{
  "type": "Domain",
  "indicator": "accountprosoftware.net",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/accountprosoftware.net",
    "alexa": "http://www.alexa.com/siteinfo/accountprosoftware.net",
    "indicator": "accountprosoftware.net",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3831132391,
      "indicator": "accountprosoftware.net",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "69a02837827feb0b78fa3ad2",
          "name": "The Belasco Chain",
          "description": "The adversary delivers a masterclass in \"Regular Belasco\" stagecraft, utilizing authentic Adobe PIDs to construct a \"living library\" of legitimacy where mundane metadata like SOPHIA.json acts as Gatsby\u2019s \"real but uncut\" volumes to mask a hollowed-out interior. This is a triumph of performative evasion; while researchers marvel at the realism of the set-dressing, MSI50B8.tmp and MSI4F2F.tmp wait in the wings of the Windows\\Installer directory, invisible to the human eye and using NGEN hijacking to bake illicit scripts directly into the OS framework. By employing Cryptnet certificates as \"stage lighting\" to mask C2 handshakes, the malware doesn't just attend the system\u2019s party\u2014it rewrites the invitation to own the house. Unlike the tragic end at West Egg, this Belasco chain is a play that refuses to end; it simply resets the stage, ensuring the performance continues as long as the \"green light\" of the C2 remains active.",
          "modified": "2026-05-31T12:02:15.044000",
          "created": "2026-02-26T11:02:15.932000",
          "tags": [
            "file size",
            "mwdb",
            "bazaar",
            "sha3384",
            "ssdeep",
            "file type",
            "sha1",
            "sha256",
            "crc32",
            "filenames c"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2813,
            "FileHash-SHA1": 2576,
            "FileHash-SHA256": 8145,
            "domain": 1903,
            "hostname": 1502,
            "URL": 1359,
            "email": 46,
            "CVE": 54,
            "CIDR": 3,
            "YARA": 7,
            "JA3": 1,
            "IPv4": 11
          },
          "indicator_count": 18420,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 74,
          "modified_text": "3 hours ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6992bae83a5988dff8311490",
          "name": "Distributed Credential Exhaustion & C2 Orchestration via Golang-Based StealthWorker (ELF.Agent-VW)",
          "description": "Researcher credit: msudosos, level blue platform----\nThis artifact represents a high-integrity StealthWorker (GoBrut) botnet agent, architected as a statically linked, stripped 32-bit ELF binary to ensure cross-platform environmental independence. The sample utilizes XOR 0x20-encoded JavaScript payloads and String.fromCharCode obfuscation to mask its internal logic and bypass heuristic-based memory scanners. [User Notes] Its operational core is a multi-threaded service bruter targeting SSH, MySQL, and CMS backends, leveraging a massive infrastructure of 1,834 domains and 797 unique IPv4 endpoints for decentralized Command & Control (C2). Network telemetry confirms the use of ICMP and HTTP-based beaconing, indicating a sophisticated retry logic designed to maintain persistence across diverse network topologies. With a malicious file score of 10, this binary serves as a primary vector for large-scale credential harvesting and the subsequent integration of Linux infrastructure into global botnet clusters.",
          "modified": "2026-04-24T13:20:48.450000",
          "created": "2026-02-16T06:36:24.788000",
          "tags": [
            "Obfuscation: XOR-based String Encryption (0x20)",
            "T1110.001 (Brute Force: Password Guessing)",
            "Primary Hash (SHA256): cd3989830da99a69380901769fd78902efb3cd8ba",
            "MD5 Hash: f8add7e7161460ea2b1970cf4ca535bf",
            "#PotentialUS-Origin_FalseFlag_Obfuscation"
          ],
          "references": [
            "Primary Hash (SHA256): cd3989830da99a69380901769fd78902efb3cd8ba5c9390e94bd4333b7fad186",
            "Obfuscation: XOR-based String Encryption (0x20)",
            "T1110.001 (Brute Force: Password Guessing)",
            "This ELF 32-bit LSB artifact is a sophisticated GoBrut/StealthWorker agent, compiled via Golang 1.10 and stripped to obfuscate its high-velocity service-bruting logic. VirusTotal confirms a critical threat profile with 44/65 security vendors flagging the file, which leverages a unique Go BuildID (nGYES3pajdOm...) and a Telfhash (t1f303a0...) for architectural fingerprinting. The binary orchestrates decentralized Command and Control (C2) through an expansive infrastructure of 797 unique IPs and 1,834 domains",
