet patches across managed endpoints. The campaign deployed EKZ Infostealer, a credential-stealing tool targeting Chrome, Firefox, and other browser credentials. The stealer extracts passwords, cookies, and autofill data, staging results locally before exfiltration via HTTP to threat-actor-controlled infrastructure. Threat actors accessed systems through Tor exit nodes, modified VPN configurations to enable script execution, and used FortiClient's own management pathways to distribute payloads fleet-wide without requiring individual endpoint compromises.

2026-05-28 15:18:45.437000+03:00

2026-05-29 10:32:45.611000+03:00

['endpoint exploitation', 'ekz infostealer', 'forticlient ems', 'vpn configuration abuse', 'cve-2026-35616']

['EKZ Infostealer']

['https://arcticwolf.com/resources/blog/forticlient-ems-exploited-via-cve-2026-35616-to-deliver-ekz-infostealer-disguised-as-a-fortinet-patch']

{'pulse_id': '6a185cd579d639bcc6ece4ac', 'indicators': [{'id': 4293596187, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-28T15:18:46', 'indicator': 'CVE-2026-35616', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4347087338, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-28T15:18:46', 'indicator': 'CVE-2026-0300', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4352920073, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-28T15:18:46', 'indicator': '0da123adf9251957a4b850a3f6bd6a753dd4892be176a84a18450e899534cc5e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370249993, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-28T15:18:46', 'indicator': '338662fd0c4d750a0ba203a32b59f081', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370250010, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-28T15:18:46', 'indicator': '17e771c78430cc67e71d4547f8996a1a488e9d3f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4382267389, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-28T15:18:46', 'indicator': '8c5b72906e8183037532afc3f4639931', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4382267390, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-28T15:18:46', 'indicator': '2927bc31b4f8254c6b332fc03110a6373cad00ffa2ff9de427c26bb222017bb2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4382267391, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-28T15:18:46', 'indicator': '2f25ea1b622abf3212141af932c2ec4cbd6b2b5903c2a531121f691227d98cff', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4382267392, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-28T15:18:46', 'indicator': 'd91c00fad521e76efa89715cca89db487d5676f2c767c883482f9c8f82bd383a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4382267393, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-28T15:18:46', 'indicator': 'fd65051c61a904a304919c04a8c8633c001183ac73ac461cd4d9057946f02bf5', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 10}

37c482afcf061369f2c29468fb29182fe0ae5e4eac4974ecbf35ee48c13ee01e

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69f1de85544538ce8b03332a

f31a8953531ffb5c14e2d8347e283e1f8f3c732a5a9a68f611c96f4730e8a7dc

FileHash-SHA256

User interaction with a ClickFix-style phishing site resulted in execution of an obfuscated PowerShell command

A ClickFix-style phishing campaign leveraged social engineering to trick users into executing obfuscated PowerShell commands that downloaded and installed a malicious MSI payload from a remote server. The attack employed a sophisticated multi-stage infection chain utilizing DLL sideloading techniques with renamed legitimate binaries to execute malicious components. The final payload deployed HijackLoader to deliver a Lumma-style information stealer designed for credential harvesting and data exfiltration. The campaign utilized multiple command-and-control domains and infrastructure hosted on specific IP addresses. Mitigation measures include blocking identified artifacts, enhancing user awareness about ClickFix social engineering tactics, implementing endpoint detection for suspicious PowerShell activity and unsigned DLL sideloading, and isolating compromised systems for remediation.

2026-04-29 10:33:41.967000+03:00

2026-05-29 10:27:04.797000+03:00

['phishing', 'lumma stealer', 'powershell', 'information stealer', 'credential theft', 'hijackloader', 'dll sideloading', 'lummastealer', 'clickfix']

['HijackLoader', 'Lumma Stealer - S1213', 'LummaStealer']

[]

{'pulse_id': '69f1de85544538ce8b03332a', 'indicators': [{'id': 4325627841, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-29T10:33:42', 'indicator': 'f31a8953531ffb5c14e2d8347e283e1f8f3c732a5a9a68f611c96f4730e8a7dc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4325932710, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-29T10:33:42', 'indicator': 'c529217014b732abbe646046c07ce8f0366a42051839d4cb3be5b400285fc728', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4330576304, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-29T10:33:42', 'indicator': 'http://robinhuds.com:9658/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4330576305, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-29T10:33:42', 'indicator': 'http://85.11.161.198:6600/qffww8ph/2DTYOKUEN.msi', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4330576306, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-29T10:33:42', 'indicator': '818daf975f78ac30ba4ce0fdd2f7eb550cdc16701da35594e8c9cba72bc84a5c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4333978435, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-29T10:33:42', 'indicator': 'b07a03883675654088a2b56a80933ca8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4333978436, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-29T10:33:42', 'indicator': 'b6a201726b44106a7dbe93a480b38420', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4333978437, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-29T10:33:42', 'indicator': 'fa1f2ac9172702ad10c24f0a637c26cd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4333978438, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-29T10:33:42', 'indicator': '10dfd71cf61ea3c1621a5b0c08c3b034773fb84b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4333978439, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-29T10:33:42', 'indicator': '7450731c0baf5befb79966a6be7873a5b1a62a7a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4333978440, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-29T10:33:42', 'indicator': 'b374d1715148bc80394b844d9f008adfa5585d65', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4333978441, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-29T10:33:42', 'indicator': 'robinhuds.com', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 12}

041ac881f792ce460567e73067b6361fe246815fc562792ae777298ba2e77811

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a17527240dde65694eed30e

mvrx.lat

domain

Exposing a Global Smishing Operation Across 19 Countries: Governments, Postal Services, and Telecoms Targeted

A coordinated smishing operation spanning 19 countries across Europe, the Americas, and the Caucasus has been exposed, originating from fraudulent SMS messages impersonating Romania's government payment portal Ghișeul.ro. Investigation revealed 1,628 malicious URLs linked by a single 128-character campaign identifier, targeting government portals, traffic police departments, postal services including DPD and SEUR, tax authorities, and telecommunications providers like T-Mobile and Vodafone. The infrastructure utilizes 32 backend IP addresses distributed across Tencent Cloud, Alibaba Cloud, Cloudflare CDN, and ALEXHOST Moldova. Threat actors employ two distinct phishing templates: a Vue.js single-page application and a Bootstrap-based clone, executing a four-stage credential harvesting process that collects complete payment card details through fabricated traffic fines, toll payments, and delivery notifications.

2026-05-27 20:22:10.565000+03:00

2026-05-28 15:19:05.611000+03:00

['smishing', 'government impersonation', 'credential harvesting', 'payment card theft', 'phishing', 'multi-country campaign', 'postal service fraud', 'typosquatting']

[]

['https://hunt.io/blog/massive-smishing-campaign-governments-postal-telecoms']

{'pulse_id': '6a17527240dde65694eed30e', 'indicators': [{'id': 4357270849, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'mvrx.lat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357270852, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'ghiseul.autos', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357270864, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'mvri.lat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4363816042, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'dpde.lat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4363821558, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'e-uprava.gov-si.shop', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373640856, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'gove.lat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373640857, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'govh.lat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373640858, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'govj.lat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373640859, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'govk.lat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373640860, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'govl.lat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598747, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': '5756505bc94149dda328a2721561cab6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598748, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'http://ghisaul.lat/ro', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598749, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'http://ghiseul-ro.cyou/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598750, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'http://ghiseul-ro.sbs/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598751, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'http://ghiseul-ro.shop/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598752, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'http://ghiseul.cfd/pay', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598753, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'http://ghiseul.eu.cc/pay', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598754, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'http://www.ghiseul.ro/ghiseul/public/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598755, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'http://www.ghiseul.ro/ghiseul/public/css/bootstrap-theme.css', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598756, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'http://www.ghiseul.ro/ghiseul/public/css/bootstrap.min.css', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598757, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'http://www.ghiseul.ro/ghiseul/public/css/font-awesome.min.css', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598758, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'http://www.ghiseul.ro/ghiseul/public/css/jquery-ui.structure.min.css', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598759, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'http://www.ghiseul.ro/ghiseul/public/css/simple-line-icons.css', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598760, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'https://ghiseal.lat/ro/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598761, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'https://ghiseal.lat/ro/#/index', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598762, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'https://ghiseul.autos/ro/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598763, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'https://ghiseul.cyou/pay', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598764, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'https://ghisiul.lat/ro/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598765, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'https://ghizeul.lat/ro/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598766, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'https://www.ghiseul-ro.bond/ghiseul/public/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598767, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'https://www.ghiseul-ro.cfd/ghiseul/public/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598768, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'https://www.ghiseul.govro.one/ghiseul/public/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598769, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'https://www.ghiseul.ro/ghiseul/public/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598770, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'https://www.ghiseulro.cyou/ro/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598771, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'dpd-lv.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598772, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'dpdlv.bond', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598773, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'dsvag.sbs', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598774, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'dsvav.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598775, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'dsvcv.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598776, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'dsvxk.cyou', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598777, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'e-csddlv.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598778, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'fanveris.cyou', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598779, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'ghisaul.lat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598780, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'ghiseal.lat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598781, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'ghiseul-ro.cyou', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598782, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'ghiseul-ro.sbs', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598783, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'ghiseul-ro.shop', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598784, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'ghiseul.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598785, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'ghiseul.cyou', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381598786, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-27T20:22:11', 'indicator': 'ghisiul.lat', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 90}

cfb104eeed778423446ded08171f91b4e29976887e90fd20e695fe0702744800

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69ef8bc1ae6e9625756e05a8

air-upsuomi.fi

domain

Inside the Bulletproof Hosting Network Behind 16,000+ Fake Shops

Fibergrid has operated as a bulletproof hosting provider for nearly a decade, currently hosting 16,700 active fraudulent e-commerce sites. The network exploits stolen African IPv4 address space worth $20-25 million, originally acquired through improper AFRINIC registrations. Despite claiming Seychelles-based operations, multilateration analysis reveals infrastructure concentrated in the United States, United Kingdom, Netherlands, Canada, and other Western countries, primarily within Equinix data centers. Fibergrid operates through a complex web of UK and Estonian shell companies using multiple autonomous systems to evade detection and enforcement. Fake shops constitute 70% of malicious activity on this infrastructure, targeting consumers through search engines and social media with counterfeit goods and payment fraud schemes. Disruption opportunities exist through upstream provider intervention, regional internet registry action, domain-level takedowns, and indicator sharing with security providers.

2026-04-27 16:16:01.047000+03:00

2026-04-27 16:30:02.826000+03:00

['fibergrid', 'e-commerce fraud', 'bulletproof hosting', 'shell companies', 'stolen ip addresses', 'autonomous systems', 'counterfeit goods', 'fake shops', 'afrinic']

[]

['https://www.netcraft.com/blog/fibergrid-inside-the-bulletproof-host']

{'pulse_id': '69ef8bc1ae6e9625756e05a8', 'indicators': [{'id': 4331162265, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-27T16:16:02', 'indicator': 'air-upsuomi.fi', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4331162266, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-27T16:16:02', 'indicator': 'airupfranceshop.fr', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4331162267, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-27T16:16:02', 'indicator': 'airuppullosuomi.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4331162268, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-27T16:16:02', 'indicator': 'airupsweden.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4331162269, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-27T16:16:02', 'indicator': 'bratziezpuertorico.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4331162270, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-27T16:16:02', 'indicator': 'pinkpalmpuffnetherland.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4331162271, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-27T16:16:02', 'indicator': 'timberlandsromania.cc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4331162272, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-27T16:16:02', 'indicator': 'ultimateearsindia.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4331162273, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-27T16:16:02', 'indicator': 'zapatilasbrookar.com', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 9}

0131d36e103452f1fc3903e3ea827ca5815e04707b126c454d9aa4b4a2817d1f

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a181f75cd4fa08fe38dfc48

000102030405060708090a0b0c0d0e0f

FileHash-MD5

A miner with a side of RAT: the unintended gift with your TV show or book

A cybercrime campaign active since at least 2022 has been distributing cryptocurrency miners and RAT malware through illegal streaming sites and digital libraries. Victims are tricked via fake video player plugin updates or browser crash pages into downloading ZIP archives containing legitimate executables and malicious DLLs. The malware employs DLL side-loading, establishes persistence through Windows services, and deploys multiple components including XMRig-based CPU miners, GPU miners, a watchdog module, and a RAT agent with remote control capabilities. The campaign leverages highly popular pirated content sites with monthly traffic reaching up to 40 million visits, significantly expanding the potential victim pool. The malware includes sophisticated anti-detection features, DNS tunneling for command-and-control, and domain generation algorithms based on dates.

2026-05-28 10:56:53.325000+03:00

2026-05-28 15:17:18.522000+03:00

['domain generation algorithm', 'fake updates', 'xmrig', 'dns tunneling', 'silentcryptominer', 'cryptocurrency miner', 'dll side-loading', 'piracy sites']

['XMRig', 'SilentCryptoMiner']

['https://securelist.com/video-books-pirates-miners-rat/119943/']

{'pulse_id': '6a181f75cd4fa08fe38dfc48', 'indicators': [{'id': 2862096398, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-28T10:56:54', 'indicator': '000102030405060708090a0b0c0d0e0f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3353377705, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-28T10:56:54', 'indicator': '0123456789abcdef0123456789abcdef', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4321124229, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-28T10:56:54', 'indicator': 'urush1bar4.online', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381997112, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-28T10:56:54', 'indicator': '02a43b3423367b9dddc24cc7dfc070df', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381997113, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-28T10:56:54', 'indicator': '6a0fe6065d76715feebc1526d456db73', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381997114, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-28T10:56:54', 'indicator': '7f624407ae489324e96a708a09c17e6f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381997115, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-28T10:56:54', 'indicator': '5d14vnfb.space', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381997116, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-28T10:56:54', 'indicator': 'jeaw520i.space', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381997117, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-28T10:56:54', 'indicator': 'qdmagva5.space', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381997118, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-28T10:56:54', 'indicator': 'r7mvjl67.space', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381997119, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-28T10:56:54', 'indicator': 'zgj1tam9.space', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381997120, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:56:54', 'indicator': 'file.ipfs.us.69.mu', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 12}

674b1b32c9589caca566e28827a882b41eceab32de970d288133611d68a71bac

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69ef8ab862c07db686ca4572

pulse:69ef8ab862c07db686ca4572

Extortion in the Enterprise: Defending Against BlackFile Attacks

Since February 2026, multiple incidents involving data theft and extortion have been attributed to activity cluster CL-CRI-1116, also known as BlackFile, UNC6671, and Cordial Spider. These financially-motivated attackers, likely associated with "The Com" collective, employ voice-based phishing combined with credential harvesting through fraudulent login pages. They impersonate IT support staff to steal credentials and bypass multi-factor authentication. The attackers focus on Living Off the Land techniques, abusing legitimate APIs like Microsoft Graph to access SharePoint sites and Salesforce data. They search for confidential information and employee data within SaaS environments, then exfiltrate it through browser downloads or API exports. To pressure victims into paying seven-figure ransoms, attackers send demands via Gmail and compromised email accounts, sometimes employing SWATting tactics against executives.

2026-04-27 16:11:35.928000+03:00

2026-05-27 16:16:49.504000+03:00

['blackfile', 'data exfiltration', 'saas attacks', 'unc6671', 'extortion', 'cordial spider', 'the com', 'credential theft', 'vishing']

[]

['https://rhisac.org/threat-intelligence/extortion-in-the-enterprise-defending-against-blackfile-attacks/']

{'pulse_id': '69ef8ab862c07db686ca4572', 'indicators': [], 'indicators_count': 0}

d634cd1868e19e4ec8330a1f26782931e5699f717dcd738e16dd5f5dc1e732ec

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a181e409d755171f4ac356c

driver-updater.net

domain

A New Threat Actor Targeting the Cryptocurrency Industry's Software Development Infrastructure

JINX-0164, a financially motivated threat actor active since mid-2025, has been conducting sophisticated campaigns against cryptocurrency organizations. The actor employs LinkedIn-based social engineering, posing as recruiters or business partners to deliver custom macOS malware including AUDIOFIX (a Python-based infostealer and RAT) and MINIRAT (a lightweight Go backdoor). Their operations focus on compromising developer endpoints to steal cryptocurrency wallet credentials, cloud secrets, and GitHub tokens. The attackers then pivot to CI/CD infrastructure, injecting malicious code into repositories to enable lateral movement. In April 2026, they executed a supply chain attack by trojanizing the npm package @velora-dex/sdk. The group masks activity using VPN services and demonstrates advanced capabilities including credential harvesting from password managers, browser extensions, and development tools.

