[
  {
    "id": 4162867506,
    "indicator": "CVE-2025-14174",
    "type": "CVE",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4206323156,
    "indicator": "CVE-2025-31277",
    "type": "CVE",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4162712467,
    "indicator": "CVE-2025-43510",
    "type": "CVE",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4162712474,
    "indicator": "CVE-2025-43520",
    "type": "CVE",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4178682801,
    "indicator": "CVE-2025-43529",
    "type": "CVE",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4205851816,
    "indicator": "CVE-2026-20700",
    "type": "CVE",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4272610400,
    "indicator": "2e5a56beb63f21d9347310412ae6efb29fd3db2d3a3fc0798865a29a3c578d35",
    "type": "FileHash-SHA256",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4272610401,
    "indicator": "https://snapshare.chat/",
    "type": "URL",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4272610402,
    "indicator": "https://static.cdncounter.net/assets/index.html",
    "type": "URL",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4272610403,
    "indicator": "https://static.cdncounter.net/widgets.js?uhfiu27fajf2948fjfefaa42",
    "type": "URL",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4274482388,
    "indicator": "0afa88a4dde47b4ad21dc1de87293814fc51499c",
    "type": "YARA",
    "created": "2026-03-20T09:26:10",
    "content": "rule G_Backdoor_GHOSTKNIFE_1 {   \n   \tmeta:   \n   \t\tauthor = \"Google Threat Intelligence Group (GTIG)\"   \n   \tstrings:   \n   \t\t$ = \"server_pub_ex\"   \n   \t\t$ = \"client_pri_ds\"   \n   \t\t$ = \"getfilebyExtention\"   \n   \t\t$ = \"getContOfFilesForModule\"   \n   \t\t$ = \"carPlayConnectionState\"   \n   \t\t$ = \"saveRecordingApp\"   \n   \t\t$ = \"getLastItemBack\"   \n   \t\t$ = \"the inherted class\"   \n   \t\t$ = \"passExtetion\"   \n   \tcondition:   \n   \t\tfilesize < 10MB and not (uint16be(0) == 0x504b or uint32be(0) == 0x6465780a or uint16be(0) == 0x4d5a or uint32be(0) == 0x377abcaf) and 4 of them   \n   }",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4274482389,
    "indicator": "bac0e0ef16c3c657967bd2155ba6d8a6ef1df6a7",
    "type": "YARA",
    "created": "2026-03-20T09:26:10",
    "content": "rule G_Datamine_GHOSTBLADE_1 {   \n   \tmeta:   \n   \t\tauthor = \"Google Threat Intelligence Group (GTIG)\"   \n   \tstrings:   \n   \t\t$ = \"/private/var/tmp/wifi_passwords.txt\"   \n   \t\t$ = \"/private/var/tmp/wifi_passwords_securityd.txt\"   \n   \t\t$ = \"/.com.apple.mobile_container_manager.metadata.plist\" fullword   \n   \t\t$ = \"X-Device-UUID: ${\"   \n   \t\t$ = \"/installed_apps.txt\" fullword   \n   \t\t$ = \"icloud_dump_\" fullword   \n   \tcondition:   \n   \t\tfilesize < 10MB and not (uint16be(0) == 0x504b or uint32be(0) == 0x6465780a or uint16be(0) == 0x4d5a or uint32be(0) == 0x377abcaf) and 3 of them   \n   }",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4274482390,
    "indicator": "d2f1ea6229a205b693508c39f654dd8e3475763c",
    "type": "YARA",
    "created": "2026-03-20T09:26:10",