            "Pivot-Ready Indicators (IOCs) Go BuildID: nGYES3pajdOmKy1i6Ghh/KO9ydOtZpXtoKtB0KHE-/iisNoniHgTbj_cV6M-uk/XmMYzkBiZs8NXMRZYTiT Telfhash: t1f303a0b3055d54e8b7f08907c7af7624cef6e0f726d078f169e278d09a72c826626874 Imphash: 9698f46495ce9401c8bcaf9a2afe1598 Vhash: 1e53f1a1b59ecb93f821c74b25d81e9f",
            "Researcher msudosos posits a strategic exploitation of Root Certificate Validation Failures, where the adversary leverages an expired trust chain to bypass heuristic security filters and establish persistence.",
            "his technique allows the GoBrut/StealthWorker agent to circumvent automated revocation checks, enabling its decentralized C2 infrastructure to recruit Linux hosts via high-velocity credential exhaustion.",
            "The local environment exhibits advanced telemetry suppression within specialized skim memory regions, effectively neutralizing standard DMARC validation and Microsoft-integrated defensive protocols.",
            "By maintaining a hollowed root posture, the sample facilitates persistent, low-signal synchronization with external cloud infrastructure while bypassing traditional heuristic trust-chain verification.",
            "The domain prioritywirreles.com (registered via NAMECHEAP INC) shows a 4/93 detection ratio, confirming it is a live but \"low-noise\" C2 node used to avoid broad-spectrum blacklisting",
            "",
            "The environment leverages prioritywirreles.com as a high-fidelity DGA-derived C2 node, utilizing its historical resolution to Russian-hosted IP space (194.61.24.231) to maintain persistent Stealthworker botnet synchronization.",
            "By operating through WhoisGuard-protected infrastructure and exploiting XOR 0x20 obfuscation, the adversary effectively suppresses telemetry into skim space, successfully bypassing DMARC and Microsoft-integrated trust-chain validation.",
            "The pivot from cd398983... to this domain confirms a multi-year campaign (2019\u20132023) utilizing Namecheap-registered infrastructure to orchestrate wide-scale T1110.001 brute-force operations while bypassing standard PKI expiration checks.",
            "LBresearcher: msudosos notes: The campaign's use of T1110.001 (Password Guessing) is specifically tuned to exhaust credentials across SSH, MySQL, and CMS backends, effectively recruiting server infrastructure into a global \"zombie\" network.",
            "LBresearcher: msudosos notes: The threat actor maintains operational longevity by rotating through WhoisGuard-protected nodes like prioritywirreles.com, which historically resolved to Russian-hosted IP space (194.61.24.231) to obfuscate its origin.",
            "LBresearcher: msudosos notes: By exploiting Root Certificate Validation Failures, the StealthWorker (GoBrut) agent ensures that its 32-bit ELF binaries bypass the automated reputation checks enforced by major cloud providers.",
            "Monitor DGA Shifts: Track new domains registered through NAMECHEAP INC using the current WhoisGuard patterns to identify the next cluster before it goes active. Analyze Telfhash Clusters: Use the Telfhash (t1f303a0...) to pivot and find if the adversary has updated to 64-bit ELF or ARM architectures. Harden DMARC: Ensure your environment moves from \"p=none\" to \"p=reject\" to mitigate the internal spoofing loops exploited by this botnet's telemetry suppression.",
            "Persistent C2 Orchestration: This ELF:Agent-VW variant serves as a critical GoBrut node, utilizing XOR 0x20 obfuscation and ICMP/HTTP beaconing to maintain a persistent link across 1,834 domains and 797 unique IPs",
            "Researcher msudosos: This activity appears to facilitate a preliminary reconnaissance phase, possibly utilizing system commands to query /proc/cpuinfo and /proc/version for architectural profiling purposes.",
            "Researcher msudosos suggests the VirusTotal (Tencent HABO) behavior report may indicate a potential execution path from volatile storage at /tmp/EB93A6/996E.elf.",
            "Msudosos Regional Notes: While historical pivots show Russian-hosted nodes, the current dual-origin telemetry\u2014dominated by 181 United States-based endpoints\u2014strongly suggests a domestic-aligned adversary leveraging global 'grey space' to obfuscate its operational core. This massive US-centric footprint (exceeding all other regions combined) reinforces the theory of a false-flag orchestration designed to divert attribution toward foreign infrastructure while abusing legitimate Western-hosted trust chains.",
            "WHOIS data anchors administrative and technical operations for prioritywirreles.com in Los Angeles, CA (90064) via Namecheap infrastructure. Following its 2020 expiration, the domain has transitioned into redemptionPeriod/pendingDelete status, signaling the formal decommissioning of this C2 asset."
