{ "type": "Domain", "indicator": "attiferstudio.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/attiferstudio.com", "alexa": "http://www.alexa.com/siteinfo/attiferstudio.com", "indicator": "attiferstudio.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3645494192, "indicator": "attiferstudio.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 16, "pulses": [ { "id": "6a04a9a090a64de310cb0568", "name": "Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign", "description": "A sophisticated campaign linked to APT37 delivers Python-based backdoors through spear-phishing emails containing malicious LNK files disguised as legitimate documents. Attackers use themes including airline e-tickets, North Korea research invitations, and impersonation of defense and police officials to induce execution. The LNK files employ environment variable-based obfuscation techniques to download additional BAT files, which establish a Python runtime environment and execute compiled Python bytecode disguised with .cat extensions. The malware functions as a remote command execution backdoor, communicating with C2 servers to receive commands and exfiltrate results. Persistence is maintained through scheduled tasks executing at one-minute intervals. The campaign shows strong tactical similarities to previous APT37 operations, including infrastructure patterns, script obfuscation methods, and the abuse of legitimate tools.", "modified": "2026-05-14T08:36:05.694000", "created": "2026-05-13T16:41:04.367000", "tags": [ "compiled python bytecode", "apt37", "environment variable obfuscation", "chinotto", "deepfake impersonation", "python backdoor", "spear-phishing", "scheduled tasks persistence", "lnk file" ], "references": [ "https://www.genians.co.kr/en/blog/threat_intelligence/python?hsCtaAttrib=343278473915" ], "public": 1, "adversary": "APT37", "targeted_countries": [], "malware_families": [ { "id": "Chinotto", "display_name": "Chinotto", "target": null } ], "attack_ids": [], "industries": [ "Defense", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "IPv4": 6, "CVE": 1, "FileHash-MD5": 11, "domain": 18 }, "indicator_count": 36, "is_author": false, "is_subscribing": null, "subscriber_count": 386464, "modified_text": "16 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6415fe988c558af39eeb94a3", "name": "Peeking at Reaper\u2019s surveillance operations", "description": "", "modified": "2023-04-17T18:01:57.645000", "created": "2023-03-18T18:10:29.864000", "tags": [ "Reaper", "APT", "espionage", "phishing", "PowerShell", "Chinotto", "backdoor", "CHM", "MSHTA", "AblyGo", "ExtremeVNC" ], "references": [ "https://blog.sekoia.io/peeking-at-reaper-surveillance-operations-against-north-korea-defectors/" ], "public": 1, "adversary": "Reaper", "targeted_countries": [], "malware_families": [ { "id": "AblyGo", "display_name": "AblyGo", "target": null }, { "id": "Chinotto", "display_name": "Chinotto", "target": null }, { "id": "ExtremeVNC", "display_name": "ExtremeVNC", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1212", "name": "Exploitation for Credential Access", "display_name": "T1212 - Exploitation for Credential Access" }, { "id": "T1503", "name": "Credentials from Web Browsers", "display_name": "T1503 - Credentials from Web Browsers" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 396, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "URL": 10, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 205, "YARA": 7, "domain": 5 }, "indicator_count": 229, "is_author": false, "is_subscribing": null, "subscriber_count": 386463, "modified_text": "1139 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a06a551635dbbeed40b21cd", "name": "Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign", "description": "", "modified": "2026-05-15T04:47:13.553000", "created": "2026-05-15T04:47:13.553000", "tags": [ "compiled python bytecode", "apt37", "environment variable obfuscation", "chinotto", "deepfake impersonation", "python backdoor", "spear-phishing", "scheduled tasks persistence", "lnk file" ], "references": [ "https://www.genians.co.kr/en/blog/threat_intelligence/python?hsCtaAttrib=343278473915" ], "public": 1, "adversary": "APT37", "targeted_countries": [], "malware_families": [ { "id": "Chinotto", "display_name": "Chinotto", "target": null } ], "attack_ids": [], "industries": [ "Defense", "Government" ], "TLP": "white", "cloned_from": "6a04a9a090a64de310cb0568", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 6, "CVE": 1, "FileHash-MD5": 11, "domain": 18 }, "indicator_count": 36, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "15 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a06a54fa41ca0f2894e09e0", "name": "Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign", "description": "", "modified": "2026-05-15T04:47:11.556000", "created": "2026-05-15T04:47:11.556000", "tags": [ "compiled python bytecode", "apt37", "environment variable obfuscation", "chinotto", "deepfake impersonation", "python backdoor", "spear-phishing", "scheduled tasks persistence", "lnk file" ], "references": [ "https://www.genians.co.kr/en/blog/threat_intelligence/python?hsCtaAttrib=343278473915" ], "public": 1, "adversary": "APT37", "targeted_countries": [], "malware_families": [ { "id": "Chinotto", "display_name": "Chinotto", "target": null } ], "attack_ids": [], "industries": [ "Defense", "Government" ], "TLP": "white", "cloned_from": "6a04a9a090a64de310cb0568", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 6, "CVE": 1, "FileHash-MD5": 11, "domain": 18 }, "indicator_count": 36, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "15 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a048d03417ba877dc0a4e1d", "name": "Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign", "description": "", "modified": "2026-05-13T14:38:59.926000", "created": "2026-05-13T14:38:59.926000", "tags": [ "c2 server", "lnk file", "figure", "north korea", "python bytecode", "compiled python", "python", "apt37 group", "python runtime", "offset", "powershell", "april", "initial access", "attack", "execution", "first", "code", "cookie", "path", "trojan", "malicious", "friday" ], "references": [ "https://www.genians.co.kr/en/blog/threat_intelligence/python?hsCtaAttrib=343278473915" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 7, "CVE": 1, "FileHash-MD5": 11, "URL": 1, "domain": 18, "email": 1, "hostname": 1 }, "indicator_count": 40, "is_author": false, "is_subscribing": null, "subscriber_count": 864, "modified_text": "17 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a047bb5f2b9d59bf3636161", "name": "EbeeMay2026 Pt2", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-05-13T13:25:09.112000", "created": "2026-05-13T13:25:09.112000", "tags": [ "filehashsha256", "filehashmd5", "filehashsha1", "cve20250921 cve", "cve20260300 cve", "cve20261281 cve", "cve20261340 cve", "cve20261731 cve", "cve20261357 cve", "cve20259501 cve", "yara" ], "references": [ "IOCs.csv" ], "public": 1, "adversary": "JDownloader, DarkCloud, Chaos Ransomware, APT29, Shadow-Earth-053", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 66, "URL": 45, "CVE": 23, "FileHash-MD5": 232, "FileHash-SHA1": 239, "FileHash-SHA256": 264, "domain": 130, "email": 3, "hostname": 41 }, "indicator_count": 1043, "is_author": false, "is_subscribing": null, "subscriber_count": 40, "modified_text": "17 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a02da5139868596248b6e77", "name": "Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign", "description": "", "modified": "2026-05-12T07:44:17.728000", "created": "2026-05-12T07:44:17.728000", "tags": [ "c2 server", "lnk file", "figure", "north korea", "python bytecode", "compiled python", "python", "apt37 group", "python runtime", "offset", "powershell", "april", "initial access", "attack", "execution", "first", "code", "cookie", "path", "trojan", "malicious", "friday" ], "references": [ "https://www.genians.co.kr/en/blog/threat_intelligence/python" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 7, "CVE": 1, "FileHash-MD5": 11, "URL": 1, "domain": 18, "email": 1, "hostname": 1 }, "indicator_count": 40, "is_author": false, "is_subscribing": null, "subscriber_count": 278, "modified_text": "18 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642376d69766b6feb6e46df6", "name": "InQuest - 28-03-2023", "description": "", "modified": "2023-04-27T23:00:42.616000", "created": "2023-03-28T23:23:02.048000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 889, "URL": 1468, "hostname": 297, "FileHash-SHA256": 199, "FileHash-MD5": 