Pulse Detail — Threat Intelligence

PULSE NAME

Tracking TamperedChef Clusters via Certificate and Code Reuse

WHITE Tr1sa111 2026-05-24 Modified: 2026-05-24

IOCs

LOW VOLUME

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1053.005 T1113 T1033 T1539 T1204.002 T1566.002 T1553.002 T1082 T1140 T1555.003 T1016 T1083 T1102 T1057 T1547.001 T1027 T1518.001 T1027.002 T1071.001 T1105 T1124

MALWARE FAMILIES

TamperedChef EvilAI DocuFlex AppSuite PDF Calendaromatic CrystalPDF JustAskJacky GoCookMate RocketPDFPro ManualReaderPro PDFPrime ManualzPDF OneZip JustConvertFiles PDFPilot SwiftNav ShinyPDF FileEase ZipMakerPro GifsMakerPro ScreensRecorder RapiDoc

Indicators of Compromise (5)

All CVE FileHash-SHA256 domain hostname

TYPE	INDICATOR	DESCRIPTION	CREATED
CVE	CVE-2026-1731	—	2026-05-24
FileHash-SHA256	2231bfa7c7bd4a8ff12568074f83de8e4ec95c226230cccc6616a1a4416de268	—	2026-05-24
FileHash-SHA256	248de1470771904462c91f146074e49b3d7416844ec143ade53f4ac0487fdb44	—	2026-05-24
domain	onezipapp.com	—	2026-05-24
hostname	www.crystalpdf.com	—	2026-05-24

References (1)

↗ https://unit42.paloaltonetworks.com/tracking-tampered-chef-clusters/