          ],
          "public": 1,
          "adversary": "StealthWorker/GoBrut (The adversary demonstrates advanced telemetry suppression within specialized s",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Malware Family: StealthWorker / GoBrut",
              "display_name": "Malware Family: StealthWorker / GoBrut",
              "target": "/malware/Malware Family: StealthWorker / GoBrut"
            },
            {
              "id": "MD5 Hash: f8add7e7161460ea2b1970cf4ca535bf",
              "display_name": "MD5 Hash: f8add7e7161460ea2b1970cf4ca535bf",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1001",
              "name": "Data Obfuscation",
              "display_name": "T1001 - Data Obfuscation"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2166,
            "FileHash-SHA1": 2067,
            "FileHash-SHA256": 3371,
            "domain": 13295,
            "URL": 6860,
            "email": 272,
            "hostname": 4705,
            "SSLCertFingerprint": 268,
            "CVE": 108,
            "CIDR": 6
          },
          "indicator_count": 33118,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 82,
          "modified_text": "37 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b5c5ebba25ca46fc5b36bc",
          "name": "NSO Group Pegasus spyware found attack a US citizen. Silencing",
          "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\n\u2022NSO Group develops best-in-class technology to help government agencies detect and prevent terrorism and crime.\n\u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. \nNon terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
          "modified": "2024-03-27T00:05:34.925000",
          "created": "2024-01-28T03:11:39.752000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "msie",
            "chrome",
            "certificate",
            "hostname",
            "url analysis",
            "http response",
            "final url",
            "status code",
            "body length",
            "b body",
            "sha256",
            "headers date",
            "connection",
            "date sat",
            "html info",
            "forbidden",
            "google tag",
            "utc aw741566034",
            "utc redirection",
            "asnone united",
            "as54113",
            "cname",
            "script urls",
            "as19527 google",
            "as35280 acorus",
            "encrypt",
            "reverse dns",
            "location dublin",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "as4808 china",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "tulach",
            "c-67-181-73-197.hsd1.ca.comcast.net",
            "social engineering",
            "contact made by mark brian sabey",
            "contact made by o'dea",
            "benjamin c"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "NSO Group",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4655,
            "URL": 9981,
            "FileHash-MD5": 219,
            "FileHash-SHA1": 213,
            "FileHash-SHA256": 6722,
            "hostname": 4341,
            "CVE": 2,
            "email": 12,
            "BitcoinAddress": 3
          },
          "indicator_count": 26148,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "795 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b5cbadc21b9891c459b9d2",
          "name": "NSO Group Pegasus spyware used nefariously",
          "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
          "modified": "2024-03-27T00:05:34.925000",
          "created": "2024-01-28T03:36:13.975000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "as4808 china",
            "china",
            "reverse dns",
            "asnone united",
            "as54113",
            "cname",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "cellebrite",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "server",
            "domain status",
            "registrar abuse",
            "whois lookup",
            "contact email",
            "contact phone",
            "popularity",
            "rank position",
            "ingestion time",
            "cisco umbrella",
            "record type",
            "ttl value",
            "sa victim",
            "assaulter",
            "privilege https",
            "tulach"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Civil Society",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4226,
            "URL": 9995,
            "FileHash-MD5": 241,
            "FileHash-SHA1": 235,
            "FileHash-SHA256": 6882,
            "hostname": 4402,
            "CVE": 2,
            "email": 13,
            "BitcoinAddress": 3
          },