2026-05-28 10:51:44.095000+03:00

2026-06-27 10:00:00.996000+03:00

['supply chain attack', 'social engineering', 'audiofix', 'npm trojan', 'linkedin phishing', 'macos', 'cryptocurrency', 'ci/cd hijacking', 'minirat', 'developer targeting']

['AUDIOFIX', 'MINIRAT']

['https://www.wiz.io/blog/threat-actors-target-crypto-orgs']

{'pulse_id': '6a181e409d755171f4ac356c', 'indicators': [{'id': 3458403540, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'driver-updater.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4186425417, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'login.teamicrosoft.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4278565869, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'live.ong', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4311820439, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'http://89.36.224.5/troubleshoot/mac/install.sh', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4325640829, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165256, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'teams.live.us.org', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165259, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'www.driver-updater.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165261, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'www.live.us.org', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165659, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'teams.retesta.live', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165660, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'www.drvstore.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165661, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'www.retesta.live', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165662, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'login.retesta.live', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165665, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'learn.retesta.live', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165666, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'driver-store.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165669, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'apple.driver-store.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165670, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'windows.driver-store.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165673, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'driver-hub.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165676, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'apple.drvstore.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165679, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'www.live.ong', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165681, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'www.driver-store.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165682, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'teams.live.ong', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165685, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'windows.drvstore.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165686, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'drvstore.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165689, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'learn.teams.us.org', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165695, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'learn.live.ong', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165696, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'www.driver-hub.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165697, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'team.live.us.org', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165698, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'login.live.ong', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165708, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'byte-io.us', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165709, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'cloud-sync.online', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4357165710, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'datahub.ink', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370402787, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': '7bd3201946ef8b8a836bc2f951923adc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370402789, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': '860ef29773cf680ed765cb08ac3072cb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370402994, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': '6ca184cb838a989220254ff1914313d774e65712', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370403005, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'db077e20e429b93d9b1187cf09869544d83dbe02', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370403010, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': '0a8ab3d16b12d3a453ee5a3208fe04744ad54514ef8ea27bb8fe32679efad270', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370403011, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': '0b028b781950641818800fee2b4bf68e4ef2bcee53fe71a21755275ba108783d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381996945, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': '3318c614fa7d74b71c81f0e5532cc27e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381996946, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': '425dbed05e53394a719c6e0986a9ce87', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381996947, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': '5fa825564b4ede126005a88ba9efbb54', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381996948, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'ce9da8845b153c5ba50281304b77969b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381996949, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': '0614fe623f6014bccae634e15e3c883a41aa89ee', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381996950, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': '2e763321936858b8a566eaadcaf5a7ce064bbad0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381996951, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'd068b346169ced2ed677e1d4d75becf84829017f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381996952, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': 'e581b38c6d4e659742839f3025a2add0a7e3fe60', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381996953, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': '0b1a36a31b952341a534fe24890f1ed2921ee259773cff46e4f6273b8c4d5d21', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381996954, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': '2a10ffe0367bb1b26ba2c3bc600892c21074725c0b8c9dc9161e6ceb33915460', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381996955, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': '3e3901519c2305fbe9d5483b7234c25c6d2b562512916481d96f26b849c39fdb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381996956, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': '402625ec79e3573a80b6de9b33fc1e503e3c7803603cd958ddd515fb0549007c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4381996957, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-28T10:51:45', 'indicator': '65cba741fe30fa4799fb9002ea8de6d96042a59159dd7c3419c766af24c835e6', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 92}

0844a3263044e8f72ef15c276efe6a24ef9b8cf4c9c27ef2027a6d36a33b0fe1

2026-06-02 19:36:33.704335+03:00

2026-06-28 19:00:06.171367+03:00

6a15ba2632bd7e246e9c1250

afraid.veloitall.cfd

hostname

Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet

Threat actors exploited the EtherHiding technique to store ClearFake payload routing instructions within smart contracts on the BNB Smart Chain testnet, creating an immutable command-and-control infrastructure that cannot be taken down. The attack began with injected JavaScript on a compromised Swiss website that queried blockchain contracts to deliver malicious payloads. Victims passing anti-analysis checks were fingerprinted by operating system and routed to platform-specific ClickFix social engineering overlays. The campaign simultaneously deployed SectopRAT, a .NET-based remote access trojan capable of browser session hijacking, and ACRStealer, a C++ infostealer targeting credentials and cryptocurrency wallets. An on-chain execution tracker confirmed each compromise in real time. Four smart contracts shared a single deployer wallet, with the oldest deployed nearly a year before analysis, indicating a long-running, actively maintained operation.

2026-05-26 15:20:06.238000+03:00

2026-05-27 13:56:54.370000+03:00

['infostealer', 'blockchain c&c', 'clickfix', 'etherhiding', 'sectoprat', 'clearfake', 'bnb smart chain', 'acrstealer']

['SectopRAT', 'ACRStealer']

['https://www.trendmicro.com/en_us/research/26/e/smart-contracts-for-command-and-control.html']

{'pulse_id': '6a15ba2632bd7e246e9c1250', 'indicators': [{'id': 4337169031, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': 'afraid.veloitall.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4337169031, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-26T15:20:07', 'indicator': 'afraid.veloitall.cfd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4346840893, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': 'root-cul.xamir3on.lat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4346903848, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-26T15:20:07', 'indicator': 'ohn.stainedunstitch.work', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4346903848, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': 'ohn.stainedunstitch.work', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4346952524, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': 'getcfgs.qen9varol.lat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4347302170, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-26T15:20:07', 'indicator': 'ootid.srv-auth-dlt-msh.in.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4347302170, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': 'ootid.srv-auth-dlt-msh.in.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4379562933, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': '46add4a5fb2da6fe12759a06fe1c6bc43e987da3ea7c28bff0a7f2a349088f0d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4379562933, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-26T15:20:07', 'indicator': '46add4a5fb2da6fe12759a06fe1c6bc43e987da3ea7c28bff0a7f2a349088f0d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4379562934, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-26T15:20:07', 'indicator': '9c235a84d15087719e59c09f41d43e3574de4544d490aab619184a7d65b02910', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4379562934, 'role': None, 'type': 'FileHash-SHA256', 'title': 'SUSP_GObfuscate_May21', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': '9c235a84d15087719e59c09f41d43e3574de4544d490aab619184a7d65b02910', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4379562935, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-26T15:20:07', 'indicator': 'a5691a4fc69faa4f0fe08f12347783e1dde3c617552be7efd1c5ed89a793e885', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4379562935, 'role': None, 'type': 'FileHash-SHA256', 'title': 'UPX', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': 'a5691a4fc69faa4f0fe08f12347783e1dde3c617552be7efd1c5ed89a793e885', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4379562936, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-26T15:20:07', 'indicator': 'put34b.camp', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4379562937, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': 'ren.trytoken.life', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4379562937, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-26T15:20:07', 'indicator': 'ren.trytoken.life', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4379562938, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': 'www.badischwaendi.ch', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4379562938, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-26T15:20:07', 'indicator': 'www.badischwaendi.ch', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4380352716, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': '4d63c25457d3d5bd37bcf7c3d10154e6', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 46add4a5fb2da6fe12759a06fe1c6bc43e987da3ea7c28bff0a7f2a349088f0d'}, {'id': 4380352717, 'role': None, 'type': 'FileHash-MD5', 'title': 'UPX', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': '6691ffa5af2d4d3b3dea04e69185a79d', 'is_active': 1, 'expiration': None, 'description': 'MD5 of a5691a4fc69faa4f0fe08f12347783e1dde3c617552be7efd1c5ed89a793e885'}, {'id': 4380352718, 'role': None, 'type': 'FileHash-MD5', 'title': 'SUSP_GObfuscate_May21', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': '7405da969d14833a77b4049b3b6a39b9', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 9c235a84d15087719e59c09f41d43e3574de4544d490aab619184a7d65b02910'}, {'id': 4380352719, 'role': None, 'type': 'FileHash-SHA1', 'title': 'UPX', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': '0eb9241b1530549c258537d647d2723879508778', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of a5691a4fc69faa4f0fe08f12347783e1dde3c617552be7efd1c5ed89a793e885'}, {'id': 4380352720, 'role': None, 'type': 'FileHash-SHA1', 'title': 'SUSP_GObfuscate_May21', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': '4f72551703b84ae70b0837a97523c66b21c538e6', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 9c235a84d15087719e59c09f41d43e3574de4544d490aab619184a7d65b02910'}, {'id': 4380352721, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-27T13:54:02', 'indicator': 'b654603260e52faefd9b5b1aad1ca4bd233f9167', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 46add4a5fb2da6fe12759a06fe1c6bc43e987da3ea7c28bff0a7f2a349088f0d'}], 'indicators_count': 25}

c1bf5972ea119c37d1d74d2c94c0b597d8874751a5ee6ebedf256c402719a6f6

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a1447f25db6bc082d5093cb

file.name

domain

RemotePE: The Lazarus RAT that lives in memory

A sophisticated memory-only toolset used by a North Korean Lazarus subgroup targeting financial and cryptocurrency organizations consists of three malware families forming a chain. DPAPILoader decrypts and loads RemotePELoader from disk using Windows Data Protection API. RemotePELoader beacons to command-and-control servers and retrieves RemotePE, a fully-fledged remote access trojan executed entirely in memory without filesystem artifacts. The toolset employs environmental keying via DPAPI, EDR evasion through HellsGate technique and ETW patching, actor-in-the-loop payload delivery, and shared hosting infrastructure on Namecheap. RemotePE features comprehensive RAT capabilities including file operations, process management, command execution, and a plugin system for dynamically loading additional payloads, while maintaining persistence through masquerading as legitimate Windows services.

2026-05-25 13:00:34.674000+03:00

2026-05-25 15:15:11.630000+03:00

['poolrat', 'pondrat', 'dpapiloader', 'themeforestrat', 'hellsgate', 'remotepeloader', 'remotepe']

['DPAPILoader', 'RemotePELoader', 'RemotePE', 'ThemeForestRAT', 'PondRAT', 'POOLRAT']

['https://blog.fox-it.com/2026/05/22/remotepe-the-lazarus-rat-that-lives-in-memory/']

{'pulse_id': '6a1447f25db6bc082d5093cb', 'indicators': [{'id': 14297815, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': 'file.name', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 2916025873, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': 'akamaicloud.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3525046790, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': 'event.name', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4126117224, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': '23c2569a65870a9e412d98d5b3bdc554', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4126117225, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': '75a46b23825ce7aa4ca297d93450f4e2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4126117230, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': '3b994549ab4fd9024b2f0155094d7aa43b70bb8f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4126117231, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': '91def0a4dd9b35510d7f8897bc114f975a5d7e2b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4126117232, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': '159471e1abc9adf6733af9d24781fbf27a776b81d182901c2e04e28f3fe2e6f3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4126117235, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': 'aa4a2d1215f864481994234f13ab485b95150161b4566c180419d93dda7ac039', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4126123226, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': '37f5afb9ed3761e73feb95daceb7a1fdbb13c8b5fc1a2ba22e0ef7994c7920ef', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4126123229, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': '4f6ae0110cf652264293df571d66955f7109e3424a070423b5e50edc3eb43874', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4126123233, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': '7a05188ab0129b0b4f38e2e7599c5c52149ce0131140db33feb251d926428d68', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4126123245, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': '442f4abac74d844256e3ff60f929b358ded71881', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4126123246, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': '56f9b97fee195ed8dea39552eac288aa58cfaf48', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4126123248, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': 'bef8714787a76d33d74dc23e7c750e74b57f6f04', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4126123251, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': 'aes-secure.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4126123252, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': 'azureglobalaccelerator.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373453820, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': '6b33d20196267b0d64bca815ca863558d26b17cee77caf62a6cce8eae555ac8d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373453822, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': '62e040a32aac2d2faa8d2bffa2cf7ab662228cebf9bb78eaa0a633c0b729d119', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373453823, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': '710f15302859c7af1c1e25219d704841b3fdbc48f16a5a574d5ab6cf4f4842e8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4377140173, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': 'https://docs.dissect.tools/en/stable', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4377140174, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': 'https://docs.dissect.tools/en/stable/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4377140175, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': '6c2b40c172a9c8706abc149ac72f5c509e4c5f56', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4377140176, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': '84bb3752307a088a6cdba4215aa9a993d34f353c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4377140177, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': 'devicelinkintel.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4377140178, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': 'intelcloudinsights.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4377140179, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': 'msdeliverycontent.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4377140180, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-25T13:00:35', 'indicator': 'docs.dissect.tools', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 28}

d56ed3622dce497a9188931f50a499584d5aeb12a225a4529418d350e117f006

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69ecc3226a3aeb6f5b7202e3

09bb7e568e573497e22bfa3f36d71fe9d104899826608affedb25d988f391c85

FileHash-SHA256

Token Bingo: Don't Let Your Code be the Winner

In early April 2026, a large-scale device code phishing campaign targeted organizations across multiple sectors and regions, exploiting OAuth 2.0 Device Authorization Grant. Threat actors leveraged the Kali365 phishing-as-a-service platform, originating primarily from IP address 216.203.20[.]95. The campaign used high-fidelity lures directing victims to Microsoft's legitimate device login flow, where users unknowingly authorized threat actor-controlled sessions. Captured OAuth tokens enabled immediate mailbox access and post-compromise activities. In some cases, attackers established malicious inbox rules to suppress security notifications, extending dwell time. The Kali365 platform operates as a multi-tenant PhaaS ecosystem supporting both device code abuse and adversary-in-the-middle session capture, featuring rapid lure generation across multiple languages and file types, Cloudflare Worker-hosted pages, and token sharing capabilities between affiliates.

2026-04-25 13:35:30.971000+03:00

2026-05-25 13:03:35.404000+03:00

['credential theft', 'oauth abuse', 'token theft', 'kali365', 'microsoft 365', 'inbox rules', 'device code phishing', 'phishing-as-a-service']

['Kali365']

['https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/']

{'pulse_id': '69ecc3226a3aeb6f5b7202e3', 'indicators': [{'id': 4327521869, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-25T13:35:31', 'indicator': '09bb7e568e573497e22bfa3f36d71fe9d104899826608affedb25d988f391c85', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327521870, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-25T13:35:31', 'indicator': '2fa6fc2199d3be55e240500d87e4484f39b9315bf336be25434f6716b8d28ec8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327521871, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-25T13:35:31', 'indicator': '883d5d4a73b0ac8cf4f78fe46d8f4e76e21508872836f2b439af2de4a205128e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327521878, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-25T13:35:31', 'indicator': 'duemineral.uk', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327521879, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-25T13:35:31', 'indicator': 'kali365.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327521880, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-25T13:35:31', 'indicator': 'api.kali365.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327521881, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-25T13:35:31', 'indicator': 'v2.kali365.xyz', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 7}

19b92654e01b44c967993f4754551fcc43a411d493f80f40171b33954513baf8

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a140384686e44f07358066d

7c1f99dca8e5a7897892f9d224a6495023a2cfd2671697d229d355978c415ed2

FileHash-SHA256

Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability

In late 2025, an unknown threat actor exploited a critical zero-day vulnerability in KnowledgeDeliver, a Learning Management System widely used in Japan. The vulnerability, tracked as CVE-2026-5426, allowed unauthenticated remote code execution through ViewState deserialization attacks. The issue stemmed from identical hardcoded ASP.NET machine keys distributed across multiple customer deployments in the vendor's configuration files. Attackers obtained these keys from one deployment and used them to compromise other internet-facing instances. Following initial access, threat actors deployed the BLUEBEAM in-memory web shell, modified JavaScript files to display fake security alerts, and tricked users into installing malicious software that delivered Cobalt Strike BEACON backdoors. The attack demonstrates the severe risks of shared secrets in deployment templates and highlights the importance of unique cryptographic keys per installation.

2026-05-25 08:08:36.688000+03:00

2026-05-25 10:41:56.539000+03:00

['zero-day exploitation', 'bluebeam', 'viewstate deserialization', 'cobalt strike', 'bluebeam web shell']

['BLUEBEAM', 'Godzilla', 'Cobalt Strike - S0154']

['https://cloud.google.com/blog/topics/threat-intelligence/knowledgedeliver-viewstate-deserialization-vulnerability']

{'pulse_id': '6a140384686e44f07358066d', 'indicators': [{'id': 4108560115, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T08:08:37', 'indicator': '7c1f99dca8e5a7897892f9d224a6495023a2cfd2671697d229d355978c415ed2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4325948096, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-25T08:08:37', 'indicator': 'CVE-2026-5426', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 2}

e6ce217cb4505e2f227245ca96ca668ee226c1b214d77e21c9b36eff1ce21d31

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a123f4adef80b0c4d8ccd35

CVE-2013-6282

CVE

Android Trojan Abuses Commercial Rooting Tool and Steals Private Information

Rootnik is an Android trojan that exploits vulnerabilities in Android 4.3 and earlier by weaponizing a Chinese commercial rooting tool called Root Assistant. The malicious operation spreads through repackaged legitimate applications distributed globally, affecting users primarily in the United States, Malaysia, Thailand, Lebanon and Taiwan. After installation, Rootnik gains root access using stolen exploits, installs four persistent APK files to the system partition, and performs aggressive app promotion campaigns. The trojan silently installs and uninstalls applications, downloads and executes code remotely, and harvests sensitive data including WiFi passwords, location information, device identifiers, and MAC addresses. The malware maintains command and control infrastructure through multiple domains and generates revenue through aggressive advertising that interrupts user activity regardless of the current application.

2026-05-23 23:59:06.114000+03:00

2026-05-25 10:39:18.780000+03:00

['rooting', 'rootnik', 'android', 'app promotion', 'wifi credentials', 'information theft']

['Rootnik']

['https://unit42.paloaltonetworks.com/rootnik-android-trojan-abuses-commercial-rooting-tool-and-steals-private-information/?pdf=print&lg=en&_wpnonce=3df28d88da']

{'pulse_id': '6a123f4adef80b0c4d8ccd35', 'indicators': [{'id': 53411, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'CVE-2013-6282', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 159264, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'shenmeapp.info', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 159265, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'superflashlight.mobi', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 159266, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'applight.mobi', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 159267, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'jaxfire.mobi', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 204212271, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'CVE-2013-2597', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 204212272, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'CVE-2013-2596', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 569116093, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'ae4be03204419fd96c4e5085b6e3ddd542f39c53f9c9d0fed4eecaf823a1b26e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1574174982, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'c1775e5fe89a0c8b1254e4d8a95686c56554b47f13e36d4f5cb551cb340f7021', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1574174983, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': '0d612eb6d3ca2bbbc2aa33493065d8b4c3237f3cb262d48602181887ccea1afb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1574174984, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': '17a00e9e8a50a4e2ae0a2a5c88be0769a16c3fc90903dd1cf4f5b0b9b0aa1139', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1574174985, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'f6b7b22bbe572c1ac1d7ac7135e076da87491eb78a37f17654a4aa92d88ded24', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1574174986, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': '3bab02ec7ab2480c65b824350b387b00fc7fd9359ebca34fb42dda340ccbf5b6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1574174987, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'dc76856ff79cfdda7b227635f204ff3341e01ea537022497f5c6a70dc46b0cea', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1574174988, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': '690d44802b3638688c7e93bf9dc85b39fbfa2e03b5763a571caf665c8803b13b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1581738963, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'api.jaxfire.mobi', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1581738964, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'api.applight.mobi', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1581738965, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'api.superflashlight.mobi', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 1581738966, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'api.shenmeapp.info', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3556004541, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'CVE-2012-4221', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3556004546, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'cdn.applight.mobi', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3556004547, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-23T23:59:06', 'indicator': 'cs.applight.mobi', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 22}

4e407bcc2cb8548f363636e3d364324ed8e5585e4fca004abf638297eb31c486

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a1187d92cdbfd79095008cd

flipboxstudio.info

domain

Laravel Lang Compromised with RCE Backdoor Across 700+ Versions

Community-maintained Laravel Lang packages were compromised with remote code execution backdoors affecting over 700 versions across multiple repositories including laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions. The attack involved coordinated rapid tag publishing on May 22-23, 2026, suggesting organization-level credential compromise. A malicious helpers.php file was automatically executed via Composer's autoloader, deploying a sophisticated cross-platform information stealer. The second-stage payload systematically harvested credentials from cloud infrastructure, Kubernetes, CI/CD systems, browsers, password managers, cryptocurrency wallets, VPN clients, and local configurations. Stolen data was encrypted and exfiltrated to a command-and-control server. The backdoor employed advanced evasion techniques including TLS verification bypass, per-host execution markers, and embedded Windows executables to bypass Chrome encryption protections.