    "content": "rule G_Backdoor_GHOSTSABER_1 {   \n   \tmeta:   \n   \t\tauthor = \"Google Threat Intelligence Group (GTIG)\"   \n   \tstrings:   \n   \t\t$ = \"sendDeviceInfoJson\"   \n   \t\t$ = \"merge2AppLists\"   \n   \t\t$ = \"send_command_to_upper_process\"   \n   \t\t$ = \"ChangeStatusCheckSleepInterval\"   \n   \t\t$ = \"SendRegEx\"   \n   \t\t$ = \"evalJsResponse.json\"   \n   \t\t$ = \"sendSimpleUploadJsonObject\"   \n   \t\t$ = \"device_info_all\"   \n   \t\t$ = \"getPayloadForSimpleStatusRequest\"   \n   \tcondition:   \n   \t\tfilesize < 10MB and not (uint16be(0) == 0x504b or uint32be(0) == 0x6465780a or uint16be(0) == 0x4d5a or uint32be(0) == 0x377abcaf) and 4 of them   \n   }",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4274482391,
    "indicator": "f4bc68581c02d6f390a8a56ff1c5d04e002afb39",
    "type": "YARA",
    "created": "2026-03-20T09:26:10",
    "content": "rule G_Hunting_DarkSwordExploitChain_ImplantLib_FilePaths_1 {   \n   \tmeta:   \n   \t\tauthor = \"Google Threat Intelligence Group (GTIG)\"   \n   \tstrings:   \n   \t\t$ = \"src/InjectJS.js\"   \n   \t\t$ = \"src/libs/Chain/Chain.js\"   \n   \t\t$ = \"src/libs/Chain/Native.js\"   \n   \t\t$ = \"src/libs/Chain/OffsetsStruct.js\"   \n   \t\t$ = \"src/libs/Driver/Driver.js\"   \n   \t\t$ = \"src/libs/Driver/DriverNewThread.js\"   \n   \t\t$ = \"src/libs/Driver/Offsets.js\"   \n   \t\t$ = \"src/libs/Driver/OffsetsTable.js\"   \n   \t\t$ = \"src/libs/JSUtils/FileUtils.js\"   \n   \t\t$ = \"src/libs/JSUtils/Logger.js\"   \n   \t\t$ = \"src/libs/JSUtils/Utils.js\"   \n   \t\t$ = \"src/libs/TaskRop/Exception.js\"   \n   \t\t$ = \"src/libs/TaskRop/ExceptionMessageStruct.js\"   \n   \t\t$ = \"src/libs/TaskRop/ExceptionReplyStruct.js\"   \n   \t\t$ = \"src/libs/TaskRop/MachMsgHeaderStruct.js\"   \n   \t\t$ = \"src/libs/TaskRop/PAC.js\"   \n   \t\t$ = \"src/libs/TaskRop/PortRightInserter.js\"   \n   \t\t$ = \"src/libs/TaskRop/RegistersStruct.js\"   \n   \t\t$ = \"src/libs/TaskRop/RemoteCall.js\"   \n   \t\t$ = \"src/libs/TaskRop/Sandbox.js\"   \n   \t\t$ = \"src/libs/TaskRop/SelfTaskStruct.js\"   \n   \t\t$ = \"src/libs/TaskRop/Task.js\"   \n   \t\t$ = \"src/libs/TaskRop/TaskRop.js\"   \n   \t\t$ = \"src/libs/TaskRop/Thread.js\"   \n   \t\t$ = \"src/libs/TaskRop/ThreadState.js\"   \n   \t\t$ = \"src/libs/TaskRop/VM.js\"   \n   \t\t$ = \"src/libs/TaskRop/VmMapEntry.js\"   \n   \t\t$ = \"src/libs/TaskRop/VMObject.js\"   \n   \t\t$ = \"src/libs/TaskRop/VmPackingParams.js\"   \n   \t\t$ = \"src/libs/TaskRop/VMShmem.js\"   \n   \t\t$ = \"src/MigFilterBypassThread.js\"   \n   \tcondition:   \n   \t\tany of them   \n   }",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4272610408,
    "indicator": "0x1fedd2.open",
    "type": "domain",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4272610409,
    "indicator": "0x436cc4.open",
    "type": "domain",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4272610410,
    "indicator": "sahibndn.io",
    "type": "domain",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4272610411,
    "indicator": "snapshare.chat",
    "type": "domain",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4272610412,
    "indicator": "e5.malaymoil.com",
    "type": "hostname",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4272610413,
    "indicator": "sqwas.shapelie.com",
    "type": "hostname",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4272610414,
    "indicator": "static.cdncounter.net",
    "type": "hostname",
    "created": "2026-03-20T09:26:10",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  }
]