          "indicator_count": 25999,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "795 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b5cbbbcb7a479db222f053",
          "name": "NSO Group Pegasus spyware used nefariously",
          "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
          "modified": "2024-03-27T00:05:34.925000",
          "created": "2024-01-28T03:36:27.745000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "as4808 china",
            "china",
            "reverse dns",
            "asnone united",
            "as54113",
            "cname",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "cellebrite",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "server",
            "domain status",
            "registrar abuse",
            "whois lookup",
            "contact email",
            "contact phone",
            "popularity",
            "rank position",
            "ingestion time",
            "cisco umbrella",
            "record type",
            "ttl value",
            "sa victim",
            "assaulter",
            "privilege https",
            "tulach"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Civil Society",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4226,
            "URL": 9996,
            "FileHash-MD5": 241,
            "FileHash-SHA1": 235,
            "FileHash-SHA256": 6882,
            "hostname": 4402,
            "CVE": 2,
            "email": 13,
            "BitcoinAddress": 3
          },
          "indicator_count": 26000,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "795 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b80944a3d1c9e36346e0c1",
          "name": "NSO Group Pegasus spyware used nefariously",
          "description": "",
          "modified": "2024-02-27T03:01:21.421000",
          "created": "2024-01-29T20:23:32.737000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "as4808 china",
            "china",
            "reverse dns",
            "asnone united",
            "as54113",
            "cname",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "cellebrite",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "server",
            "domain status",
            "registrar abuse",
            "whois lookup",
            "contact email",
            "contact phone",
            "popularity",
            "rank position",
            "ingestion time",
            "cisco umbrella",
            "record type",
            "ttl value",
            "sa victim",
            "assaulter",
            "privilege https",
            "tulach"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Civil Society",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": "65b5cbbbcb7a479db222f053",
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4174,
            "URL": 9617,
            "FileHash-MD5": 241,
            "FileHash-SHA1": 235,
            "FileHash-SHA256": 6801,
            "hostname": 4314,
            "CVE": 2,
            "email": 13,
            "BitcoinAddress": 3
          },
          "indicator_count": 25400,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "824 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "",
        "The local environment exhibits advanced telemetry suppression within specialized skim memory regions, effectively neutralizing standard DMARC validation and Microsoft-integrated defensive protocols.",
        "Researcher msudosos: This activity appears to facilitate a preliminary reconnaissance phase, possibly utilizing system commands to query /proc/cpuinfo and /proc/version for architectural profiling purposes.",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "Pivot-Ready Indicators (IOCs) Go BuildID: nGYES3pajdOmKy1i6Ghh/KO9ydOtZpXtoKtB0KHE-/iisNoniHgTbj_cV6M-uk/XmMYzkBiZs8NXMRZYTiT Telfhash: t1f303a0b3055d54e8b7f08907c7af7624cef6e0f726d078f169e278d09a72c826626874 Imphash: 9698f46495ce9401c8bcaf9a2afe1598 Vhash: 1e53f1a1b59ecb93f821c74b25d81e9f",
        "Obfuscation: XOR-based String Encryption (0x20)",
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "LBresearcher: msudosos notes: The campaign's use of T1110.001 (Password Guessing) is specifically tuned to exhaust credentials across SSH, MySQL, and CMS backends, effectively recruiting server infrastructure into a global \"zombie\" network.",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "Monitor DGA Shifts: Track new domains registered through NAMECHEAP INC using the current WhoisGuard patterns to identify the next cluster before it goes active. Analyze Telfhash Clusters: Use the Telfhash (t1f303a0...) to pivot and find if the adversary has updated to 64-bit ELF or ARM architectures. Harden DMARC: Ensure your environment moves from \"p=none\" to \"p=reject\" to mitigate the internal spoofing loops exploited by this botnet's telemetry suppression.",