2026-05-23 10:56:25.473000+03:00

2026-05-25 10:36:35.936000+03:00

['developer compromise', 'rce backdoor', 'laravel', 'supply chain attack', 'information stealer']

['helpers.php stealer', 'DebugChromium.exe']

['https://socket.dev/blog/laravel-lang-compromise']

{'pulse_id': '6a1187d92cdbfd79095008cd', 'indicators': [{'id': 4373750590, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-23T10:56:26', 'indicator': 'flipboxstudio.info', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373750591, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-23T10:56:26', 'indicator': 'https://flipboxstudio.info/payload', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373750592, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-23T10:56:26', 'indicator': 'https://flipboxstudio.info/exfil', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 3}

bf8a596459b6fc41766053b6fa61e59cb486312a0f6c64e48fe8851668833b2e

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a10949191ce7d3c3f2f8105

710a9d2653c8bd3689e451778dab9daec0de4c4c75f900788ccf23ef254b122a

FileHash-SHA256

From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence

A sophisticated multi-stage intrusion began with the compromise of an internet-facing F5 BIG-IP load balancer running an end-of-life version. The threat actor established SSH access to a Linux server using privileged credentials, then conducted extensive reconnaissance including network scanning with Nmap and service enumeration with gowitness. Following horizontal and vertical scanning operations, the actor identified and compromised an unpatched internal Atlassian Confluence server via remote code execution. Credentials extracted from Confluence configuration files were subsequently used to attempt Kerberos relay attacks against Active Directory infrastructure and exploit CVE-2025-33073. The incident demonstrates how edge device compromises enable lateral movement across hybrid environments, bypassing traditional security controls through trusted relationships and exploiting insufficient monitoring of non-Windows systems and internal applications.

2026-05-22 17:38:25.493000+03:00

2026-05-25 10:30:22.149000+03:00

['confluence exploitation', 'kerberos relay', 'credential theft']

['HackTool:Linux/MalPack.B', 'HackTool:Linux/Kerbrute']

['https://www.microsoft.com/en-us/security/blog/2026/05/22/from-edge-appliance-to-enterprise-compromise-multi-stage-linux-intrusion-via-f5-and-confluence/']

{'pulse_id': '6a10949191ce7d3c3f2f8105', 'indicators': [{'id': 3840896527, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:38:26', 'indicator': '710a9d2653c8bd3689e451778dab9daec0de4c4c75f900788ccf23ef254b122a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4080401609, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-22T17:38:26', 'indicator': 'CVE-2025-33073', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4095372473, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-22T17:38:26', 'indicator': 'CVE-2024-2012', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4134980156, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-22T17:38:26', 'indicator': 'CVE-2025-20333', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4134980157, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-22T17:38:26', 'indicator': 'CVE-2025-20362', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4140267107, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-22T17:38:26', 'indicator': 'CVE-2025-53521', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373455716, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:38:26', 'indicator': '4a927d031919fd6bd88d3c8a917214b54bca00f8ddc80ecfe4d230663dda7465', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373455717, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:38:26', 'indicator': '57b3188e24782c27fdf72493ce599537efd3187d03b80f8afe733c72d68c5517', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373455718, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:38:26', 'indicator': 'b4592cea69699b2c0737d4e19cff7dca17b5baf5a238cd6da950a37e9986f216', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373455719, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:38:26', 'indicator': 'bdd5da81ac34d9faa2a5118d4ed8f492239734be02146cd24a0e34270a48a455', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 10}

b845e975de447559d56982bf314ffd5d9dd804d0ca71599472897f8db5015ef7

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a141fcbde28865faa897cb4

ramiltonsfinance.com

domain

Fast and Furious - Nimbus Manticore Operations During the Iranian Conflict

The Iranian IRGC-affiliated threat actor Nimbus Manticore launched sophisticated cyber operations during Operation Epic Fury, the US military campaign against Iran beginning February 28, 2026. The campaigns targeted organizations in aviation and software sectors across the United States, Europe, and Middle East using career-themed phishing lures. For the first time, the actor employed SEO poisoning techniques and introduced MiniFast, a previously undocumented backdoor showing signs of AI-assisted development. The operations leveraged AppDomain hijacking and abused legitimate Zoom installer execution flows for malware deployment. The actor demonstrated rapid adaptation capabilities during wartime conditions, maintaining high operational availability while expanding targeting to US-based aviation companies. Multiple campaign waves were observed from February through April 2026, with persistent infrastructure and evolving techniques.

2026-05-25 10:09:15.943000+03:00

2026-05-25 10:15:01.309000+03:00

['operation epic fury', 'minifast', 'minijunk', 'seo poisoning', 'nimbus manticore', 'appdomain hijacking']

['MiniFast', 'MiniJunk']

['https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/']

{'pulse_id': '6a141fcbde28865faa897cb4', 'indicators': [{'id': 3459421467, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'ramiltonsfinance.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4218352632, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '3106848925a39b9d51f9ad9f5963e417', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4218352634, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '8eb107b3dde0a7ac039c668b427a3634', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4236956619, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'getsqldeveloper.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4333879178, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'business-startup.org', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4333879182, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'buisness-centeral-transportation.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204682, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '628d831989787ee1b4ffee611cb2014b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204683, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '810f8e3b88eb05f710c09552941d6f56', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204684, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'cdbe76cdfdec8f7c09781b2ef0fdb7f4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204686, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '0997b6c2fdc3af2de118db559c92ef510c60a994', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204687, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '67f41dc48bfd0c0597295259bd3c0d3c09dfea34', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204688, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'da11679653ef33952c3dc8d8850e43d7b8ac884a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204689, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '0db36a04d304ad96f9e6f97b531934594cd95a5cea9ff2c9af249201089dc864', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204690, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '332ba2f0297dfb1599adecc3e9067893e7cf243aa23aedce4906a4c480574c17', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204691, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '38bd137c672bd58d08c4f0502f993a6561e2c3411773d1ae57ee0151a0a9d11d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204692, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '43dc62cef52ebdd69e79f10015b3e13890f26c058325c0ff139c70f8d8eadcfa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204693, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '44f4f7aca7f1d9bfdaf7b3736934cbe19f851a707662f8f0b0c49b383e054250', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204694, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '74882085db2088356ed7f72f01e0404a0a98cda88ef56fb15ce74c1f36b26d27', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204695, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204696, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '9cf029daca89523d917dafed0568d11d00e45ec96b5b90b4a1f7fd4018c7da84', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204697, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '9e4a658e6d831c9e9bdfe11884a75b7c64812ed0a80e8495ddf6b316505acac1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204698, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'b19e06da580cf91691eda066ac9ee4b09c6e5dc26c367af12660fe1f9306eec4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204699, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'bc3b44154518c5794ce639108e7b9c5fecb0c189607a26de1aaed518d890c7ad', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204700, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'd4a7e9f107fe40c1a5d0139c6c6e25bf6bf57f61feff090bee28f476bb3cc3c2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504608, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '00213937e9c41e69bed025a882de521b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504609, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '2d3fcf0f7a069958a7d9ab2d9d52bee7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504610, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '36e3cd7b35f5abdf8b5f76afb46e4dea', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504611, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '8d1f16c615b39b13ddfe5d2820c6bae8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504612, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'd6cfee4032ba6f8737242fbbe2ec87d7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504613, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'ef0b3833f96b9b5dfe2fc91ec7ba0727', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504614, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '491ac43610a46ad3a9ca647e6e7b29e6387b2169', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504615, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '510668d94c3638749b6c945246922679d4db4df7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504616, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '6e12c54d1861a455c0008ed9ce166e843298a4a0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504617, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '94a0fcc1fb22c6a96abfefbb75bc40afb126f69a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504618, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'a067d4a121af6922fd695e76fa5720135ed12e7b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504619, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'fca243db4f4671e6425c7813b24585c22137224f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504620, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '0291ef318576953f7f3fe287e7775ed1d7c3206119dc7b9cd6d85c02779e6e40', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504621, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '10fd541674adadfbba99b54280f7e59732746faf2b10ce68521866f737f1e46d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504622, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '2c214494fd0bad31473ca8adce78a4f50847876584571e66aadeae70827ec2dc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504623, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '485f182f7b74ea4013b2539275a95d21e3a9bf0082c331937af9353a324b36f3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504624, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '5c3362d20229597d11380f56d1f2eb39647fb6afad7be8392a7abcd18dff12f8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504625, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '63d0d3c4a7f71bdbca720903d6a99b832089cc093c64d2938e7e001e56c17ab4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504626, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '64530d7e6ee30e4a66d9eeed6b8595c33fd72f5f73409133ca40539e5695df4c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504627, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': '781605ce9d4a9869e846f6c9657d71437cb6240ab27ffbc4cd550c0e06996690', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504628, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'a13ba3c5aff46e9daf2d23df4b3e3d49dc7236c207c56f0a1433051f3450d441', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504629, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'a57ffb819fe8d98ff925c5d7b239598fe302acf5a13193d7a535040a71298fdf', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504630, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'dfa1e3137a032ee8561a1cd5e1a0f71a10bebb36aef7c336c878638a9c1239ee', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504631, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'ecaf493c320d201d285ef5f61d75744216e47cf1115b4af528f9a78883cc446e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504632, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'eee657ffdb2af8ed6412221e7d5fbf4f5742f2ac2c88f43f12db46af0697de71', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373504633, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-25T10:09:16', 'indicator': 'f08b17856616d66492a24dced27f788e235f35f42fa7cd10f315000d3a2f4c03', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 69}

7a853e820347ab836e2c9f946b49bd8b8405a030e93bad26d74fb4a461ea6f6f

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a109360ffcb2c8229a150c7

business-startup.org

domain

Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns

Unit 42 researchers identified six new remote access Trojan variants deployed by Iran-nexus APT group Screening Serpens between February and April 2026, coinciding with a regional conflict starting February 28, 2026. The group targeted entities in the U.S., Israel, UAE, and other Middle Eastern locations, primarily focusing on technology sector professionals through highly tailored social engineering using personalized recruitment lures. Two new malware families, MiniUpdate and MiniJunk V2, were discovered featuring advanced techniques including AppDomainManager hijacking that manipulates .NET application initialization to disable security mechanisms. The campaigns demonstrated increased technical capabilities and operational resilience, with each variant using dedicated C2 infrastructure hosted on Azure. The attacks leveraged DLL sideloading, scheduled tasks for persistence, and sophisticated evasion techniques to maintain long-term access for espionage purposes.

2026-05-22 17:33:20.634000+03:00

2026-05-25 09:51:33.862000+03:00

['minijunk v2', 'screening serpens', 'appdomainmanager hijacking', 'iran nexus']

['MiniUpdate', 'MiniJunk V2', 'UpdateChecker.dll', 'uevmonitor.dll']

['https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens/']

{'pulse_id': '6a109360ffcb2c8229a150c7', 'indicators': [{'id': 4333879178, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': 'business-startup.org', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204682, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': '628d831989787ee1b4ffee611cb2014b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204683, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': '810f8e3b88eb05f710c09552941d6f56', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204684, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': 'cdbe76cdfdec8f7c09781b2ef0fdb7f4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204685, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': 'edcdba624ddb43c2a1dcf334aa493068', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204686, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': '0997b6c2fdc3af2de118db559c92ef510c60a994', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204687, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': '67f41dc48bfd0c0597295259bd3c0d3c09dfea34', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204688, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': 'da11679653ef33952c3dc8d8850e43d7b8ac884a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204689, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': '0db36a04d304ad96f9e6f97b531934594cd95a5cea9ff2c9af249201089dc864', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204690, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': '332ba2f0297dfb1599adecc3e9067893e7cf243aa23aedce4906a4c480574c17', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204691, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': '38bd137c672bd58d08c4f0502f993a6561e2c3411773d1ae57ee0151a0a9d11d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204692, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': '43dc62cef52ebdd69e79f10015b3e13890f26c058325c0ff139c70f8d8eadcfa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204693, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': '44f4f7aca7f1d9bfdaf7b3736934cbe19f851a707662f8f0b0c49b383e054250', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204694, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': '74882085db2088356ed7f72f01e0404a0a98cda88ef56fb15ce74c1f36b26d27', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204695, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': '8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204696, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': '9cf029daca89523d917dafed0568d11d00e45ec96b5b90b4a1f7fd4018c7da84', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204697, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': '9e4a658e6d831c9e9bdfe11884a75b7c64812ed0a80e8495ddf6b316505acac1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204698, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': 'b19e06da580cf91691eda066ac9ee4b09c6e5dc26c367af12660fe1f9306eec4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204699, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': 'bc3b44154518c5794ce639108e7b9c5fecb0c189607a26de1aaed518d890c7ad', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4373204700, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-22T17:33:21', 'indicator': 'd4a7e9f107fe40c1a5d0139c6c6e25bf6bf57f61feff090bee28f476bb3cc3c2', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 20}

281c77ff0433b1bd03b6882ee5293a5f6d1d78daae1e9be1402eff1eefc58454

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69ec44ff58f20f2cb01e0a1c

mpasvw.com

domain

AMOS Stealer delivered via Cursor AI agent session

On April 23, 2026, Field Effect MDR identified AMOS Stealer malware delivered through a novel technique exploiting Cursor AI agent sessions running Claude Code. The attack employed social engineering to manipulate operators into prompting the AI agent to download and execute malicious AppleScript loaders. The heavily obfuscated scripts performed sandbox evasion checks, collected sensitive data including credentials, SSH keys, browser data, and cryptocurrency wallets, then exfiltrated compressed archives to remote servers within two minutes. The malware prompted users for local account credentials through fake macOS system dialogs, subsequently using elevated permissions to install persistent implants masquerading as legitimate system services. This delivery mechanism makes detection challenging as malicious commands blend with typical agentic coding behavior, representing an evolution in AMOS Stealer tactics beyond traditional SEO poisoning methods.

2026-04-25 04:37:19.579000+03:00

2026-05-25 04:21:46.500000+03:00

['cryptocurrency theft', 'social engineering', 'amos stealer', 'ai agent exploitation', 'cursor', 'applescript', 'credential harvesting', 'persistent implant']

['AMOS Stealer']

['https://fieldeffect.com/blog/field-effect-detects-amos-stealer-delivered-via-cursor-ai-agent-session']

{'pulse_id': '69ec44ff58f20f2cb01e0a1c', 'indicators': [{'id': 4298024402, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-25T04:37:20', 'indicator': 'mpasvw.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4313395459, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-25T04:37:20', 'indicator': 'arkypc.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4319571025, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-25T04:37:20', 'indicator': 'https://arkypc.com/n8n/update', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327339301, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-25T04:37:20', 'indicator': '312147c0ae0d555a4d50fa627ff7d4f3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327339302, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-25T04:37:20', 'indicator': 'c54620dd3745fdeaff5ccc0db4132f11', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327339303, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-25T04:37:20', 'indicator': '62360ea3b0030238b31dcae402f94c9c73474154', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327339304, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-25T04:37:20', 'indicator': 'df297141e4676b40c29739033468d58163280067', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327339305, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-25T04:37:20', 'indicator': '8ef98fd781a6f1869657fc1acbc9b43a228a99e6fa5fe39c47cce8ab58066596', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327339306, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-25T04:37:20', 'indicator': 'c11bfc200c363ef76ad40b717b5a850daf699f6fa64a26a8ecf7848711bdbd9c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327339307, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-25T04:37:20', 'indicator': 'https://arkypc.com/curl/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327339308, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-25T04:37:20', 'indicator': 'https://lakhov.com/contact', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327339309, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-25T04:37:20', 'indicator': 'https://ouilov.com/zxc/kito', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327339310, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-25T04:37:20', 'indicator': 'foto.gd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327339311, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-25T04:37:20', 'indicator': 'lakhov.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4327339312, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-25T04:37:20', 'indicator': 'ouilov.com', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 15}

db5a0c4a9d0da5a332b5246d6b92d4584dbc01383d023837c32def489a2cc31f

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69eb45ce7c704d3df21996a2

CVE-2012-1856

CVE

RTF Exploit Installs RAT: uWarrior

An unknown Italian-origin threat actor has developed uWarrior, a Remote Access Tool delivered through weaponized RTF documents containing multiple exploits. The attack chain leverages CVE-2012-1856 with a novel ROP chain and CVE-2015-1770 to bypass ASLR protections by loading non-DYNAMICBASE compiled DLLs through OLE objects. The fully-featured RAT uses compressed, optionally encrypted TCP communications with binary message protocols for command and control. Analysis reveals the actor borrowed components from off-the-shelf tools, particularly the ctOS RAT, sharing similar configuration structures and code functions. uWarrior provides extensive capabilities including remote command execution, file manipulation, system control, software enumeration and uninstallation, and data exfiltration. The malware establishes persistence and communicates with C2 servers using AES encryption.

2026-04-24 10:28:30.718000+03:00

2026-05-24 11:12:43.947000+03:00

['rtf exploitation', 'ctos rat', 'uwarrior']

['uWarrior', 'ctOS']

['https://unit42.paloaltonetworks.com/rtf-exploit-installs-italian-rat-uwarrior/?pdf=print&lg=en&_wpnonce=499c73f4de']

{'pulse_id': '69eb45ce7c704d3df21996a2', 'indicators': [{'id': 8505, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-04-24T10:28:31', 'indicator': 'CVE-2012-1856', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 21746, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-24T10:28:31', 'indicator': 'login.loginto.me', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 29500, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-24T10:28:31', 'indicator': '5dce01ec5e1bc1b4f5012e0b4bf16532206284fc8c64cfb8dcf907f45caf98fc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 29501, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-24T10:28:31', 'indicator': '57a5d0da72655df9c5ca9137df7210b86845eeabae488537c70e36587274937c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 29502, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-24T10:28:31', 'indicator': 'a6dea088c9e2c9191e4c2fc4ece7b7b7bd3f034f444362d35c8765f6ec4bd279', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 29504, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-24T10:28:31', 'indicator': 'login.collegefan.org', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 29506, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-04-24T10:28:31', 'indicator': 'CVE-2015-1770', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 7}

22181228b4a8ffea39ef033e18d4ffe7fd0093b7ad78dd46d4706023d122c94f

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69ea2ebe8c3499b065ec22a7

2024ea60da870a221db260482117258b

FileHash-MD5

GopherWhisper: A burrow full of malware

ESET researchers discovered a previously undocumented China-aligned APT group named GopherWhisper that targeted a governmental entity in Mongolia. The group employs a diverse arsenal of custom tools, predominantly written in Go, including backdoors LaxGopher, RatGopher, and BoxOfFriends, along with injectors JabGopher, exfiltration tool CompactGopher, loader FriendDelivery, and C++ backdoor SSLORDoor. The threat actors abuse legitimate services including Discord, Slack, Microsoft 365 Outlook, and file.io for command and control communications and data exfiltration. Through extraction of thousands of messages from compromised Slack and Discord channels, researchers gained valuable insights into the group's internal operations and post-compromise activities. Timestamp analysis of communications indicates operators work during UTC+8 business hours, aligning with China Standard Time, supporting attribution to China-aligned actors.

2026-04-23 14:37:50.540000+03:00

2026-05-23 14:01:56.194000+03:00

['gopherwhisper', 'laxgopher', 'ratgopher', 'boxoffriends', 'go-based backdoors', 'jabgopher', 'china-aligned apt', 'frienddelivery']

['LaxGopher', 'RatGopher', 'BoxOfFriends', 'JabGopher', 'CompactGopher', 'SSLORDoor', 'FriendDelivery']

['https://www.welivesecurity.com/en/eset-research/gopherwhisper-burrow-full-malware/']

{'pulse_id': '69ea2ebe8c3499b065ec22a7', 'indicators': [{'id': 3466208814, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-23T14:37:51', 'indicator': '2024ea60da870a221db260482117258b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3466208814, 'role': None, 'type': 'FileHash-MD5', 'title': 'ALF:Trojan:Win32/Cassini_539ed36b!ibt', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '2024ea60da870a221db260482117258b', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 716554dc580a82cc17a1035add302c0766590964'}, {'id': 3466208829, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T14:37:51', 'indicator': '716554dc580a82cc17a1035add302c0766590964', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3466208829, 'role': None, 'type': 'FileHash-SHA1', 'title': 'ALF:Trojan:Win32/Cassini_539ed36b!ibt', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '716554dc580a82cc17a1035add302c0766590964', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3466208848, 'role': None, 'type': 'FileHash-SHA256', 'title': 'ALF:Trojan:Win32/Cassini_539ed36b!ibt', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '53043bd27f47dbbe3e5ac691d8a586ab56a33f734356be9b8e49c7e975241a56', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 716554dc580a82cc17a1035add302c0766590964'}, {'id': 3466208848, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-23T14:37:51', 'indicator': '53043bd27f47dbbe3e5ac691d8a586ab56a33f734356be9b8e49c7e975241a56', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286363, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-23T14:37:51', 'indicator': '06007ef61672d1153531137c2e5f6ec6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286363, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '06007ef61672d1153531137c2e5f6ec6', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 039eb329a173fce7efeca18611a8f2c0f7d24609'}, {'id': 4324286364, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T14:37:51', 'indicator': '039eb329a173fce7efeca18611a8f2c0f7d24609', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286364, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '039eb329a173fce7efeca18611a8f2c0f7d24609', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286365, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T14:37:51', 'indicator': '57c2490e4db194d3503ee85635fb1d6f26e8c534', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286365, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '57c2490e4db194d3503ee85635fb1d6f26e8c534', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286366, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T14:37:51', 'indicator': '5a1bbb40c442b12594a913431f8c6757a3a66e8f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286366, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '5a1bbb40c442b12594a913431f8c6757a3a66e8f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286367, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '926974facfd0383c65458d6ef1f31fbb7c769e18', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286367, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T14:37:51', 'indicator': '926974facfd0383c65458d6ef1f31fbb7c769e18', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286368, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': 'ad7e264eb08415871617e45f21d03f7d71e4c36f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286368, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T14:37:51', 'indicator': 'ad7e264eb08415871617e45f21d03f7d71e4c36f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286369, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T14:37:51', 'indicator': 'c72e7540d6f12d74d8e737b02f31568385f575d7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286369, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': 'c72e7540d6f12d74d8e737b02f31568385f575d7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286370, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T14:37:51', 'indicator': 'fa9e65e58eb8fa41fde0a0a870b7d24b298026d9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286370, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': 'fa9e65e58eb8fa41fde0a0a870b7d24b298026d9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286371, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-23T14:37:51', 'indicator': '97c1266ac21a35f1d82781c30378d563769ce144d903d93d4bfea533103044a3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324286371, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '97c1266ac21a35f1d82781c30378d563769ce144d903d93d4bfea533103044a3', 'is_active': 1, 'expiration': None, 'description': 'SHA256 of 039eb329a173fce7efeca18611a8f2c0f7d24609'}, {'id': 4325809790, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '136ad515aeb19cada0703dfe146567f1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4325809791, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '46846ddc7c614331a55623d7c9fa7974', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4325809792, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '51ff3568763f1c290ee21d963d1e2348', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4325809793, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '9f767cfa8c1716e7e3cc64a87e6fec02', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4325809794, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': 'a79e31eddff524646f98a2c14881f6ad', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4325809795, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': 'f4d4581704501e4088312abd9f7bb4ad', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4325809796, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '023fdb1a859f73f1716f5ec0c8a01a964b702de3b4fd63a3bc7a966cdd39d427', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4325809797, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '860069ddb5fb78f19698c6951bb67b5183016cfa813d109699130dafcc55789c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4325809798, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '8c872595fa8fa58a657584a0172aa20eb18f60fcfc955dec41144a002037b10e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4325809799, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': '9c2d91b76e495e917d9064ef25352c8bfe913cc67f0aab0fda4beabcb07c90aa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4325809800, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': 'ca5caa6bc20f9153360e5789ec511235046952a77f3f72b35fefec9b1c342f98', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4325809801, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-24T09:03:00', 'indicator': 'dd85e137e876a32e5dbedf8a8441d3a1c68f97f4c2304ed862438d6c4cc76348', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 36}

c4f763bd0de757f9be9f4e386fdeae898a64a8417bb47e5cf7a99ec45b58e8a6

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69ea29a2df2a3f26872b6e15

ineracaspsl.site

domain

DinDoor Backdoor: Deno Runtime Abuse and 20 Active C2 Servers

DinDoor is a Deno-based backdoor delivered via MSI files that exploits the Deno runtime to execute obfuscated JavaScript for command and control communications and system fingerprinting. Two analyzed samples show different execution behaviors: one writes JavaScript to disk while the other executes entirely in memory. Both samples use identical fingerprinting algorithms generating unique victim identifiers. One sample contains an embedded JWT exposing campaign metadata and the domain serialmenot[.]com, identified as multi-tenant infrastructure serving multiple threat actors including state-sponsored groups and cybercriminals. Analysis of HTTP response headers enabled identification of 20 active C2 servers across 15 autonomous systems, many using bulletproof hosting providers. The malicious infrastructure uses Caddy proxy with distinctive headers allowing network-based detection.

2026-04-23 14:16:02.952000+03:00

2026-05-23 14:01:56.194000+03:00

['castleloader', 'deno runtime', 'caddy proxy', 'tsundere botnet']

['DinDoor', 'Tsundere Botnet', 'CastleLoader', 'CastleRAT', 'ChainShell']

['https://hunt.io/blog/dindoor-deno-runtime-backdoor-msi-analysis']

{'pulse_id': '69ea29a2df2a3f26872b6e15', 'indicators': [{'id': 4136079731, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'ineracaspsl.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4214237618, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'serialmenot.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4218288516, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'justtalken.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4240175920, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'hngfbgfbfb.cyou', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4243021505, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': '2a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4247044883, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': '5c057af2f358fc10107d5ccdb39938ad', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4247044903, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'e2e8516b4f275e8c636620b7377ee3b9f9f47bb0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4293582144, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'agilemast3r.duckdns.org', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322604046, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'grafana.healthydefinitetrunk.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324226805, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': '7b793c54a927da36649eb62b9481d5bcf1e9220035d95bbfb85f44a6cc9541ae', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324226825, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'http://serialmenot.com/mv2/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324226826, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'aeeracaspsl.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324226827, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'annaionovna.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324226828, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'bitatits.surf', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324226829, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'generalnewlong.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324226830, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'ilspaeysoff.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324226831, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'landmas.info', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324226832, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'myspaeysoff.site', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324226833, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'bandage.healthydefinitetrunk.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324226834, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': 'surgery.healthydefinitetrunk.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324285803, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': '6d56ec35c1bb1e44a8d6ee201845aa05', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324285804, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T14:16:03', 'indicator': '197fb8bf3d6064a9f3272b8222cab6d5cf4f24de', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 22}

a78fc0293d2ac097166afc78611daac77e6f1f155f640ca20e9c746bc87e539c

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69e9d8ba4c0b0df25b764711

2d7cc3646c287d6355def362916c6d26

FileHash-MD5

Malicious Campaign Deploying AdaptixC2 Beacon and VS Code via Trojanized SumatraPDF

On March 12, 2026, a sophisticated attack campaign was identified targeting Chinese-speaking individuals using military-themed document lures distributed through a malicious ZIP archive. The operation employed a trojanized SumatraPDF binary as the initial vector to deploy an AdaptixC2 Beacon and Visual Studio Code on victim systems. The shellcode loader demonstrated significant similarities to the TOSHIS loader previously linked to TAOTH campaigns. Attackers established a custom AdaptixC2 Beacon listener utilizing GitHub for command-and-control infrastructure. The staging server infrastructure additionally hosted CobaltStrike Beacon and EntryShell backdoor, both previously associated with this threat group. The campaign infrastructure included multiple compromised domains and IP addresses for malware distribution and C2 communications.

2026-04-23 08:30:50.632000+03:00

2026-05-23 08:20:01.501000+03:00

['sumatrapdf', 'cobaltstrike', 'adaptixc2 beacon', 'entryshell', 'toshis', 'tropic trooper', 'chinese targets', 'cobaltstrike beacon', 'toshis loader', 'adaptixc2', 'github c2']

['AdaptixC2 Beacon', 'CobaltStrike Beacon', 'EntryShell', 'TOSHIS']

[]

{'pulse_id': '69e9d8ba4c0b0df25b764711', 'indicators': [{'id': 4324125661, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '2d7cc3646c287d6355def362916c6d26', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125662, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '3238d2f6b9ea9825eb61ae5e80e7365c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125663, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '67fcf5c21474d314aa0b27b0ce8befb2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125664, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '71fa755b6ba012e1713c9101c7329f8d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125665, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '89daa54fada8798c5f4e21738c8ea0b4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125666, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '9a69b717ec4e8a35ae595aa6762d3c27', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125667, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': 'c620b4671a5715eec0e9f3b93e6532ba', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125668, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': 'e2dc48ef24da000b8fc1354fa31ca9ae', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125669, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '19e3c4df728e3e657cb9496cd4aaf69648470b63', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125670, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '2c65433696037f4ce0f8c9a1d78bdd6835c1b94d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125671, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '343be0f2077901ea5b5b9fb97d97892ac1a907e6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125672, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '401cc16d79d94c32da3f66df21d66ffd71603c14', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125673, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '6c68dc2e33780e07596c3c06aa819ea460b3d125', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125674, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': 'adb47733c224fc8c0f7edc61becb578e560435ab', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125675, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': 'bd618c9e1e10891fe666839650fa406833d70afd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125676, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': 'c2051635ccfdc0b48c260e7ceeee3f96bf026fea', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125677, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '3936f522f187f8f67dda3dc88abfd170f6ba873af81fc31bbf1fdbcad1b2a7fb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125678, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '3c29c72a59133dd9eb23953211129fd8275a11b91a3b8dddb3c6e502b6b63edb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125679, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '47c7ce0e3816647b23bb180725c7233e505f61c35e7776d47fd448009e887857', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125680, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '6eaea92394e115cd6d5bab9ae1c6d088806229aae320e6c519c2d2210dbc94fe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125681, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': '7a95ce0b5f201d9880a6844a1db69aac7d1a0bf1c88f85989264caf6c82c6001', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125682, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': 'a4f2131eb497afe5f78d8d6e534df2b8d75c5b9b565c3ec17a323afe5355da26', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125683, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': 'aeec65bac035789073b567753284b64ce0b95bbae62cf79e1479714238af0eb7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125684, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': 'b92a3a1cf5786b6e08643483387b77640cd44f84df1169dd00efde7af46b5714', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125687, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': 'https://47.76.236.58:4430/Divide/developement/GIZWQVCLF', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125688, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': 'https://47.76.236.58:4430/Originate/contacts/CX4YJ5JI7RZ', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125689, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': 'https://stg.lsmartv.com:8443/Divide/developement/GIZWQVCLF', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125690, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': 'https://stg.lsmartv.com:8443/Originate/contacts/CX4YJ5JI7RZ', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324125691, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-23T08:30:51', 'indicator': 'stg.lsmartv.com', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 29}

74b0a5313e6fafcc254a0c478c174c7f4fca92474596ef18e97247ec68f6be3d

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69e991829321a6135dcd0a13

b2d9a99de44a7cd8faf396d0482268369d14a315edaf18a36fa273ffd5500108

FileHash-SHA256

Beyond PowerShell: Analyzing the Multi-Action ClickFix Variant

This analysis documents a newly observed ClickFix variant that abuses native Windows utilities, specifically cmdkey and regsvr32, for payload delivery. Victims are socially engineered through fake CAPTCHA pages to execute a malicious command via the Windows Run dialog. The single command chains multiple actions: staging credentials using cmdkey, retrieving a remote DLL via regsvr32 from a UNC path, and executing it silently. The 64-bit DLL establishes persistence through a scheduled task pulled from a remote XML file hosted on attacker infrastructure. This approach avoids traditional malware drops and leverages exclusively trusted Windows components for high stealth. The variant demonstrates continued evolution of ClickFix techniques, moving beyond PowerShell to use command chaining with legitimate system tools.

2026-04-23 03:26:58.577000+03:00

2026-05-23 08:20:01.501000+03:00

['scheduled task', 'social engineering', 'clickfix', 'cmdkey', 'unc path', 'lolbins', 'remote dll', 'regsvr32']

[]

['https://www.cyberproof.com/blog/beyond-powershell-analyzing-the-multi-action-clickfix-variant/']

{'pulse_id': '69e991829321a6135dcd0a13', 'indicators': [{'id': 4324129199, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-23T03:26:59', 'indicator': 'b2d9a99de44a7cd8faf396d0482268369d14a315edaf18a36fa273ffd5500108', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324129199, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-23T08:56:35', 'indicator': 'b2d9a99de44a7cd8faf396d0482268369d14a315edaf18a36fa273ffd5500108', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 2}

d34eedfba16d056974a3e2cd811df56cd90018467d73090487fe65e52ba1fae6

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69e991a518634e661de0c8eb

https://flare.io/learn/resources/north-korean-infiltrator-threat

URL

Unmasking DPRK Cyber Threat Actors: Fake IT Worker Infrastructure

Investigation of DPRK-linked fake IT worker infrastructure began after cryptocurrency researcher ZachXBT identified domain luckyguys[.]site connected to illicit payments. Analysis of 30 days of network activity associated with IP 163.245.219[.]19 revealed concentrated VPN usage patterns, with Astrill VPN (37.5%), Mullvad (32.25%), and Proton VPN (6.25%) being prominent. American and Latvian residential IPs communicated with the infrastructure, showing frequent Astrill VPN usage and connectivity to Gmail, ChatGPT, and Workana freelance platform. A second IP, 216.158.225[.]144, was discovered through X509 certificate analysis. Traffic dropped sharply following public exposure, consistent with adversary behavior of abandoning attributed infrastructure. The activity suggests a distributed network of remote IT workers participating in sanctions evasion workflows, leveraging AI tools and freelance platforms to obtain employment under false identities.

2026-04-23 03:27:33.908000+03:00

2026-05-23 03:09:17.599000+03:00

['dprk', 'astrill vpn', 'vpn infrastructure', 'freelance platforms', 'fake it workers', 'cryptocurrency fraud', 'residential proxies', 'sanctions evasion']

[]

['https://www.team-cymru.com/post/dprk-fake-it-worker-cyber-threat-actors-infrastructure']

{'pulse_id': '69e991a518634e661de0c8eb', 'indicators': [{'id': 4324129220, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-23T03:27:34', 'indicator': 'https://flare.io/learn/resources/north-korean-infiltrator-threat', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324129221, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-23T03:27:34', 'indicator': 'luckyguys.site', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 2}

4d87899da48b338f91511be18ad54d56ca648d549cbff686202b8a33e9af41df

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69e9526908d4b6c7e9c97fed

d47de3772f2d61a043e7047431ef4cf4

FileHash-MD5

Malicious Artifacts Found in Official KICS Docker Repository and Code Extensions

Docker and Socket uncovered a supply chain compromise affecting Checkmarx KICS distribution channels. Attackers poisoned official Docker Hub images (tags v2.1.20, v2.1.21, alpine) and VS Code extensions (versions 1.17.0, 1.19.0), introducing unauthorized data exfiltration capabilities. The trojanized KICS binary collects and encrypts scan reports containing credentials from infrastructure-as-code files, transmitting them to external endpoints. Compromised VS Code extensions download mcpAddon.js via Bun runtime, harvesting GitHub tokens, AWS credentials, Azure tokens, npm configurations, and SSH keys. The malware creates public GitHub repositories for staging stolen data, injects malicious GitHub Actions workflows to capture repository secrets, and uses stolen npm credentials to identify writable packages for propagation. TeamPCP appears to claim responsibility for this multi-stage attack designed to steal developer credentials and propagate through CI/CD pipelines.