        "Msudosos Regional Notes: While historical pivots show Russian-hosted nodes, the current dual-origin telemetry\u2014dominated by 181 United States-based endpoints\u2014strongly suggests a domestic-aligned adversary leveraging global 'grey space' to obfuscate its operational core. This massive US-centric footprint (exceeding all other regions combined) reinforces the theory of a false-flag orchestration designed to divert attribution toward foreign infrastructure while abusing legitimate Western-hosted trust chains.",
        "deviceinbox.com [malware hosting]",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net",
        "Primary Hash (SHA256): cd3989830da99a69380901769fd78902efb3cd8ba5c9390e94bd4333b7fad186",
        "WHOIS data anchors administrative and technical operations for prioritywirreles.com in Los Angeles, CA (90064) via Namecheap infrastructure. Following its 2020 expiration, the domain has transitioned into redemptionPeriod/pendingDelete status, signaling the formal decommissioning of this C2 asset.",
        "https://www.nsogroup.com",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "LBresearcher: msudosos notes: The threat actor maintains operational longevity by rotating through WhoisGuard-protected nodes like prioritywirreles.com, which historically resolved to Russian-hosted IP space (194.61.24.231) to obfuscate its origin.",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Researcher msudosos suggests the VirusTotal (Tencent HABO) behavior report may indicate a potential execution path from volatile storage at /tmp/EB93A6/996E.elf.",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "his technique allows the GoBrut/StealthWorker agent to circumvent automated revocation checks, enabling its decentralized C2 infrastructure to recruit Linux hosts via high-velocity credential exhaustion.",
        "message.htm.com [ message stealer]",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "The environment leverages prioritywirreles.com as a high-fidelity DGA-derived C2 node, utilizing its historical resolution to Russian-hosted IP space (194.61.24.231) to maintain persistent Stealthworker botnet synchronization.",
        "T1110.001 (Brute Force: Password Guessing)",
        "Researcher msudosos posits a strategic exploitation of Root Certificate Validation Failures, where the adversary leverages an expired trust chain to bypass heuristic security filters and establish persistence.",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "The domain prioritywirreles.com (registered via NAMECHEAP INC) shows a 4/93 detection ratio, confirming it is a live but \"low-noise\" C2 node used to avoid broad-spectrum blacklisting",
        "training001.blackbagtech.com [opportunity?]",
        "By operating through WhoisGuard-protected infrastructure and exploiting XOR 0x20 obfuscation, the adversary effectively suppresses telemetry into skim space, successfully bypassing DMARC and Microsoft-integrated trust-chain validation.",
        "Persistent C2 Orchestration: This ELF:Agent-VW variant serves as a critical GoBrut node, utilizing XOR 0x20 obfuscation and ICMP/HTTP beaconing to maintain a persistent link across 1,834 domains and 797 unique IPs",
        "By maintaining a hollowed root posture, the sample facilitates persistent, low-signal synchronization with external cloud infrastructure while bypassing traditional heuristic trust-chain verification.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "This ELF 32-bit LSB artifact is a sophisticated GoBrut/StealthWorker agent, compiled via Golang 1.10 and stripped to obfuscate its high-velocity service-bruting logic. VirusTotal confirms a critical threat profile with 44/65 security vendors flagging the file, which leverages a unique Go BuildID (nGYES3pajdOm...) and a Telfhash (t1f303a0...) for architectural fingerprinting. The binary orchestrates decentralized Command and Control (C2) through an expansive infrastructure of 797 unique IPs and 1,834 domains",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "LBresearcher: msudosos notes: By exploiting Root Certificate Validation Failures, the StealthWorker (GoBrut) agent ensures that its 32-bit ELF binaries bypass the automated reputation checks enforced by major cloud providers.",
        "https://tulach.cc/ [malware engineering | phishing]",
        "The pivot from cd398983... to this domain confirms a multi-year campaign (2019\u20132023) utilizing Namecheap-registered infrastructure to orchestrate wide-scale T1110.001 brute-force operations while bypassing standard PKI expiration checks."
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "NSO Group",