2026-04-22 22:57:45.610000+03:00

2026-05-22 22:09:48.400000+03:00

['docker hub poisoning', 'github actions', 'mcpaddon.js', 'credential theft', 'npm propagation', 'ci/cd compromise', 'canister worm', 'checkmarx kics', 'vs code extension', 'supply chain compromise']

['mcpAddon.js', 'Canister Worm']

['https://socket.dev/blog/checkmarx-supply-chain-compromise']

{'pulse_id': '69e9526908d4b6c7e9c97fed', 'indicators': [{'id': 4324027680, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': 'd47de3772f2d61a043e7047431ef4cf4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027681, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': 'e1023db24a29ab0229d99764e2c8deba', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027682, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': '250f3633529457477a9f8fd3db3472e94383606a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027683, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': '2b12cc5cc91ec483048abcbd6d523cdc9ebae3f3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027684, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': 'bbbca2ddaa5d8feaa63e36b76fdaad77386f024f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027685, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': 'de0fac2e4500dabe0009e67214ff5f5447ce83dd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027686, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': '222e6bfed0f3bb1937bf5e719a2342871ccd683ff1c0cb967c8e31ea58beaf7b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027687, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': '24680027afadea90c7c713821e214b15cb6c922e67ac01109fb1edb3ee4741d9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027688, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': '2588a44890263a8185bd5d9fadb6bc9220b60245dbcbc4da35e1b62a6f8c230d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027689, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': '26e8e9c5e53c972997a278ca6e12708b8788b70575ca013fd30bfda34ab5f48f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027690, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': '2a6a35f06118ff7d61bfd36a5788557b695095e7c9a609b4a01956883f146f50', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027691, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': '415610a42c5b51347709e315f5efb6fffa588b6ebc1b95b24abf28088347791b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027692, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': '7391b531a07fccbbeaf59a488e1376cfe5b27aef757430a36d6d3a087c610322', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027693, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': 'a0d9366f6f0166dcbf92fcdc98e1a03d2e6210e8d7e8573f74d50849130651a0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027694, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': 'a6871deb0480e1205c1daff10cedf4e60ad951605fd1a4efaca0a9c54d56d1cb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027695, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': 'd186161ae8e33cd7702dd2a6c0337deb14e2b178542d232129c0da64b1af06e4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027696, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': 'ff7b0f114f87c67402dfc2459bb3d8954dd88e537b0e459482c04cffa26c1f07', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027697, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': 'https://audit.checkmarx.cx/v1/telemetry', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027698, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-22T22:57:46', 'indicator': 'audit.checkmarx.cx', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 19}

fa439b3da7018efdcf5828a011abe7967b052905c1b3956340e65760e73e2607

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69e95245cf3877ded3870cff

CVE-2025-30406

CVE

Untangling a Linux Incident With an OpenAI Twist (Part 2)

A Linux endpoint was simultaneously compromised by at least two distinct threat actors while the developer user relied on OpenAI's Codex AI agent for security remediation. Actor A deployed a cryptominer mining Monero to a private pool. Actor B installed a multi-revenue botnet including XMRig mining, residential proxy services, and bandwidth-selling components with eight different persistence mechanisms. Actor C, potentially affiliated with Actor B, executed mass data exfiltration of 15 categories including SSH keys, cloud credentials, and API tokens. The threat actors exploited CVE-2025-55182 (React2Shell) affecting Next.js and React applications. While Codex identified some threats, it lacked contextual awareness and privileged access needed for comprehensive incident response, creating additional noise that complicated SOC investigation. The endpoint was ultimately secured through managed EDR telemetry and expert SOC analysis.

2026-04-22 22:57:09.022000+03:00

2026-05-22 22:09:48.400000+03:00

['cryptominer', 'repocket', 'botnet', 'linux compromise', 'multiple threat actors', 'credential harvesting', 'systemd-logind', 'dnser', 'ai-assisted remediation', 'earnfm', 'fkkkf', 'cve-2025-55182', 'xmrig', 'fh8a7d7m', 'data exfiltration', 'react2shell']

['XMRig', 'systemd-logind', 'fkkkf', 'FH8a7d7M', 'dnser', 'EarnFM', 'Repocket']

['https://www.huntress.com/blog/codex-part-two']

{'pulse_id': '69e95245cf3877ded3870cff', 'indicators': [{'id': 4057491341, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-04-22T22:57:09', 'indicator': 'CVE-2025-30406', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4157551390, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-04-22T22:57:09', 'indicator': 'CVE-2025-55182', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4281970322, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-22T22:57:09', 'indicator': '0x1x2x3.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027650, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-04-22T22:57:09', 'indicator': 'CVE-2025-31151', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324027651, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T22:57:09', 'indicator': '781c19b56fbdb17284707f9026e107f639e5447df7df3b248a5d5a50c4b0806c', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 5}

ba7d1df40de257946ae5ea391681fba536e7f5e3473320765cc3067cfbe0290d

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69e8c2ea19756cc9d2899dea

fudcrypt.net

domain

Dissecting FudCrypt: A Real-World Malware Crypting Service Analysis

FudCrypt is a Cryptor-as-a-Service platform offering subscription-based malware obfuscation for $800 to $2,000 monthly. The service wraps customer payloads in multi-stage deployment packages featuring DLL sideloading, AMSI and ETW interference, silent UAC elevation via CMSTPLUA, and Windows Defender tampering through Group Policy. Analysis of recovered server infrastructure revealed 200 registered users, 334 builds, and comprehensive fleet C2 command history across 32 enrolled agents. The operator maintains a separate signing infrastructure using four Azure Trusted Signing accounts to sign operator-controlled binaries including fleet agents, native loaders, and ScreenConnect installers. The platform employs 20 undocumented DLL sideload carrier profiles, per-build polymorphic encryption with layered XOR-32, RC4-16, and custom S-box transforms, and an advanced development branch featuring indirect syscalls, module stomping, fiber-based execution, and Ekko sleep obfuscation. Server infrastructure included exp...

2026-04-22 12:45:30.748000+03:00

2026-05-22 12:28:13.772000+03:00

['cmstplua-uac-bypass', 'azure-trusted-signing', 'cryptor-as-a-service', 'dll-sideloading', 'etw-patching', 'amsi-bypass', 'screenconnect', 'fudcrypt']

[]

['https://ctrlaltintel.com/research/FudCrypt-analysis-1/#c2-infrastructure']

{'pulse_id': '69e8c2ea19756cc9d2899dea', 'indicators': [{'id': 117392726, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'fudcrypt.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3464434623, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'e32f72e15f78347c51c4ca1b2847f667', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3464434624, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'de8b253c8aee745fdb082fec5ad0618c2e4cdb92', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3464434625, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '341cb4515476007153b7f17212f5e4476852837a031efedd5a4adea723c0bcbe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3775944129, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'hijacklibs.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4040499934, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '38502a7852b56c500caba4cd92e15a67b745bb778fd452214bbc5599ff738c99', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4132495529, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '36e31f610eef3223154e6e8fd074190f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4132495631, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '1f2800382cd71163c10e5ce0a32b60297489fbb5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4132495963, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '16cbe40fb24ce2d422afddb5a90a5801ced32ef52c22c2fc77b25a90837f28ad', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4160029770, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '2541290195ffe29716ebbc7aac76d82f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4160029806, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'd8e22adc26ef1628b826785682830c3d128a0d43', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4160029840, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'eaa9dc1c9dc8620549fee54d81399488292349d2c8767b58b7d0396564fb43e7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900860, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '3af1da74264645a07ba3647eed9f7641cf90e3abbc1df83fbbeffbdf157e7c2c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900861, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '3c6863139e2679a5f53f0c43f7d74cde593dd8aa0349f38e6939849f02fcf7fe', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900863, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '8339d057c0369f28b6c71fff740206a8a2b8eca170b8e673dfecf2a782ee50a4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900864, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'c35d11ebb1590f051140c2842bc0b6c9f6640389622f13cb422b7a0c6fd73a78', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900865, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '661e613b993e97e2df4bd5bb3940cfbc4944d71b82579d7d81fd5a17da418436', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900866, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '49a87a2d7ca47a0ebef027a9030d5cf2f7bb963e74bccfd3f79e86536277a5d8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900867, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '505a40deaf8f2ab81980a2bab38b1f7d88d6c856b799d8dc087b5f258af9b1c9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900868, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '473a9b4a43ddc907399a6ef09e7b95bbcf9aef5affc388716e3f55e284d5bd07', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900869, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'a6d6fd1b4116e79e4ef53ea4fa84e50b34cf719a5a94786101b90c946b95243b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900870, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '9a099a4c8f6fc22bbf7a76cd2d9dcfcb1563c3640f629710d3027ae126259de0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900871, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'd5e77fe5fc4a64c5cfd6db1ab21133e129c8f7ab180f781c6526cf1adcaf8bb0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900872, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '6d08fef537ad92a618cad3efea018363d5bff84f30669747b49b5dd3789c5555', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900873, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '184c0292f6619e5f0e9cb36f94ba43232175a6212a0ab27a17f39e73cf4fe44b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900874, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '54c094506f8286d6a01e3663a6cf395153b51a7ba9b1e1e49e5183ae54db2550', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900875, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '51f4e8df8b56de1930be0c277ecf76dbe132a1138dff7fdcfc0a0d7cf0d3da45', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900876, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '9b1fb32254fbd31fcb8662b287d7600bf9affe5a4e2b0a753416b4351dbd9736', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900877, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '1602ef30af3b5de3f45ced75594a202a9e938a1b6e9375a210a33d269540430e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900878, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '91dd099c3cfeffe1ea23d864a796c301c80544231a7988cd656030ffd1805fc5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900879, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '14f17d7c548ddf02bbe3479d133ad2241b625fde26ce5ae641b297434c23956b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900880, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'd044df0e67952c40201d70abd676f9b4ce4b168d85ab538d269b6e55b08205a3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900881, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '20094e09a2d2778a3d17fa871c7dec42c39472dd651ad08a8910bcf26139b90d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900882, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'e60aaad86f7b34683979a9391aa31333207c6011d96b9fa2cfef262f6ee6c4ef', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900883, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'f2424e535170ac66b9e0d1650dc6a21f847dfb8e8ed0f04d514f63efd6fe3952', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900884, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '86df162cc93277e058356e566ba9e03266893c80c24bf647a27389348b68ab71', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900885, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '3df7e9107ea51e1067cdfe337c026b2bd0c4395c00fdd394365f24da50489ab5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900886, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '0f36122ac39cc9bd526d5c414939f72841d1c7495e16990f5cd24dbaa0864f79', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900887, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '0cf1d46ebb1eebd5bf79489157f02aa719d5b50445f3eca3fac20f3cb0a581e8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900888, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '56550f342e1297e389a1a62fe3fee82234fab130838682b2d6da0b4ac8965ca8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900889, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '6e8a6741f6cabd174389ce0ac693c2712aa7aca9bd697e9a3eba975bba985b46', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900890, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '2ea66b021040e3ced5627a1f29021c8c7bad3835f01838ee697beabf37a3563f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900891, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'aca5a4791b1efd6b8a20ee73aa20afdde6810b5511b327cf236a4a63e15d279c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900892, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'f10acdceee4f0e472ac60b1b0e68cace74cce08056e48b1534d6f2af218f0b32', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900893, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'f8c92ec4d4ecedc0c234c793b03adf371801c283602a637586e78fa3bb661a1f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900894, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '020aac79a14717e316a593155ca778dd3e253b888bf62633b174838d35df7f41', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900895, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '87b4a42cdd6bf6d4a97e744dd67afef6f35b7ce7355ce8bd00b94613d67a8839', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900896, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': 'f1db698c68543c49d9a19e5725e72a96535a06e787915076d55dfe960a770f8a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900897, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '911c4dca2247dd958c8a9a43b080c9909658a77f497af907b7985ec1b438621c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4320900898, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:45:32', 'indicator': '7fd36bb8a300025b7f2a19c1ba3717de1f4528c943847af1f45d96d05421bc71', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 566}

8d951a37e5057f169da703f3641d4af203660b479258e9c61304aebe3462ee71

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69e8c1fb96869b14e2c565a2

fanonlyatn.xyz

domain

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

A sophisticated multi-stage malware operation was identified through an exposed C2 panel at 103.241.66[.]238:1337, combining cryptocurrency clipboard hijacking across eight chains, BIP-39 seed phrase theft, browser credential exfiltration, ransomware module (crpx0), and Java RAT builder managed via FastAPI-based panel with license key system. The operation targets Windows and macOS using FedEx and OnlyFans-themed social engineering lures, with complete source code exposed in open directories. The ransomware component communicates with three Russian .ru domains resolving to 31.31.198[.]206 at REG.RU hosting, operating under the identity DataBreachPlus with Telegram, qTox, and ProtonMail contacts. Ten cryptocurrency wallet addresses spanning Bitcoin, Ethereum, Tron, Dogecoin, Litecoin, Solana, Ripple, and Bitcoin Cash were extracted from configurations, indicating a Malware-as-a-Service operation with tiered licensing.

2026-04-22 12:41:31.240000+03:00

2026-05-22 12:28:13.772000+03:00

['crypto clipper', 'twizadmin', 'multi-platform', 'russian-speaking', 'infostealer', 'crpx0', 'maas', 'ransomware', 'cryptocurrency theft']

['TwizAdmin', 'crpx0']

['https://intel.breakglass.tech/post/twizadmin-103-241-66']

{'pulse_id': '69e8c1fb96869b14e2c565a2', 'indicators': [{'id': 4293410066, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'fanonlyatn.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4293410068, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'https://fanonlyatn.xyz/files/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693789, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'https://fanonlyatn.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693790, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': '06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693791, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': '3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693792, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': '584796212f99efc7ac765d6048913fe34e46a64b13a8a78fb3a465b8c61f3527', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693793, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': '74ab520e94b2f3b8915ec7b47abab7a2d7e9759add5aa195af7edf0ffa5b4150', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693794, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': '9d9783f57fd543043e0792d125831883259c823a5eaa69211e5254db4db4eaec', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693795, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'aa11f154b17a4f81f951dbeaab78b58ea012f5b6ea16e4f894bd90971e01bae4', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693796, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'f7ddba605e3d04e06d2f7b0fc4a38027ae58ca65a69d800dd2f43c8e94ca8396', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693797, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'http://fanonlyatn.xyz/files/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693798, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'https://beboss34.ru/crpx0/notify.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693799, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'https://caribb.ru/crpx0/notify.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693800, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'https://fanonlyatn.xyz/api.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693801, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'https://fanonlyatn.xyz/api_address_match.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693802, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'https://fanonlyatn.xyz/api_dropper_log.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693803, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'https://fanonlyatn.xyz/builds/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693804, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'https://mekhovaya-shuba.ru/crpx0/notify.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693805, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'beboss34.ru', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693806, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'caribb.ru', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693807, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'mekhovaya-shuba.ru', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693808, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'secure-shard-091.of-cdn.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322693809, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-22T12:41:32', 'indicator': 'www.fanonlyatn.xyz', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 23}

b93153244071b5c7b3142fd36f6599ada6c60a64ee4237495ecc10a3eb208c94

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a0f8f33ccaf530ec98bd8ae

1vpns.com

domain

Cybercriminal VPN Dismantled in Crackdown

A coordinated law enforcement operation led by France and the Netherlands has successfully taken down First VPN, a service extensively used by ransomware operators, fraudsters, and data thieves to conceal their criminal activities. The operation, which took place from May 19-20, resulted in the dismantling of 33 servers, seizure of three domains, and a house search of the administrator in Ukraine. The VPN service had been advertised on Russian-language cybercrime forums for years, accepting anonymous payments and providing infrastructure specifically designed for illicit use. Investigators gained access to the user database, generating 83 intelligence packages shared internationally, information on 506 users distributed globally, and advancing 21 investigations. The service had appeared in almost every major cybercrime investigation supported by Europol in recent years.

2026-05-21 23:03:15.778000+03:00

2026-05-22 06:47:07.116000+03:00

['takedown', 'law enforcement operation', 'ransomware operators', 'data theft', 'cybercrime forums', 'fraud operations', 'europol', 'first vpn']

[]

['https://www.infosecurity-magazine.com/news/first-vpn-takedown-europol/']

{'pulse_id': '6a0f8f33ccaf530ec98bd8ae', 'indicators': [{'id': 4056545429, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T23:03:16', 'indicator': '1vpns.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370487422, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T23:03:16', 'indicator': '1vpns.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370487423, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T23:03:16', 'indicator': '1vpns.org', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 3}

3b0be657d6c3028841c02f0451262d412f5c3488871c8fc5947ab763fa09487f

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69e827168edcf67707285b4e

editor.gleeze.com

hostname

Same packet, different magic: Hits India's banking sector and Korea geopolitics

A new variant of the LOTUSLITE backdoor, version 1.1, has been identified targeting India's banking sector and South Korean diplomatic circles. The backdoor is delivered via DLL sideloading using legitimate Microsoft-signed executables and initially through CHM files containing malicious JavaScript. It communicates with dynamic DNS-based command-and-control servers over HTTPS, supporting remote shell access, file operations and session management. Code-level analysis reveals direct lineage to LOTUSLITE v1.0, including identical command structures, shared persistence mechanisms, and residual exports from the original codebase. The campaign demonstrates incremental improvements including updated magic values, API resolution techniques, and delivery mechanisms evolving from CHM-based to JavaScript loaders to DLL sideloading. Infrastructure hosted under Dynu Systems shows continuity with previous operations.

2026-04-22 01:40:38.268000+03:00

2026-05-22 02:03:39.507000+03:00

['espionage', 'chm files', 'backdoor', 'south korea diplomacy', 'lotuslite', 'dll sideloading', 'india banking', 'javascript loader']

['LOTUSLITE']

['https://www.acronis.com/en/tru/posts/same-packet-different-magic-mustang-panda-hits-indias-banking-sector-and-korea-geopolitics/']

{'pulse_id': '69e827168edcf67707285b4e', 'indicators': [{'id': 4284213163, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-22T01:40:39', 'indicator': 'editor.gleeze.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322481981, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-04-22T01:40:39', 'indicator': '5abac6560eeb77f71e4cd2e1b33d973e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322481982, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-04-22T01:40:39', 'indicator': '1ffd797a49df270494b8cb2d2d0d679387fbd44a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322481983, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:39', 'indicator': '18bc0e0f627d90fb283aa243055b46d0bfb5d85a7240d8f63ec2d1c8a2c15893', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322481984, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:39', 'indicator': '6d22d50634c2c2fc853bfd2b564e1837d51087aa684a9c4415634c8c13c44135', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322481985, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:39', 'indicator': '7beede15ecdc7d3f01db4b699e5fe5f4f2e7c79cd7ef0e918ed0583bf621de7d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322481986, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:39', 'indicator': '9bf2f3b15a621789f898f9bd7710ba857e3f238a4937b64fdc47ef9a92e0b05d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322481987, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:39', 'indicator': 'af31ebe9085df408bedcf8f027fb60389897e5c8d3b0e9695fea29774f9d3aec', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322481988, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:39', 'indicator': 'cc0ff7e25ea686171919575916e2d9ebaeb5800a063f370a6980ea791f8851b8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322481989, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-22T01:40:39', 'indicator': 'cosmosmusic.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322481990, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-22T01:40:39', 'indicator': 'www.cosmosmusic.com', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 11}

68e2e603451a8e2b3ee2005a1636888aea8547cea75fbddf239a68df2833860f

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69e82714e5cf2d1fb9fe1b0a

livemicrosft.com

domain

Mach-O Man Malware: What CISOs Need to Know

Lazarus Group is conducting an active campaign targeting businesses through ClickFix attacks, distributing a newly identified macOS malware kit called "Mach-O Man". The attack begins with fake meeting invitations via Telegram, redirecting victims to fraudulent collaboration platforms impersonating Zoom, Microsoft Teams, or Google Meet. Victims are tricked into executing terminal commands that install the malware. The kit consists of Go-based Mach-O binaries including a stager, profiler, persistence mechanism, and stealer. The malware collects credentials, browser data, and macOS Keychain entries, exfiltrating data through Telegram. Primary targets include fintech, crypto, and high-value environments where macOS is prevalent. The campaign leverages social engineering and native macOS binaries to evade traditional EDR detection, ultimately enabling account takeover, unauthorized infrastructure access, and financial loss.

2026-04-22 01:40:36.560000+03:00

2026-05-22 00:19:59.440000+03:00

['mach-o man', 'browser stealing', 'pylangghostrat', 'social engineering', 'macos', 'mach-o binaries', 'telegram exfiltration', 'credential theft', 'clickfix', 'fintech targeting']

['Mach-O Man', 'PyLangGhostRAT']

['https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/']

{'pulse_id': '69e82714e5cf2d1fb9fe1b0a', 'indicators': [{'id': 4291974558, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': 'livemicrosft.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4304211529, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': '0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4304211530, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': '24af069b8899893cfc7347a4e5b46d717d77994a4b140d58de0be029dba686c9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4304211531, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': '4b08a9e221a20b8024cf778d113732b3e12d363250231e78bae13b1f1dc1495b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4304211532, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': '85bed283ba95d40d99e79437e6a3161336c94ec0acbc0cd38599d0fc9b2e393c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4304211533, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': '871d8f92b008a75607c9f1feb4922b9a02ac7bd2ed61b71ca752a5bed5448bf3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4304211534, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': '89616a503ffee8fc70f13c82c4a5e4fa4efafa61410971f4327ed38328af2938', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4304211535, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': 'a9562ab6bce06e92d4e428088eacc1e990e67ceae6f6940047360261b5599614', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4304211536, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': 'cc31b3dc8aeed0af9dd24b7e739f183527d55d5b5ecd3d93ba45dd4aaa8ba260', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4304211537, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': 'dfee6ea9cafc674b93a8460b9e6beea7f0eb0c28e28d1190309347fd1514dbb6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4304211538, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': 'eb3eae776d175f7fb2fb9986c89154102ba8eabfde10a155af4dfb18f28be1b5', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322481965, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': 'a73ce18952b40fd621789e43c56b2af08d1497ce3560b2481fa973d8265ce491', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322481966, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': 'http://172.86.113.102/localencode', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322481967, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': 'http://livemicrosft.com/meet/89035563931?p=9jXK14VFM8fObdKxfkake8tD7rPhzs.1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322481968, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': 'http://update-teams.live/teams', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322481969, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-22T01:40:37', 'indicator': 'update-teams.live', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 16}

6c8ce7dd111441f63fcfe07bd3c5ed39cafe168e3c8cb2b645069e9e6a9bca6d

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a0df33ecc667be61a0a9608

CVE-2017-7692

CVE

New burrowing techniques

Webworm is a China-aligned APT group that has evolved its tactics since first being discovered in 2022, shifting focus from Asian targets to European governmental organizations. In 2025, the group deployed two new backdoors: EchoCreep, which uses Discord for command and control, and GraphWorm, which leverages Microsoft Graph API. Researchers decrypted over 400 Discord messages revealing four victims and analyzed a compromised Amazon S3 bucket used for data exfiltration. The group stages tools in GitHub repositories and uses multiple custom proxy solutions including WormFrp, ChainWorm, SmuxProxy, and WormSocket to create hidden networks. Webworm appears to exploit web vulnerabilities using tools like nuclei and dirsearch for initial access, targeting government entities and educational institutions across Europe and South Africa.

2026-05-20 17:45:34.947000+03:00

2026-05-21 16:53:24.254000+03:00

['wormfrp', 'github staging', 'discord c&c', 'cloud infrastructure', 'wormsocket', 'apt', 'china-aligned', 'mcrat', 'chainworm', 'proxy tools', 'vulnerability scanning', 'smuxproxy', 'trochilus', 'echocreep', 'cve-2017-7692', 'microsoft graph api', 'graphworm']

['EchoCreep', 'GraphWorm', 'WormFrp', 'ChainWorm', 'SmuxProxy', 'WormSocket', 'Hydraq - S0203', 'Roarur', 'MdmBot', 'HomeUnix', 'Homux', 'HidraQ', 'HydraQ', 'McRat', 'Aurora', '9002 RAT', 'Trochilus']

['https://www.welivesecurity.com/en/eset-research/webworm-new-burrowing-techniques/']

{'pulse_id': '6a0df33ecc667be61a0a9608', 'indicators': [{'id': 2199221146, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-20T17:45:35', 'indicator': 'CVE-2017-7692', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4369976457, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-20T17:45:35', 'indicator': '1df40a4a31b30b62ec33dc6fecc2c4408302adc7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4369976458, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-20T17:45:35', 'indicator': '77f1970d620216c5fff4e14a6ccc13fccc267217', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4369976459, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-20T17:45:35', 'indicator': '7dcfe9ee25841dfd58d3d6871bf867fe32141dfb', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4369976460, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-20T17:45:35', 'indicator': '948159a7fc2e688386864bea59fd40dffc4b24d6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4369976461, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-20T17:45:35', 'indicator': 'a3c077bdf8898e612ccd65bc82e7960834adb2a9', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4369976462, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-20T17:45:35', 'indicator': 'cb4e50433336707381429707f59c3cbe8d497d98', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 7}

6ae478093c9eb5efd0690f9488706da554c1f28f6b582f56c59f6dbe35f7d37f

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a0e37bba2c6b50f5bf38278

apkafa.com

domain

Uncovering a Global Android Carrier Billing Fraud Campaign

A sophisticated Android malware campaign has been identified conducting carrier billing fraud through premium SMS abuse across Malaysia, Thailand, Romania, and Croatia. The operation comprises nearly 250 malicious applications that selectively target users based on their mobile operators, silently subscribing victims to premium services without consent. The malware demonstrates advanced capabilities including precise regional targeting with hardcoded SIM operator validation, automated subscription workflows using WebView manipulation and JavaScript injection, OTP interception via abuse of Google's SMS Retriever API, and Telegram-based exfiltration of device metadata. The campaign impersonates popular applications including Facebook, Instagram, TikTok, Minecraft, and Grand Theft Auto to lure victims. Active from March 2025 through January 2026, the operation employs three distinct variants with increasing levels of sophistication, utilizing distributed command and control infrastructure and systematic refer...

2026-05-20 22:37:47.550000+03:00

2026-05-21 16:51:58.805000+03:00

['android', 'telegram exfiltration', 'otp interception', 'webview manipulation', 'sms retriever api', 'premium sms', 'carrier billing fraud', 'southeast asia']

[]

['https://zimperium.com/blog/premium-deception-uncovering-a-global-android-carrier-billing-fraud-campaign']

{'pulse_id': '6a0e37bba2c6b50f5bf38278', 'indicators': [{'id': 4370230458, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-20T22:37:48', 'indicator': 'apkafa.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370230459, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-20T22:37:48', 'indicator': 'modobomz.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370230460, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-20T22:37:48', 'indicator': 'api.modobomco.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370230461, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-20T22:37:48', 'indicator': 'apizep.mwmze.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370230462, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-20T22:37:48', 'indicator': 'onesignal.mwmze.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370230463, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-20T22:37:48', 'indicator': 'onesignalmdb.modobomz.com', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 6}

2bc415bdc60ae283481ef71ee209997699e733cb741daeb8d0185eb8e1af4e8f

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a0c5b666ccb232590e33087

b06b126b9e26af03a7ef2f8b8e90d446

FileHash-MD5

The Worm That Keeps on Digging: Latest Wave

A sophisticated supply chain campaign targeting the open source developer ecosystem has emerged, compromising NPM packages in the @antv namespace, GitHub Actions including actions-cool/issues-helper, and the VSCode extension nrwl.angular-console. The malware initiates multi-stage infection chains using GitHub-hosted infrastructure and orphaned commits to deploy payloads via bun. It harvests extensive credentials including GitHub tokens, SSH keys, cloud credentials, and browser secrets, exfiltrating data through attacker-controlled public GitHub repositories. The campaign establishes persistence through a Python backdoor that polls GitHub for signed commands containing specific trigger strings, enabling remote code execution. Infrastructure analysis and operational patterns indicate moderate confidence attribution to the threat actor TeamPCP.

2026-05-19 12:45:26.087000+03:00

2026-05-21 16:49:27.291000+03:00

['npm packages', 'supply chain attack', 'github actions', 'credential theft', 'cicd compromise', 'vscode extension', 'backdoor persistence', 'developer environments']

[]

['https://www.wiz.io/blog/mini-shai-hulud-teampcp-hits-antv-supply-chain']

{'pulse_id': '6a0c5b666ccb232590e33087', 'indicators': [{'id': 4367347951, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-19T12:45:26', 'indicator': 'b06b126b9e26af03a7ef2f8b8e90d446', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367347952, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-19T12:45:26', 'indicator': '783b4019fc5b942a29846132d28441c8fc31bed8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367347953, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-19T12:45:26', 'indicator': 'fb5c97557230a27460fdab01fafcfabeaa49590bafd5b6ef30501aa9e0a51142', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367347955, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-19T12:45:26', 'indicator': 'm-kosche.com', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 4}

2632201ec25cbfcb171b8350de46259a6ee0ad08c6da2dc50b15ce7948c43cd6

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a0e803c81c123ee6cf7066a

mickeymousegamesdealer.alexavegas.icu

hostname

Fresh mischief and digital shenanigans

FrostyNeighbor, a cyberespionage group allegedly operating from Belarus and active since at least 2016, continues targeting governmental, military, and key sectors in Eastern Europe, particularly Ukraine, Poland, and Lithuania. Recent activities detected since March 2026 show the group targeting Ukrainian governmental organizations using evolved compromise chains. The attacks utilize spearphishing with malicious PDF lures impersonating legitimate entities, delivering JavaScript variants of PicassoLoader downloader. The group employs server-side victim validation based on geolocation and fingerprinting before manually delivering Cobalt Strike beacons. FrostyNeighbor demonstrates high operational maturity through diverse delivery mechanisms, exploitation of legitimate services, and regular toolset updates to evade detection, while maintaining focus on credential harvesting and establishing persistent access to compromised systems.

2026-05-21 03:47:08.397000+03:00

2026-05-21 16:48:31.304000+03:00

['belarus', 'ukraine', 'cobalt strike', 'cve-2023-38831', 'cyberespionage', 'cve-2024-42009', 'eastern europe', 'governmental targeting', 'spearphishing', 'picassoloader']

['PicassoLoader', 'Cobalt Strike - S0154']

['https://www.welivesecurity.com/en/eset-research/frostyneighbor-fresh-mischief-digital-shenanigans/']

{'pulse_id': '6a0e803c81c123ee6cf7066a', 'indicators': [{'id': 4360782289, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': 'mickeymousegamesdealer.alexavegas.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4360782289, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'mickeymousegamesdealer.alexavegas.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4360782290, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'book-happy.needbinding.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4360782290, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': 'book-happy.needbinding.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4360782291, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'attachment-storage-asset-static.needbinding.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4360782291, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': 'attachment-storage-asset-static.needbinding.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4360782292, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': 'easiestnewsfromourpointofview.algsat.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4360782292, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'easiestnewsfromourpointofview.algsat.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4360782293, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': 'nama-belakang.nebao.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4360782293, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'nama-belakang.nebao.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4360782294, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'best-seller.lavanille.buzz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4360782294, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': 'best-seller.lavanille.buzz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4360782295, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': 'shinesafar.sardk.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4360782295, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'shinesafar.sardk.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4360782296, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': 'hinesafar.sardk.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4360782296, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'hinesafar.sardk.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279544, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': '27fa11f6a1d653779974b6fb54de4af47f211232', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279544, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': '27fa11f6a1d653779974b6fb54de4af47f211232', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279546, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': '3fa7d1b13542f1a9eb054111f9b69c250af68643', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279546, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': '3fa7d1b13542f1a9eb054111f9b69c250af68643', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279547, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': '43e30be82d82b24a6496f6943ecb6877e83f88ab', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279547, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': '43e30be82d82b24a6496f6943ecb6877e83f88ab', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279548, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': '4e52c92709a918383e90534052aaa257ace2780c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279548, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': '4e52c92709a918383e90534052aaa257ace2780c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279549, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': '4f2c1856325372b9b7769d00141dbc1a23bddd14', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279549, 'role': None, 'type': 'FileHash-SHA1', 'title': 'invalid_trailer_structure', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': '4f2c1856325372b9b7769d00141dbc1a23bddd14', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279552, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': '6fded427a16d5314ba3e1eb9afd120dc84449769', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279552, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': '6fded427a16d5314ba3e1eb9afd120dc84449769', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279553, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': '776a43e46c36a539c916ed426745ee96e2392b39', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279553, 'role': None, 'type': 'FileHash-SHA1', 'title': 'RAR_Archive', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': '776a43e46c36a539c916ed426745ee96e2392b39', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279555, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': '7e537d8e91668580a482bd77a5a4caba26d6bdac', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279555, 'role': None, 'type': 'FileHash-SHA1', 'title': 'compromised_site_redirector_fromcharcode', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': '7e537d8e91668580a482bd77a5a4caba26d6bdac', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279556, 'role': None, 'type': 'FileHash-SHA1', 'title': 'SUSP_obfuscated_JS_obfuscatorio', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': '8d1f2a6df51c7783f2eaf1a0fc0ff8d032e5b57f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279556, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': '8d1f2a6df51c7783f2eaf1a0fc0ff8d032e5b57f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279557, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'b65551d339aece718ea1465bf3542c794c445efc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279557, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': 'b65551d339aece718ea1465bf3542c794c445efc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279559, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'd89e5524e49199b1c3b66c524e7a63c3f0a0c199', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279559, 'role': None, 'type': 'FileHash-SHA1', 'title': 'invalid_trailer_structure', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': 'd89e5524e49199b1c3b66c524e7a63c3f0a0c199', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279560, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': 'e15abee1cfde8be7d87c7c0b510450bad6bc0906', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279560, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'e15abee1cfde8be7d87c7c0b510450bad6bc0906', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279561, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'exavegas.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279562, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'fa6882672ad3654800987613310d7c3fbade027e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279562, 'role': None, 'type': 'FileHash-SHA1', 'title': 'compromised_site_redirector_fromcharcode', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': 'fa6882672ad3654800987613310d7c3fbade027e', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279563, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'https://book-happy.needbinding.icu/employment/documents-and-resources', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279564, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'https://book-happy.needbinding.icu/wp-content/uploads/2023/10/1GreenAM.jpg', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4362279566, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'https://nama-belakang.nebao.icu/statistics/discover.txt', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4364064859, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'mickeymousegamesdealer.al', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4364064861, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'static.needbinding.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4364064862, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T03:47:09', 'indicator': 'view.algsat.icu', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4364064863, 'role': None, 'type': 'FileHash-MD5', 'title': 'SUSP_obfuscated_JS_obfuscatorio', 'content': '', 'created': '2026-05-21T16:37:58', 'indicator': '4fd6063141ef6edfeb23fdd8a1f97d2e', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 8d1f2a6df51c7783f2eaf1a0fc0ff8d032e5b57f'}], 'indicators_count': 73}

5b77a280ae9319834ade0671d7be488d8153dd99dca2507c77266e0073484dd2

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a0f06676dfe8431915ed38a

jalwat.com

domain

Ghost CMS Mass Compromised via CVE-2026-26980, Now Fueling ClickFix Attacks

Attackers exploited CVE-2026-26980, a critical SQL injection vulnerability in Ghost CMS, to obtain Admin API Keys without authorization and conduct mass website poisoning campaigns. Over 700 domains across multiple industries including universities, blockchain, AI, security research, and media were compromised. The attack chain involves CMS takeover, page poisoning with malicious JavaScript loaders, two-stage cloaking scripts, and FakeCaptcha social engineering to trick users into executing malicious commands. Two distinct threat groups are actively exploiting unpatched Ghost CMS installations, delivering information stealers and remote access tools. Compromised sites include Harvard University, Oxford University, and Auburn University. The attacks leverage users' trust in legitimate websites to increase success rates of ClickFix-type attacks, with payloads being dynamically distributed through Cloudflare-proxied domains.

2026-05-21 13:19:35.593000+03:00

2026-05-21 16:42:12.982000+03:00

['sql injection', 'cloaking', 'installer.dll', 'notepadplusplus.dll', 'clickfix', 'ghost cms', 'information stealer', 'mass compromise', 'utilifysetup.exe', 'cve-2026-26980', 'fakecaptcha']

['installer.dll', 'UtilifySetup.exe', 'NotepadPlusPlus.dll']

['https://blog.xlab.qianxin.com/ghost-cms-mass-compromised-via-cve-2026-26980-now-fueling-clickfix-attacks/']

{'pulse_id': '6a0f06676dfe8431915ed38a', 'indicators': [{'id': 3164510393, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'jalwat.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4343970988, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'cloud-verification.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4345119060, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'script-dev.buzz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4355439693, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'https://clo4shara.xyz/11z77u3.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4356943671, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'clo4shara.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370243513, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'cdnupdatenews.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486343, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': '18a7251ddde77ed24bc54700d84d9be1', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486344, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': '5659292833ec421da11ebde005d9c9a8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486345, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'd30cc10d54ebc967c8538ff74f442eee', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486347, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'f280e12f51f996dae7fffc64a56ee527', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486348, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'fceca579efcef09eb507c6ca977ea281', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486358, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'https://cdnupdatenews.top/dl?fid=38', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486360, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'https://cloud-verification.com/update.zip', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486361, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'https://com-apps.cc/11z77u3.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486362, 'role': None, 'type': 'URL', 'title': 'Zip archive data, at least v2.0 to extract', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'https://com-apps.cc/NotepadPlusPlus.zip', 'is_active': 1, 'expiration': None, 'description': '2858eea059aea9789fb32ec31c284c54030114649f29daf78a2a1bd6516092b5'}, {'id': 4370486363, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'https://com-apps.cc/update.zip', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486364, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'https://jalwat.com/static/uploads/campaigns/6/update.zip', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486367, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'https://platecrumbs.com/11z77u3.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486368, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'https://script-dev.digital/api/css.js', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486369, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'https://staticcloudflare.pro/api/css.js', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486370, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'https://taketwolabs.com/wp-content/NotepadPlusPlus.dll', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486380, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'com-apps.cc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486381, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'download-file.today', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486382, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'platecrumbs.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486383, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'script-dev.digital', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486384, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'script-dev.xyz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486385, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'static-file.digital', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486386, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'staticcloudflare.pro', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486387, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'taketwolabs.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486388, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'updatefile-cf.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486389, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'updatefilescf.top', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486390, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'updatesecurity.pro', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486391, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T16:42:01', 'indicator': 'web-telegram.ug', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 33}

6fdd630b1fe65362be4a401a5f08ac0de6e766f6e0b62743fa92e249d2de0fa1

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

678a94934bbe1df5bdf0a9cd

my-game.biz

domain

Gootloader Inside Out

The report details an analysis of the Gootloader malware family, which uses malicious SEO tactics to infect computers. It explains how Gootloader compromises legitimate WordPress sites, manipulates search results, and presents visitors with a fake online forum to distribute malware. The analysis reconstructs Gootloader's server-side operations using open-source intelligence, revealing the intricate processes behind its infection chain. Key components discussed include the landing page code, the 'mothership' server orchestrating attacks, and techniques used to evade detection. The report provides insights into Gootloader's persistence and effectiveness despite its well-understood mechanisms.