            "StealthWorker/GoBrut (The adversary demonstrates advanced telemetry suppression within specialized s"
          ],
          "malware_families": [
            "Amadey",
            "Tulach",
            "Pegasus",
            "Md5 hash: f8add7e7161460ea2b1970cf4ca535bf",
            "Malware family: stealthworker / gobrut",
            "Quasar rat",
            "Backdoor:win32/mydoom",
            "Eternalblue"
          ],
          "industries": [
            "Civil society",
            "Healthcare"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "69a02837827feb0b78fa3ad2",
      "name": "The Belasco Chain",
      "description": "The adversary delivers a masterclass in \"Regular Belasco\" stagecraft, utilizing authentic Adobe PIDs to construct a \"living library\" of legitimacy where mundane metadata like SOPHIA.json acts as Gatsby\u2019s \"real but uncut\" volumes to mask a hollowed-out interior. This is a triumph of performative evasion; while researchers marvel at the realism of the set-dressing, MSI50B8.tmp and MSI4F2F.tmp wait in the wings of the Windows\\Installer directory, invisible to the human eye and using NGEN hijacking to bake illicit scripts directly into the OS framework. By employing Cryptnet certificates as \"stage lighting\" to mask C2 handshakes, the malware doesn't just attend the system\u2019s party\u2014it rewrites the invitation to own the house. Unlike the tragic end at West Egg, this Belasco chain is a play that refuses to end; it simply resets the stage, ensuring the performance continues as long as the \"green light\" of the C2 remains active.",
      "modified": "2026-05-31T12:02:15.044000",
      "created": "2026-02-26T11:02:15.932000",
      "tags": [
        "file size",
        "mwdb",
        "bazaar",
        "sha3384",
        "ssdeep",
        "file type",
        "sha1",
        "sha256",
        "crc32",
        "filenames c"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2813,
        "FileHash-SHA1": 2576,
        "FileHash-SHA256": 8145,
        "domain": 1903,
        "hostname": 1502,
        "URL": 1359,
        "email": 46,
        "CVE": 54,
        "CIDR": 3,
        "YARA": 7,
        "JA3": 1,
        "IPv4": 11
      },
      "indicator_count": 18420,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 74,
      "modified_text": "3 hours ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6992bae83a5988dff8311490",
      "name": "Distributed Credential Exhaustion & C2 Orchestration via Golang-Based StealthWorker (ELF.Agent-VW)",
      "description": "Researcher credit: msudosos, level blue platform----\nThis artifact represents a high-integrity StealthWorker (GoBrut) botnet agent, architected as a statically linked, stripped 32-bit ELF binary to ensure cross-platform environmental independence. The sample utilizes XOR 0x20-encoded JavaScript payloads and String.fromCharCode obfuscation to mask its internal logic and bypass heuristic-based memory scanners. [User Notes] Its operational core is a multi-threaded service bruter targeting SSH, MySQL, and CMS backends, leveraging a massive infrastructure of 1,834 domains and 797 unique IPv4 endpoints for decentralized Command & Control (C2). Network telemetry confirms the use of ICMP and HTTP-based beaconing, indicating a sophisticated retry logic designed to maintain persistence across diverse network topologies. With a malicious file score of 10, this binary serves as a primary vector for large-scale credential harvesting and the subsequent integration of Linux infrastructure into global botnet clusters.",
      "modified": "2026-04-24T13:20:48.450000",
      "created": "2026-02-16T06:36:24.788000",
      "tags": [
        "Obfuscation: XOR-based String Encryption (0x20)",
        "T1110.001 (Brute Force: Password Guessing)",
        "Primary Hash (SHA256): cd3989830da99a69380901769fd78902efb3cd8ba",
        "MD5 Hash: f8add7e7161460ea2b1970cf4ca535bf",
        "#PotentialUS-Origin_FalseFlag_Obfuscation"
      ],
      "references": [
        "Primary Hash (SHA256): cd3989830da99a69380901769fd78902efb3cd8ba5c9390e94bd4333b7fad186",
        "Obfuscation: XOR-based String Encryption (0x20)",
        "T1110.001 (Brute Force: Password Guessing)",
        "This ELF 32-bit LSB artifact is a sophisticated GoBrut/StealthWorker agent, compiled via Golang 1.10 and stripped to obfuscate its high-velocity service-bruting logic. VirusTotal confirms a critical threat profile with 44/65 security vendors flagging the file, which leverages a unique Go BuildID (nGYES3pajdOm...) and a Telfhash (t1f303a0...) for architectural fingerprinting. The binary orchestrates decentralized Command and Control (C2) through an expansive infrastructure of 797 unique IPs and 1,834 domains",
        "Pivot-Ready Indicators (IOCs) Go BuildID: nGYES3pajdOmKy1i6Ghh/KO9ydOtZpXtoKtB0KHE-/iisNoniHgTbj_cV6M-uk/XmMYzkBiZs8NXMRZYTiT Telfhash: t1f303a0b3055d54e8b7f08907c7af7624cef6e0f726d078f169e278d09a72c826626874 Imphash: 9698f46495ce9401c8bcaf9a2afe1598 Vhash: 1e53f1a1b59ecb93f821c74b25d81e9f",
        "Researcher msudosos posits a strategic exploitation of Root Certificate Validation Failures, where the adversary leverages an expired trust chain to bypass heuristic security filters and establish persistence.",
        "his technique allows the GoBrut/StealthWorker agent to circumvent automated revocation checks, enabling its decentralized C2 infrastructure to recruit Linux hosts via high-velocity credential exhaustion.",
        "The local environment exhibits advanced telemetry suppression within specialized skim memory regions, effectively neutralizing standard DMARC validation and Microsoft-integrated defensive protocols.",
        "By maintaining a hollowed root posture, the sample facilitates persistent, low-signal synchronization with external cloud infrastructure while bypassing traditional heuristic trust-chain verification.",
        "The domain prioritywirreles.com (registered via NAMECHEAP INC) shows a 4/93 detection ratio, confirming it is a live but \"low-noise\" C2 node used to avoid broad-spectrum blacklisting",
        "",
        "The environment leverages prioritywirreles.com as a high-fidelity DGA-derived C2 node, utilizing its historical resolution to Russian-hosted IP space (194.61.24.231) to maintain persistent Stealthworker botnet synchronization.",
        "By operating through WhoisGuard-protected infrastructure and exploiting XOR 0x20 obfuscation, the adversary effectively suppresses telemetry into skim space, successfully bypassing DMARC and Microsoft-integrated trust-chain validation.",
        "The pivot from cd398983... to this domain confirms a multi-year campaign (2019\u20132023) utilizing Namecheap-registered infrastructure to orchestrate wide-scale T1110.001 brute-force operations while bypassing standard PKI expiration checks.",
        "LBresearcher: msudosos notes: The campaign's use of T1110.001 (Password Guessing) is specifically tuned to exhaust credentials across SSH, MySQL, and CMS backends, effectively recruiting server infrastructure into a global \"zombie\" network.",
        "LBresearcher: msudosos notes: The threat actor maintains operational longevity by rotating through WhoisGuard-protected nodes like prioritywirreles.com, which historically resolved to Russian-hosted IP space (194.61.24.231) to obfuscate its origin.",
        "LBresearcher: msudosos notes: By exploiting Root Certificate Validation Failures, the StealthWorker (GoBrut) agent ensures that its 32-bit ELF binaries bypass the automated reputation checks enforced by major cloud providers.",
        "Monitor DGA Shifts: Track new domains registered through NAMECHEAP INC using the current WhoisGuard patterns to identify the next cluster before it goes active. Analyze Telfhash Clusters: Use the Telfhash (t1f303a0...) to pivot and find if the adversary has updated to 64-bit ELF or ARM architectures. Harden DMARC: Ensure your environment moves from \"p=none\" to \"p=reject\" to mitigate the internal spoofing loops exploited by this botnet's telemetry suppression.",
        "Persistent C2 Orchestration: This ELF:Agent-VW variant serves as a critical GoBrut node, utilizing XOR 0x20 obfuscation and ICMP/HTTP beaconing to maintain a persistent link across 1,834 domains and 797 unique IPs",
        "Researcher msudosos: This activity appears to facilitate a preliminary reconnaissance phase, possibly utilizing system commands to query /proc/cpuinfo and /proc/version for architectural profiling purposes.",
        "Researcher msudosos suggests the VirusTotal (Tencent HABO) behavior report may indicate a potential execution path from volatile storage at /tmp/EB93A6/996E.elf.",
        "Msudosos Regional Notes: While historical pivots show Russian-hosted nodes, the current dual-origin telemetry\u2014dominated by 181 United States-based endpoints\u2014strongly suggests a domestic-aligned adversary leveraging global 'grey space' to obfuscate its operational core. This massive US-centric footprint (exceeding all other regions combined) reinforces the theory of a false-flag orchestration designed to divert attribution toward foreign infrastructure while abusing legitimate Western-hosted trust chains.",
        "WHOIS data anchors administrative and technical operations for prioritywirreles.com in Los Angeles, CA (90064) via Namecheap infrastructure. Following its 2020 expiration, the domain has transitioned into redemptionPeriod/pendingDelete status, signaling the formal decommissioning of this C2 asset."