2025-01-17 17:34:10.413000+03:00

2025-02-16 00:01:21.376000+03:00

['malicious SEO', 'WordPress compromise', 'JScript payload', 'PHP shell', 'fake forum']

['Gootloader']

['https://news.sophos.com/en-us/2025/01/16/gootloader-inside-out/']

{'pulse_id': '678a94934bbe1df5bdf0a9cd', 'indicators': [{'id': 3204449526, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2025-01-17T17:34:13', 'indicator': 'my-game.biz', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4027797243, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-01-17T17:34:13', 'indicator': '03a46ad7873ddb6663377282640d45e38697e0fdc1512692bcaee3cbba1aa016', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4027797244, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-01-17T17:34:13', 'indicator': '1fcc418bdd7d2d40e7f70b9d636735ab760e1044bb76f8c2232bd189e2fd8be7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4027797245, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-01-17T17:34:13', 'indicator': '258cb1d60a000e8e0bb6dc751b3dc14152628d9dd96454a3137d124a132a4e69', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4027797246, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-01-17T17:34:13', 'indicator': '5d50a7cf15561f35ed54a2e442c3dfdac1d660dc18375f7e4105f50eec443f27', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4027797247, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-01-17T17:34:13', 'indicator': '7bcffa722687055359c600e7a9abf5d57c9758dccf65b288ba2e6f174b43ac57', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4027797248, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-01-17T17:34:13', 'indicator': 'af50c735173326b2af2e2d2b4717590e813c67a65ba664104880dc5d6a58a029', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4027797249, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-01-17T17:34:13', 'indicator': '89672c08916dd38d9d4b7f5bbf7f39f919adcaebc7f8bb1ed053cb701005499a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4027797250, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2025-01-17T17:34:13', 'indicator': '0874d307fc45886d2751cd9e6816513dc3e1604e514ef1b291bbe7b1a887cd96', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 9}

1f4e7036b3a92fdb37312e3acbdafa12cf8bef59e3486ca13b4df723724ab0dc

2026-06-04 16:17:10.860473+03:00

2026-06-04 16:17:10.860473+03:00

6a0f06681c6ea37a99ec7d21

chocolatey.net

domain

SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer

Financially motivated eCrime actors are conducting an ongoing infostealer campaign targeting software developers through SEO poisoning techniques. The operation impersonates AI platforms including Gemini CLI and Claude Code, as well as developer tools like Node.js, Chocolatey, and KeePassXC. Attackers position fake domains above legitimate search results, directing victims to malicious installation pages that deliver fileless PowerShell-based infostealer malware. The malware executes entirely in memory, disables Windows Defender telemetry by patching ETW and AMSI, and harvests credentials from browsers, collaboration platforms, VPN clients, and cloud storage. Stolen data includes OAuth tokens, CI/CD credentials, and corporate VPN details, providing direct enterprise network access. The campaign leverages bulletproof hosting infrastructure and over 30 typosquatted domains registered between March and April 2026, primarily targeting users in the United States and United Kingdom.

2026-05-21 13:19:36.849000+03:00

2026-05-21 16:40:33.714000+03:00

['fileless powershell', 'infostealer', 'ai platform impersonation', 'developer targeting', 'supply chain risk', 'typosquatting', 'seo poisoning', 'credential theft']

[]

['https://blog.eclecticiq.com/seo-poisoning-campaign-leverages-gemini-and-claude-code-impersonation-to-deliver-infostealer']

{'pulse_id': '6a0f06681c6ea37a99ec7d21', 'indicators': [{'id': 2235620449, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'chocolatey.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322479111, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'gemini-setup.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322604579, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'events.msft23.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4322734847, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'claude-setup.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324183984, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '9c87e8162b39fbb773c416006b16f8e34aca53372d1b2d4a584df0ffc69ad333', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324183985, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '89d634c8471382ff9c6fd966008ad5c376d7a0edae8f799eb569837170f2373d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324183986, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'a1c5e1d9bdc1a931c11ac6fdfdff1fbc69ff88521cf443cb174f9720a05fe72d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324183987, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'a6525b37b0cc5339df375e17a0c10772b50c9d425001b0c3a9dada995c7f62dd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324183988, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'aa350580ae5ea46544ffa15c324ab4225dff0dcc5842ac5ca8e2dc4018e5ffad', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324183989, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '64d2a9a49e27d89f1b3489d7db29c3a3a12b4b090f59c24b694c239cb55db262', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324183990, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '5c6a2c73f59fd8defbf118f87e5c88ba62e3067f8e8c0ed104f3f188fa0d959d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324183991, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'de34f2f93b74e049a08074c779a863a87a85a403594b8e220b1fba15112e6386', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324183992, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'dfd21a363f4994794f821d76ca61c834882a51b5c6f7b95627b70789462149e3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4324183993, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'a31ae1eef3261c36b465255e624fb7ac5899bf2a9823564ba792fac8346723aa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4332222596, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'api.bio9438.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4332222598, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'olive3451.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4332222600, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'community.chocolatey.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486402, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '04f0ef18a152f892ef0c43aa7d1499cd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486403, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '2a36e01516929b5e2c43ed3f7bb137cd', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486404, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '34a9b024da31c3c54233f7da2021ef8a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486405, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '8e43af7bb1961e87e35cecd9c9dc39c7', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486406, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'a7012d46ab1f5fba4ff81f442848237d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486407, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '3269b7c555b868bce5bae7fc7b4b8a55174ec221', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486408, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '33c8c74294cd9cece97a2158a2533e992c8310bc', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486409, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'a05aedfc0906ea392cd182cc75163cba0646d419', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486410, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'b2b8eab958b77555160c95d89c7b5915f7d48a34', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486411, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'e11cc0e79307a6237a6660d48988402fad6d3c6a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486412, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '0e8c45d847f57095d9879c0da764ab02431db4d5d85f50c4fd5ba38353b79eed', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486413, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '1439d30ebeac3a6ccb9545acaa350783a83cc08746cb575e59ddb0efc77d412a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486414, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '27e17661f5573f63b65e3a5cfe5bdca75acdc1911441b032781f7ebe125d9194', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486415, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '2d7a94e4a0fedcf31cdd43b06222add9d1888fecb2c5488afc658d08c3f40116', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486416, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '2d9ecc9321994558d0cc0e9d3fa9fdf600bacfe8758976d34f26f89c33bd5007', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486417, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '5071921cb1ca369fe8f7af522a00373c8c85e4357f7ea1879d2cb4ae791797d6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486418, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '65e1a542bb7d995cc4aa6c71191da125f14f99ca03da7266f5b071440d6d229a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486419, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '7c2a9ad5fcf489d1844f51830242f6dd9dfc203be6de3ceb07a4f6dd21c9f1a3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486420, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': '80ffc86673bd8c8bd5862bbe961323a822b23c94df48c685162c571445552faa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486421, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'ae8f70dad97fedecd707977ca22fd6f656c64c0dac96e03f0f4a6c04d0693f59', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486422, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'ae9bc11adb457930d402844bd3bf3af8ea7c13fdb7ea269fbe73877b18af1ca8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486423, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'b37ee243518221017bab0eb4b54b5431571cc21e54113698ce49a89b89993754', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486424, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'bb78f024c4d8b5a6a128aacb498acad025a234a6b25fde36ff2e14601134555f', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486425, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'be2ff065a232a3a6f187f9fb03a6c1b368dff3d2ba0966777b1f5503aa5ecd16', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486426, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'c213ce07b5791abd334ff749b5f05ecc6b40772d35ef4388b5f576bc3e619765', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486427, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'c416052c8ac6bfb78b7f0c46c568c528ead33501149661f1d9ecb1861269f8fa', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486428, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'c47610c9df3fb101b0e99f2ac12589db653464edf12cebaa2c67fd33fc7715f3', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486429, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'efbf87447d93f4232b1169920f75c2066d19863ebc28fb2d2662353dc4ef61d8', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486430, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'ff81cb9263fcde5870a0748fd6af2d30a4ba864415c15ca14827d0dd723eb60c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486431, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'http://events.msft23.com/process', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486432, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'https://community.chocolatey.net/install.ps1|iex', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486433, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'https://geminicli.com/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370486434, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-21T13:19:37', 'indicator': 'https://www.pinvoke.net/default.aspx/advapi32.credwrite', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 54}

75083680eebe3f26f555f4f124a232d4222551cb866acb8462c93c60b733f047

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a0ec4bc3bab6cd24d3d05be

signspace.cloud

domain

Politicians to Ditch Signal for Homegrown Apps

European governments are transitioning from encrypted messaging applications like Signal and WhatsApp to sovereign Matrix-based solutions. This shift follows successful phishing campaigns, primarily attributed to Russian intelligence services, exploiting Signal's linked devices feature to gain persistent access to political communications. While Signal was initially recommended for external communications, scope creep led to its widespread use for sensitive statecraft discussions. Matrix-based systems offer advantages including federated architecture, government-controlled identity platforms, and customizable data retention policies. However, these homegrown solutions introduce new security vulnerabilities and implementation challenges. The walled-garden nature of current sovereign systems limits their utility for international diplomacy, suggesting Signal will continue to be used for communications with external parties despite the security concerns.

2026-05-21 08:39:24.349000+03:00

2026-05-21 16:39:25.594000+03:00

['fast16', 'phishing attacks', 'sovereign messaging', 'encrypted communications', 'diplomatic security', 'european governments', 'stuxnet', 'signal', 'matrix protocol', 'whatsapp']

['Stuxnet - S0603', 'W32.Stuxnet', 'Fast16']

['https://news.risky.biz/srsly-risky-biz-politicians-to-ditch-signal-for-homegrown-apps/']

{'pulse_id': '6a0ec4bc3bab6cd24d3d05be', 'indicators': [{'id': 4368530745, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-21T08:39:25', 'indicator': 'signspace.cloud', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 1}

d9d22e115b48c28085a0a5201195d6181dea92ae4a6a06e066a1753149c71c5e

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a0e3753562a6e67c9d9aac4

a8d79f40ddb79de569d778f1c0b832f9cc266b32274b702cff4ba2b8a0dd1549

FileHash-SHA256

Misconfigured, Enrolled and Dormant: Anatomy of a P2Pinfect Kubernetes Compromise

An investigation identified persistent P2Pinfect botnet presence within Google Kubernetes Engine clusters at multiple organizations, with one compromise lasting six months. The intrusions originated from exposed Redis instances that provided initial access. The botnet utilizes a peer-to-peer architecture for resilience against takedowns and operates as a botnet-for-hire platform. While no second-stage payloads were executed in observed cases, the malware has been linked to ransomware and cryptocurrency mining deployment. A new deployment script was discovered, and evidence suggests P2Pinfect has expanded exploitation techniques to include CVE-2025-11953 (Metro4Shell) targeting React vulnerabilities. Possible incorporation of CVE-2025-49844 (RediShell) is speculated. The campaign demonstrates how single misconfigurations enable long-term compromise in cloud environments.

2026-05-20 22:36:03.899000+03:00

2026-05-21 16:35:59.713000+03:00

['metro4shell', 'cve-2025-49844', 'cve-2022-0543', 'peer-to-peer', 'redis exploitation', 'cve-2025-11953', 'ransomware', 'p2pinfect', 'cryptomining', 'botnet', 'kubernetes']

['P2Pinfect']

['https://www.fortinet.com/blog/threat-research/misconfigured-enrolled-and-dormant-anatomy-of-a-p2pinfect-kubernetes-compromise']

{'pulse_id': '6a0e3753562a6e67c9d9aac4', 'indicators': [{'id': 132127200, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': 'a8d79f40ddb79de569d778f1c0b832f9cc266b32274b702cff4ba2b8a0dd1549', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3400083822, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-20T22:36:04', 'indicator': 'CVE-2022-0543', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3821939876, 'role': None, 'type': 'FileHash-MD5', 'title': 'SUSP_ELF_LNX_UPX_Compressed_File', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '65a4a8a24fbd9cd7585d3f843be9210d', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 976e3772ffea7499f7c119e956a5a71806f8f054caf174978fa888b254dd22a0'}, {'id': 3821939887, 'role': None, 'type': 'FileHash-SHA1', 'title': 'SUSP_ELF_LNX_UPX_Compressed_File', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': 'b5c5268ad6b270a446a19387b9813696f6ebc9b6', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 976e3772ffea7499f7c119e956a5a71806f8f054caf174978fa888b254dd22a0'}, {'id': 3821939911, 'role': None, 'type': 'FileHash-SHA256', 'title': 'SUSP_ELF_LNX_UPX_Compressed_File', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '976e3772ffea7499f7c119e956a5a71806f8f054caf174978fa888b254dd22a0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4063290717, 'role': None, 'type': 'FileHash-SHA256', 'title': 'UPX', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': 'bae21a944b639ed2c7b70964288131274916a1d52ac906725b39a3e15d243cf0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4063290717, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-20T22:36:04', 'indicator': 'bae21a944b639ed2c7b70964288131274916a1d52ac906725b39a3e15d243cf0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4159928579, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-20T22:36:04', 'indicator': 'a1a35afebb585917675534de3d610c93', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4196313521, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-20T22:36:04', 'indicator': '18d232d04d35d31f20d4549fa5f52f3afdb5d2d6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4196313525, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-20T22:36:04', 'indicator': 'd1886b189474b02467ed2845df0938cec9785e99c3d4b04e0b7de3cafbee4182', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4196313526, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-20T22:36:04', 'indicator': 'd8337df3aff749250557bf11daf069eb404cce0e6f4f91c6bd6d3f78aed6e9d6', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4196856221, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-20T22:36:04', 'indicator': 'CVE-2025-11953', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4197767916, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-20T22:36:04', 'indicator': '08ad2c2877edda9a050b81d011c1c003', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4197767919, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-20T22:36:04', 'indicator': '61450287ebd524cde1a500d91c334cfb49f85db0', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4225968880, 'role': None, 'type': 'FileHash-MD5', 'title': 'Trojan:Linux/CoinMiner.K', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '5958eaa29057a92954253606d0d0d340', 'is_active': 1, 'expiration': None, 'description': 'MD5 of c5e5e41f88f91e4e2ad524fae156bb74efe86e97ce84701b3e7f3a252fdb82ab'}, {'id': 4225974177, 'role': None, 'type': 'FileHash-SHA1', 'title': 'Trojan:Linux/CoinMiner.K', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': 'f72a9f166280db9f0f4e652a4861af9dcf6a6ead', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of c5e5e41f88f91e4e2ad524fae156bb74efe86e97ce84701b3e7f3a252fdb82ab'}, {'id': 4225975287, 'role': None, 'type': 'FileHash-SHA256', 'title': 'Trojan:Linux/CoinMiner.K', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': 'c5e5e41f88f91e4e2ad524fae156bb74efe86e97ce84701b3e7f3a252fdb82ab', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4294590425, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '03acb11799183f3b25b2ffe7227e0e010016eae81b23a663f32b5b0929d0598d', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370230412, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-20T22:36:04', 'indicator': 'CVE-2025-49844', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370230413, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-20T22:36:04', 'indicator': '5d1ca537c4bedebf2f4d276d4199ea95', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370230413, 'role': None, 'type': 'FileHash-MD5', 'title': 'UPX', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '5d1ca537c4bedebf2f4d276d4199ea95', 'is_active': 1, 'expiration': None, 'description': 'MD5 of bae21a944b639ed2c7b70964288131274916a1d52ac906725b39a3e15d243cf0'}, {'id': 4370230414, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-20T22:36:04', 'indicator': '80676a539765a9e117f20b6b99887eca', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370230415, 'role': None, 'type': 'FileHash-SHA1', 'title': 'UPX', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '15ecb943232ff81301dfdba1df88ca575ea047b2', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of bae21a944b639ed2c7b70964288131274916a1d52ac906725b39a3e15d243cf0'}, {'id': 4370230415, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-20T22:36:04', 'indicator': '15ecb943232ff81301dfdba1df88ca575ea047b2', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4371664824, 'role': None, 'type': 'FileHash-MD5', 'title': 'UPX', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '1d0a54bf03a6786f31598adbdc405304', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 20e7ca6945964ef5072639854f5a2f58a574196de7532872c79d66e313f9e075'}, {'id': 4371664825, 'role': None, 'type': 'FileHash-MD5', 'title': 'is__elf', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '20609b90a830f81af2b6c1a355170ec9', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 11370d218430a0bdb2b584eb4181c21bd2abe9958ba639c017caf04ec019d117'}, {'id': 4371664826, 'role': None, 'type': 'FileHash-MD5', 'title': 'is__elf', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '5294f25631d20b68ebf3a9acd4cc1f5d', 'is_active': 1, 'expiration': None, 'description': 'MD5 of a505de0af54408dcde2f869608398a409908543a43fad15397a342b2200f8a52'}, {'id': 4371664827, 'role': None, 'type': 'FileHash-MD5', 'title': 'is__elf', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '7abff55bf8ff0075afb3a3ff2ad9d7f1', 'is_active': 1, 'expiration': None, 'description': 'MD5 of b67cd5f540094b7a2dea1ba92f3ac7a3c0ecfe67975ed947a1203cefe41f3a42'}, {'id': 4371664828, 'role': None, 'type': 'FileHash-MD5', 'title': 'ccrewQAZ', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '829e1fe1e2b4e9d7be9b93d09e93c236', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 28f641a9ea52542ed8cedcd070e825944b4650477d1a79cb0ab2acea97733e9b'}, {'id': 4371664829, 'role': None, 'type': 'FileHash-MD5', 'title': 'is__elf', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '88c8db87ebbde2a330783999d69704f5', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 53fb9390d471f30b79297095159247d23c0af868fd02c43afcd797bc83816678'}, {'id': 4371664830, 'role': None, 'type': 'FileHash-MD5', 'title': 'is__elf', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': 'c2e97ad957d5608e96bbfcf0f71c0479', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 2fcaf9a4f6d549a86f4fdf6a6b01e044c29fce093a777b114d73dea8adf25538'}, {'id': 4371664831, 'role': None, 'type': 'FileHash-MD5', 'title': 'UPX', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': 'd3d8d98ec41040a96dd941d044af0b46', 'is_active': 1, 'expiration': None, 'description': 'MD5 of 329f0a2c0727b122b84d1719a68066cbd1fabf2854b2a785869021aa2bfdd5cf'}, {'id': 4371664832, 'role': None, 'type': 'FileHash-SHA1', 'title': 'is__elf', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '283a962497d5fa5b214c79b853ea56ef361c06c8', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of b67cd5f540094b7a2dea1ba92f3ac7a3c0ecfe67975ed947a1203cefe41f3a42'}, {'id': 4371664833, 'role': None, 'type': 'FileHash-SHA1', 'title': 'UPX', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '2d27edf195daeba284749136236d76c093ff9ea7', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 20e7ca6945964ef5072639854f5a2f58a574196de7532872c79d66e313f9e075'}, {'id': 4371664834, 'role': None, 'type': 'FileHash-SHA1', 'title': 'is__elf', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '4026e7113258a4ee50991da4aff21c061e779563', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of a505de0af54408dcde2f869608398a409908543a43fad15397a342b2200f8a52'}, {'id': 4371664835, 'role': None, 'type': 'FileHash-SHA1', 'title': 'is__elf', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '62761c693b66eaa766baaa51fd7e16e288510cbc', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 53fb9390d471f30b79297095159247d23c0af868fd02c43afcd797bc83816678'}, {'id': 4371664836, 'role': None, 'type': 'FileHash-SHA1', 'title': 'is__elf', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '8d563b058d659375c34042cc85b08ca03c2fb851', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 2fcaf9a4f6d549a86f4fdf6a6b01e044c29fce093a777b114d73dea8adf25538'}, {'id': 4371664837, 'role': None, 'type': 'FileHash-SHA1', 'title': 'ccrewQAZ', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '9b9bf3028152ea5bb94f50bb329edcabbc5ea62a', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 28f641a9ea52542ed8cedcd070e825944b4650477d1a79cb0ab2acea97733e9b'}, {'id': 4371664838, 'role': None, 'type': 'FileHash-SHA1', 'title': 'is__elf', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': 'd39d10d9e4a27d2a44c0d17ce162bc7b78f49b06', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 11370d218430a0bdb2b584eb4181c21bd2abe9958ba639c017caf04ec019d117'}, {'id': 4371664839, 'role': None, 'type': 'FileHash-SHA1', 'title': 'UPX', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': 'fa19c6feb7abcd020305a0546681e3e2663f8eff', 'is_active': 1, 'expiration': None, 'description': 'SHA1 of 329f0a2c0727b122b84d1719a68066cbd1fabf2854b2a785869021aa2bfdd5cf'}, {'id': 4371664840, 'role': None, 'type': 'FileHash-SHA256', 'title': 'is__elf', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '11370d218430a0bdb2b584eb4181c21bd2abe9958ba639c017caf04ec019d117', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4371664841, 'role': None, 'type': 'FileHash-SHA256', 'title': 'UPX', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '20e7ca6945964ef5072639854f5a2f58a574196de7532872c79d66e313f9e075', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4371664842, 'role': None, 'type': 'FileHash-SHA256', 'title': 'ccrewQAZ', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '28f641a9ea52542ed8cedcd070e825944b4650477d1a79cb0ab2acea97733e9b', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4371664843, 'role': None, 'type': 'FileHash-SHA256', 'title': 'is__elf', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '2fcaf9a4f6d549a86f4fdf6a6b01e044c29fce093a777b114d73dea8adf25538', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4371664844, 'role': None, 'type': 'FileHash-SHA256', 'title': 'UPX', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '329f0a2c0727b122b84d1719a68066cbd1fabf2854b2a785869021aa2bfdd5cf', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4371664845, 'role': None, 'type': 'FileHash-SHA256', 'title': 'is__elf', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '53fb9390d471f30b79297095159247d23c0af868fd02c43afcd797bc83816678', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4371664846, 'role': None, 'type': 'FileHash-SHA256', 'title': 'is__elf', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': 'a505de0af54408dcde2f869608398a409908543a43fad15397a342b2200f8a52', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4371664847, 'role': None, 'type': 'FileHash-SHA256', 'title': 'is__elf', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': 'b67cd5f540094b7a2dea1ba92f3ac7a3c0ecfe67975ed947a1203cefe41f3a42', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4371664848, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': 'ee957f0bae67ae3e8815549e5620dc11', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4371664849, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-21T16:34:31', 'indicator': '1ab5deb020fdfd22cdbb5264ce0817e1b92b09d660dd5a92baab8835c81c5c84', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 65}

019b5eb7c66cacda43c098b1dcf65990e973a83561c924e59522347168b319b2

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a0e3751a23f1487cbb26ac5

t.m-kosche.com

hostname

Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft

Microsoft identified an active supply chain attack targeting the @antv npm package ecosystem. A threat actor compromised an @antv maintainer account and published malicious versions of widely used data-visualization packages, affecting libraries like echarts-for-react with over 1 million weekly downloads. The attack propagates through dependency chains into CI/CD pipelines and cloud workloads. A 499 KB obfuscated JavaScript payload executes silently during npm install, specifically designed to steal credentials from GitHub Actions environments. Key capabilities include multi-platform credential theft (GitHub, AWS, HashiCorp Vault, npm, Kubernetes, 1Password), GitHub Action Runner process memory scraping, privilege escalation, dual-channel data exfiltration, and SLSA provenance forgery. The payload targets CI/CD environments deliberately, with over 2,200 compromised repositories observed. GitHub responded by removing 640 malicious packages and invalidating 61,274 npm tokens.

2026-05-20 22:36:01.815000+03:00

2026-05-21 16:35:36.126000+03:00

['supply chain attack', 'npm', 'credential theft', 'obfuscation', 'privilege escalation', 'github actions', 'ci/cd', 'data exfiltration']

[]

['https://www.microsoft.com/en-us/security/blog/2026/05/20/mini-shai-hulud-compromised-antv-npm-packages-enable-ci-cd-credential-theft/']

{'pulse_id': '6a0e3751a23f1487cbb26ac5', 'indicators': [{'id': 4367102282, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-20T22:36:02', 'indicator': 't.m-kosche.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367347953, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-20T22:36:02', 'indicator': 'fb5c97557230a27460fdab01fafcfabeaa49590bafd5b6ef30501aa9e0a51142', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4367567977, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-20T22:36:02', 'indicator': '7cb42f57561c321ecb09b4552802ae0ac55b3a7a', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4368696166, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-05-20T22:36:02', 'indicator': 'http://t.m-kosche.com:443', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370230395, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-20T22:36:02', 'indicator': '7f44e4ba6f6a71bd0f789e7f83bd3104', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370230396, 'role': None, 'type': 'FileHash-MD5', 'title': '', 'content': '', 'created': '2026-05-20T22:36:02', 'indicator': '8f8f24b6bc727e18295feaad45d17b44', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370230397, 'role': None, 'type': 'FileHash-SHA1', 'title': '', 'content': '', 'created': '2026-05-20T22:36:02', 'indicator': '19b62ae4f76273645e36a60e7b7d23c05c16b395', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370230398, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-20T22:36:02', 'indicator': 'a68dd1e6a6e35ec3771e1f94fe796f55dfe65a2b94560516ff4ac189390dfa1c', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4370230399, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-20T22:36:02', 'indicator': 'a8269c01069452afb8a54de904e6419578d155fdbdb9e566bab8576a4266b61e', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 9}

74e2e6e0ae17fe43605de6914ceebde888e3b13ca1645d3eb6ff37effd728dfb

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a0dae41682ec38e55d1aa12

onezipapp.com

domain

Tracking TamperedChef Clusters via Certificate and Code Reuse

Multiple threat clusters designated as CL-CRI-1089, CL-UNK-1090, and CL-UNK-1110 have been distributing trojanized productivity software through malicious advertising campaigns since 2023. These applications, including PDF editors, calendars, and compression tools, appear legitimate but contain remote access capabilities enabling deployment of information stealers, proxy tooling, and RATs. The campaigns leverage code-signing certificates, remain dormant for weeks to months before activation, and affect organizations globally with over 4,000 samples identified across 100 variants. CL-CRI-1089 operations utilize Ukrainian, Malaysian, and British infrastructure with 34 unique code-signing entities, while CL-UNK-1090 demonstrates vertical integration between advertising agencies and malware creation using primarily Israeli infrastructure with 39 corporations involved. Distribution occurs through sophisticated malvertising employing professional websites, CDN delivery, and search engine optimization techniques.

2026-05-20 12:51:13.592000+03:00

2026-05-21 16:28:27.224000+03:00

['gocookmate', 'cl-cri-1089', 'swiftnav', 'cl-unk-1090', 'docuflex', 'tamperedchef', 'pdfpilot', 'information stealers', 'trojanized productivity software', 'zipmakerpro', 'appsuite pdf', 'justaskjacky', 'shinypdf', 'pdfprime', 'screensrecorder', 'code-signing abuse', 'rocketpdfpro', 'rapidoc', 'manualzpdf', 'evilai', 'justconvertfiles', 'crystalpdf', 'gifsmakerpro', 'manualreaderpro', 'onezip', 'fileease', 'malvertising campaigns', 'calendaromatic']

['TamperedChef', 'EvilAI', 'DocuFlex', 'AppSuite PDF', 'Calendaromatic', 'CrystalPDF', 'JustAskJacky', 'GoCookMate', 'RocketPDFPro', 'ManualReaderPro', 'PDFPrime', 'ManualzPDF', 'OneZip', 'JustConvertFiles', 'PDFPilot', 'SwiftNav', 'ShinyPDF', 'FileEase', 'ZipMakerPro', 'GifsMakerPro', 'ScreensRecorder', 'RapiDoc']

['https://unit42.paloaltonetworks.com/tracking-tampered-chef-clusters/']

{'pulse_id': '6a0dae41682ec38e55d1aa12', 'indicators': [{'id': 4180285368, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-20T12:51:14', 'indicator': 'onezipapp.com', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4200504512, 'role': None, 'type': 'CVE', 'title': '', 'content': '', 'created': '2026-05-20T12:51:14', 'indicator': 'CVE-2026-1731', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4368884223, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-20T12:51:14', 'indicator': '2231bfa7c7bd4a8ff12568074f83de8e4ec95c226230cccc6616a1a4416de268', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4368884224, 'role': None, 'type': 'FileHash-SHA256', 'title': '', 'content': '', 'created': '2026-05-20T12:51:14', 'indicator': '248de1470771904462c91f146074e49b3d7416844ec143ade53f4ac0487fdb44', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4368884225, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-05-20T12:51:14', 'indicator': 'www.crystalpdf.com', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 5}

6d01d270e991f63d35f4cb802cefc786b8422edc7cef9b030326916d8bf385a3

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a0dae059daacd856b07a97f

cabyceogpsji73sske5nvo45mdrkbz4m3qd3iommf3zaaa6izg3j2cqd.onion

domain

Volume Obfuscation Game: The Lead Data Brokers Out To Waste Your Time

An increasing number of data brokers operating in Chinese-speaking dark web forums and Telegram channels are advertising large volumes of allegedly stolen data from organizations worldwide. Analysis reveals these datasets primarily consist of fabricated information and data compiled from previous breaches, particularly the Facebook 2021 leak containing 553 million user records. Five prominent sources were identified: Exchange Market (Deepmix), Chang'An Sleepless Night dark web forums, and Telegram channels Aiqianjin, Yiqun Data, and Phoenix Overseas Resources. These brokers typically post hundreds to thousands of messages monthly, claiming to sell data in multiples of ten thousand records. Validation of sample datasets shows inconsistent fields, mistranslated column names, and cross-compiled information from unrelated breaches including Facebook 2021 and Eatigo 2020 leaks. This activity represents a significant diversion of analytical resources from legitimate threats.

2026-05-20 12:50:13.518000+03:00

2026-05-21 16:26:47.392000+03:00

['aiqianjin', "chang'an sleepless night", 'chinese-speaking forums', 'exchange market', 'data brokers', 'facebook 2021 leak', 'dark web marketplaces', 'lead data', 'telegram channels']

[]

['https://www.group-ib.com/blog/lead-data-obfuscation-brokers/']

{'pulse_id': '6a0dae059daacd856b07a97f', 'indicators': [{'id': 4368892008, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-20T12:50:14', 'indicator': 'cabyceogpsji73sske5nvo45mdrkbz4m3qd3iommf3zaaa6izg3j2cqd.onion', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4368892009, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-20T12:50:14', 'indicator': 'xxxxxxxxxs6qbnahsbvxbghsnqh4rj6whbyblqtnmetf7vell2fmxmad.onion', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 2}

ec149384f029d8803db405681b0bdebd07dc43ea7531fd938e7220f9fd312329

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

69de5f631a2f4bca81392ccd

profile.name

domain

108 Chrome Extensions Linked to Data Exfiltration and Session Theft via Shared C2 Infrastructure

A coordinated campaign of 108 malicious Chrome extensions operated through shared command-and-control infrastructure at cloudapi[.]stream has been identified, collectively accounting for approximately 20,000 installations. The campaign spans multiple threat categories: 54 extensions steal Google account identities via OAuth2, one extension actively exfiltrates Telegram Web sessions every 15 seconds, and 45 extensions contain a universal backdoor enabling arbitrary URL execution on browser startup. Published under five distinct publisher identities (Yana Project, GameGen, SideGames, Rodeo Games, and InterAlt), these extensions masquerade as legitimate tools including Telegram sidebar clients, slot games, YouTube and TikTok enhancers, and translation utilities. All extensions route stolen credentials, user identities, and browsing data to servers controlled by the same operator, with infrastructure confirming a Malware-as-a-Service business model.

2026-04-14 15:38:11.151000+03:00

2026-05-14 15:08:51.031000+03:00

['session hijacking', 'chrome extensions', 'google identity theft', 'browser backdoor']

[]

['https://socket.dev/blog/108-chrome-ext-linked-to-data-exfil-session-theft-shared-c2']

{'pulse_id': '69de5f631a2f4bca81392ccd', 'indicators': [{'id': 2798374309, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'profile.name', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3238517027, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'message.data', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3936588044, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'chrome.runtime.id', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3960785432, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3960785432, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3960807628, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'crm.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 3960807630, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'multiaccount.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278189, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://api.cloudapi.stream:8443/Register', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278190, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://api.cloudapi.stream:8443/Translation', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278191, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://cloudapi.stream/install/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278192, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://cloudapi.stream/uninstall/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278193, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://mines.cloudapi.stream/auth_google', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278194, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://mines.cloudapi.stream/slot_test/', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278195, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://mines.cloudapi.stream/user_info', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278198, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://tg.cloudapi.stream/count_sessions.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278199, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://tg.cloudapi.stream/delete_session.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278200, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://tg.cloudapi.stream/get_session.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278201, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://tg.cloudapi.stream/get_sessions.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278202, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://tg.cloudapi.stream/save_session.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278203, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://tg.cloudapi.stream/save_title.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278204, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://top.rodeo/notify.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278205, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://top.rodeo/server/remote.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278206, 'role': None, 'type': 'URL', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'http://top.rodeo/server/remote3.php', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278216, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'interalt.net', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278217, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'nashprom.info', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278218, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'profile.email', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278219, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'webuk.tech', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278220, 'role': None, 'type': 'email', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'support@top.rodeo', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278221, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'api.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278221, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'api.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278222, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'cdn.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278223, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'chat.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278224, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'coin-miner.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278225, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'gamewss.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278226, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'goldminer.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278227, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'herculessportslegend.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278228, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'metal.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278229, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'mines.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278229, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'mines.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278230, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:40:56', 'indicator': 'tg.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278230, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'tg.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278231, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'topup.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}, {'id': 4310278232, 'role': None, 'type': 'hostname', 'title': '', 'content': '', 'created': '2026-04-14T15:38:11', 'indicator': 'wheel.cloudapi.stream', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 43}

58628757a1e48bb2872c354a85f2d3e5de32207d8ab3f86b6921b802ae987fda

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00

6a0d970b3015e77563f4a9fa

1cpur2zdsv762uzyoyzma6pvzz4a2xhv64zdouxpjlu3exyks7gh7leyd.onion

domain

Inside a Tor Backed Supply Chain Worm

A sophisticated npm supply chain attack was uncovered involving the typosquatted package crypto-javascri, designed to mimic the legitimate crypto-js library. The malware harvests npm and GitHub credentials from infected systems, hijacks maintainer accounts, and automatically republishes trojanized versions of packages under trusted identities. The final payload incorporates a weaponized Arti Tor client with credential theft, cryptomining capabilities, privilege escalation via SUID exploitation, and systemd-based persistence mechanisms. The campaign specifically targets Linux developer systems and CI/CD environments, using Tor-based command-and-control infrastructure to maintain anonymity and resilience. The attack creates significant downstream supply chain risk through its worm-like propagation model.

2026-05-20 11:12:11.970000+03:00

2026-05-21 16:15:16.548000+03:00

['typosquatting', 'npm', 'supply chain attack', 'Tor C2', 'credential theft', 'cryptomining', 'privilege escalation', 'worm propagation']

['crypto-javascri', 'Arti']

['https://www.cloudsek.com/blog/inside-a-tor-backed-supply-chain-worm']

{'pulse_id': '6a0d970b3015e77563f4a9fa', 'indicators': [{'id': 4368883967, 'role': None, 'type': 'domain', 'title': '', 'content': '', 'created': '2026-05-20T11:12:12', 'indicator': '1cpur2zdsv762uzyoyzma6pvzz4a2xhv64zdouxpjlu3exyks7gh7leyd.onion', 'is_active': 1, 'expiration': None, 'description': ''}], 'indicators_count': 1}

7548f0e63af14aed4ff9e476038b5b01b528382ef1b3258637eb41f4e550ca45

2026-06-02 19:36:33.704335+03:00

2026-06-04 16:17:09.852877+03:00