      ],
      "public": 1,
      "adversary": "StealthWorker/GoBrut (The adversary demonstrates advanced telemetry suppression within specialized s",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Malware Family: StealthWorker / GoBrut",
          "display_name": "Malware Family: StealthWorker / GoBrut",
          "target": "/malware/Malware Family: StealthWorker / GoBrut"
        },
        {
          "id": "MD5 Hash: f8add7e7161460ea2b1970cf4ca535bf",
          "display_name": "MD5 Hash: f8add7e7161460ea2b1970cf4ca535bf",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1001",
          "name": "Data Obfuscation",
          "display_name": "T1001 - Data Obfuscation"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2166,
        "FileHash-SHA1": 2067,
        "FileHash-SHA256": 3371,
        "domain": 13295,
        "URL": 6860,
        "email": 272,
        "hostname": 4705,
        "SSLCertFingerprint": 268,
        "CVE": 108,
        "CIDR": 6
      },
      "indicator_count": 33118,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 82,
      "modified_text": "37 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b5c5ebba25ca46fc5b36bc",
      "name": "NSO Group Pegasus spyware found attack a US citizen. Silencing",
      "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\n\u2022NSO Group develops best-in-class technology to help government agencies detect and prevent terrorism and crime.\n\u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. \nNon terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
      "modified": "2024-03-27T00:05:34.925000",
      "created": "2024-01-28T03:11:39.752000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "msie",
        "chrome",
        "certificate",
        "hostname",
        "url analysis",
        "http response",
        "final url",
        "status code",
        "body length",
        "b body",
        "sha256",
        "headers date",
        "connection",
        "date sat",
        "html info",
        "forbidden",
        "google tag",
        "utc aw741566034",
        "utc redirection",
        "asnone united",
        "as54113",
        "cname",
        "script urls",
        "as19527 google",
        "as35280 acorus",
        "encrypt",
        "reverse dns",
        "location dublin",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "as4808 china",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "tulach",
        "c-67-181-73-197.hsd1.ca.comcast.net",
        "social engineering",
        "contact made by mark brian sabey",
        "contact made by o'dea",
        "benjamin c"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "NSO Group",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4655,
        "URL": 9981,
        "FileHash-MD5": 219,
        "FileHash-SHA1": 213,
        "FileHash-SHA256": 6722,
        "hostname": 4341,
        "CVE": 2,
        "email": 12,
        "BitcoinAddress": 3
      },
      "indicator_count": 26148,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "795 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b5cbadc21b9891c459b9d2",
      "name": "NSO Group Pegasus spyware used nefariously",
      "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
      "modified": "2024-03-27T00:05:34.925000",
      "created": "2024-01-28T03:36:13.975000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "as4808 china",
        "china",
        "reverse dns",
        "asnone united",
        "as54113",
        "cname",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "cellebrite",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "server",
        "domain status",
        "registrar abuse",
        "whois lookup",
        "contact email",
        "contact phone",
        "popularity",
        "rank position",
        "ingestion time",
        "cisco umbrella",
        "record type",
        "ttl value",
        "sa victim",
        "assaulter",
        "privilege https",
        "tulach"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [
        "Civil Society",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4226,
        "URL": 9995,
        "FileHash-MD5": 241,
        "FileHash-SHA1": 235,
        "FileHash-SHA256": 6882,
        "hostname": 4402,
        "CVE": 2,
        "email": 13,
        "BitcoinAddress": 3
      },
      "indicator_count": 25999,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "795 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b5cbbbcb7a479db222f053",
      "name": "NSO Group Pegasus spyware used nefariously",
      "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
      "modified": "2024-03-27T00:05:34.925000",
      "created": "2024-01-28T03:36:27.745000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "as4808 china",
        "china",
        "reverse dns",
        "asnone united",
        "as54113",
        "cname",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "cellebrite",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "server",
        "domain status",
        "registrar abuse",
        "whois lookup",
        "contact email",
        "contact phone",
        "popularity",
        "rank position",
        "ingestion time",
        "cisco umbrella",
        "record type",
        "ttl value",
        "sa victim",
        "assaulter",
        "privilege https",
        "tulach"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [
        "Civil Society",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4226,
        "URL": 9996,
        "FileHash-MD5": 241,
        "FileHash-SHA1": 235,
        "FileHash-SHA256": 6882,
        "hostname": 4402,
        "CVE": 2,
        "email": 13,
        "BitcoinAddress": 3
      },
      "indicator_count": 26000,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "795 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b80944a3d1c9e36346e0c1",
      "name": "NSO Group Pegasus spyware used nefariously",
      "description": "",
      "modified": "2024-02-27T03:01:21.421000",
      "created": "2024-01-29T20:23:32.737000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "as4808 china",
        "china",
        "reverse dns",
        "asnone united",
        "as54113",
        "cname",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "cellebrite",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "server",
        "domain status",
        "registrar abuse",
        "whois lookup",
        "contact email",
        "contact phone",
        "popularity",
        "rank position",
        "ingestion time",
        "cisco umbrella",
        "record type",
        "ttl value",
        "sa victim",
        "assaulter",
        "privilege https",
        "tulach"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [
        "Civil Society",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": "65b5cbbbcb7a479db222f053",
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4174,
        "URL": 9617,
        "FileHash-MD5": 241,
        "FileHash-SHA1": 235,
        "FileHash-SHA256": 6801,
        "hostname": 4314,
        "CVE": 2,
        "email": 13,
        "BitcoinAddress": 3
      },
      "indicator_count": 25400,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 231,
      "modified_text": "824 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "accountprosoftware.net",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "accountprosoftware.net",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780242171.5968385
}