54, "FileHash-SHA1": 11 }, "indicator_count": 2918, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1129 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64485fe1b2fa503cff822d9a", "name": "Twitter Feed - suyog41 - 25-04-2023", "description": "", "modified": "2023-04-25T23:18:57.189000", "created": "2023-04-25T23:18:57.189000", "tags": [], "references": [ "https://twitter.com/suyog41/status/1650807252843102208" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "FileHash-MD5": 1 }, "indicator_count": 2, "is_author": false, "is_subscribing": null, "subscriber_count": 1620, "modified_text": "1131 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "641c46982eec05bf5ed54647", "name": "Peeking at Reaper\u2019s surveillance operations - SEKOIA.IO Blog", "description": "A survey conducted by security researchers on two C2s of the North Korea-nexus intrusion set Reaper (aka APT37) led to the uncovering of several phishing web pages, new PowerShell implants, and a signature malware.", "modified": "2023-04-22T12:00:17.550000", "created": "2023-03-23T12:31:20.940000", "tags": [ "cku", "chinotto", "ablygo", "reaper", "powershell", "kaspersky", "data", "command", "dprk", "http", "html", "dlls", "malicious", "conti", "android", "copy", "next" ], "references": [ "https://blog.sekoia.io/peeking-at-reaper-surveillance-operations-against-north-korea-defectors/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "AblyGo", "display_name": "AblyGo", "target": null }, { "id": "Chinotto", "display_name": "Chinotto", "target": null }, { "id": "CKU", "display_name": "CKU", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1078", "name": "Valid Accounts", "display_name": "T1078 - Valid Accounts" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" } ], "industries": [ "Journalists" ], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 13, "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 205, "YARA": 7, "domain": 5 }, "indicator_count": 234, "is_author": false, "is_subscribing": null, "subscriber_count": 862, "modified_text": "1134 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "641b3b56539f3a138aa79fb1", "name": "Peeking at Reaper\u2019s surveillance operations - SEKOIA.IO Blog", "description": "A survey conducted by security researchers on two C2s of the North Korea-nexus intrusion set Reaper (aka APT37) led to the uncovering of several phishing web pages, new PowerShell implants, and a signature malware.", "modified": "2023-04-21T17:02:41.342000", "created": "2023-03-22T17:31:02.908000", "tags": [ "cku", "chinotto", "ablygo", "reaper", "powershell", "kaspersky", "data", "command", "dprk", "http", "html", "dlls", "malicious", "conti", "android", "copy", "next" ], "references": [ "https://blog.sekoia.io/peeking-at-reaper-surveillance-operations-against-north-korea-defectors/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "AblyGo", "display_name": "AblyGo", "target": null }, { "id": "Chinotto", "display_name": "Chinotto", "target": null }, { "id": "CKU", "display_name": "CKU", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1078", "name": "Valid Accounts", "display_name": "T1078 - Valid Accounts" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" } ], "industries": [ "Journalists" ], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Cyber74Team", "id": "202637", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_202637/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10, "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 205, "domain": 5 }, "indicator_count": 224, "is_author": false, "is_subscribing": null, "subscriber_count": 164, "modified_text": "1135 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "641bf65e1590b03987e3a062", "name": "Peeking at Reaper\u2019s surveillance operations", "description": "", "modified": "2023-04-21T17:02:41.342000", "created": "2023-03-23T06:49:02.837000", "tags": [ "cku", "chinotto", "ablygo", "reaper", "powershell", "kaspersky", "data", "command", "dprk", "http", "html", "dlls", "malicious", "conti", "android", "copy", "next" ], "references": [ "https://blog.sekoia.io/peeking-at-reaper-surveillance-operations-against-north-korea-defectors/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "AblyGo", "display_name": "AblyGo", "target": null }, { "id": "Chinotto", "display_name": "Chinotto", "target": null }, { "id": "CKU", "display_name": "CKU", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1078", "name": "Valid Accounts", "display_name": "T1078 - Valid Accounts" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" } ], "industries": [ "Journalists" ], "TLP": "white", "cloned_from": "641b3b56539f3a138aa79fb1", "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "goatluxy", "id": "207695", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10, "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 205, "domain": 5 }, "indicator_count": 224, "is_author": false, "is_subscribing": null, "subscriber_count": 71, "modified_text": "1135 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6419a2d967c3d4b581f1754a", "name": "Peeking at Reaper\u2019s surveillance operations", "description": "A survey conducted by security researchers on two C2s of the North Korea-nexus intrusion set Reaper (aka APT37) led to the uncovering of several phishing web pages, new PowerShell implants, and a signature malware.", "modified": "2023-04-20T12:00:54.469000", "created": "2023-03-21T12:28:09.866000", "tags": [ "cku", "chinotto", "ablygo", "reaper", "powershell", "kaspersky", "data", "command", "dprk", "http", "html", "dlls", "malicious", "conti", "android", "copy", "next" ], "references": [ "https://blog.sekoia.io/peeking-at-reaper-surveillance-operations-against-north-korea-defectors/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "AblyGo", "display_name": "AblyGo", "target": null }, { "id": "Chinotto", "display_name": "Chinotto", "target": null }, { "id": "CKU", "display_name": "CKU", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1078", "name": "Valid Accounts", "display_name": "T1078 - Valid Accounts" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" } ], "industries": [ "Journalists" ], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "jeffchandy", "id": "215558", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_215558/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10, "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 205, "YARA": 7, "domain": 5 }, "indicator_count": 231, "is_author": false, "is_subscribing": null, "subscriber_count": 55, "modified_text": "1136 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64197ae6d00c72738181a62f", "name": "APT37 aka Reaper Group", "description": "A survey conducted by security researchers on two C2s of the North Korea-nexus intrusion set Reaper (aka APT37) led to the uncovering of several phishing web pages, new PowerShell implants, and a signature malware.", "modified": "2023-04-20T09:03:15.056000", "created": "2023-03-21T09:37:42.711000", "tags": [ "cku", "chinotto", "ablygo", "reaper", "powershell", "kaspersky", "data", "command", "dprk", "http", "html", "dlls", "malicious", "conti", "android", "copy", "next" ], "references": [ "https://blog.sekoia.io/peeking-at-reaper-surveillance-operations-against-north-korea-defectors/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "AblyGo", "display_name": "AblyGo", "target": null }, { "id": "Chinotto", "display_name": "Chinotto", "target": null }, { "id": "CKU", "display_name": "CKU", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1078", "name": "Valid Accounts", "display_name": "T1078 - Valid Accounts" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" } ], "industries": [ "Journalists" ], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "parvesh4399", "id": "224939", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10, "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 205, "YARA": 7, "domain": 5 }, "indicator_count": 231, "is_author": false, "is_subscribing": null, "subscriber_count": 57, "modified_text": "1136 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64160398b0ae35187960cbef", "name": "Miller ", "description": "", "modified": "2023-04-17T18:01:57.645000", "created": "2023-03-18T18:31:52.489000", "tags": [ "Reaper", "APT", "espionage", "phishing", "PowerShell", "Chinotto", "backdoor", "CHM", "MSHTA", "AblyGo", "ExtremeVNC" ], "references": [ "https://blog.sekoia.io/peeking-at-reaper-surveillance-operations-against-north-korea-defectors/" ], "public": 1, "adversary": "Reaper", "targeted_countries": [], "malware_families": [ { "id": "AblyGo", "display_name": "AblyGo", "target": null }, { "id": "Chinotto", "display_name": "Chinotto", "target": null }, { "id": "ExtremeVNC", "display_name": "ExtremeVNC", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1212", "name": "Exploitation for Credential Access", "display_name": "T1212 - Exploitation for Credential Access" }, { "id": "T1503", "name": "Credentials from Web Browsers", "display_name": "T1503 - Credentials from Web Browsers" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" } ], "industries": [], "TLP": "white", "cloned_from": "6415fe988c558af39eeb94a3", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Shane1211", "id": "229864", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 205, "YARA": 7, "domain": 5 }, "indicator_count": 229, "is_author": false, "is_subscribing": null, "subscriber_count": 0, "modified_text": "1139 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642376b57766be5d730167e8", "name": "Twitter Feed - suyog41 - 28-03-2023", "description": "", "modified": "2023-03-28T23:22:29.773000", "created": "2023-03-28T23:22:29.773000", "tags": [], "references": [ "https://twitter.com/suyog41/status/1640662025247289345" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "FileHash-MD5": 1 }, "indicator_count": 2, "is_author": false, "is_subscribing": null, "subscriber_count": 1620, "modified_text": "1159 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.genians.co.kr/en/blog/threat_intelligence/python?hsCtaAttrib=343278473915", "https://twitter.com/suyog41/status/1650807252843102208", "https://blog.sekoia.io/peeking-at-reaper-surveillance-operations-against-north-korea-defectors/", "https://www.genians.co.kr/en/blog/threat_intelligence/python", "https://twitter.com/suyog41/status/1640662025247289345", "https://labs.inquest.net/iocdb", "IOCs.csv" ], "related": { "alienvault": { "adversary": [ "APT37", "Reaper" ], "malware_families": [ "Extremevnc", "Chinotto", "Ablygo" ], "industries": [ "Government", "Defense" ] }, "other": { "adversary": [ "APT37", "JDownloader, DarkCloud, Chaos Ransomware, APT29, Shadow-Earth-053", "Reaper" ], "malware_families": [ "Extremevnc", "Chinotto", "Cku", "Ablygo" ], "industries": [ "Government", "Defense", "Journalists" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 16, "pulses": [ { "id": "6a04a9a090a64de310cb0568", "name": "Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign", "description": "A sophisticated campaign linked to APT37 delivers Python-based backdoors through spear-phishing emails containing malicious LNK files disguised as legitimate documents. Attackers use themes including airline e-tickets, North Korea research invitations, and impersonation of defense and police officials to induce execution. The LNK files employ environment variable-based obfuscation techniques to download additional BAT files, which establish a Python runtime environment and execute compiled Python bytecode disguised with .cat extensions. The malware functions as a remote command execution backdoor, communicating with C2 servers to receive commands and exfiltrate results. Persistence is maintained through scheduled tasks executing at one-minute intervals. The campaign shows strong tactical similarities to previous APT37 operations, including infrastructure patterns, script obfuscation methods, and the abuse of legitimate tools.", "modified": "2026-05-14T08:36:05.694000", "created": "2026-05-13T16:41:04.367000", "tags": [ "compiled python bytecode", "apt37", "environment variable obfuscation", "chinotto", "deepfake impersonation", "python backdoor", "spear-phishing", "scheduled tasks persistence", "lnk file" ], "references": [ "https://www.genians.co.kr/en/blog/threat_intelligence/python?hsCtaAttrib=343278473915" ], "public": 1, "adversary": "APT37", "targeted_countries": [], "malware_families": [ { "id": "Chinotto", "display_name": "Chinotto", "target": null } ], "attack_ids": [], "industries": [ "Defense", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "IPv4": 6, "CVE": 1, "FileHash-MD5": 11, "domain": 18 }, "indicator_count": 36, "is_author": false, "is_subscribing": null, "subscriber_count": 386464, "modified_text": "16 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6415fe988c558af39eeb94a3", "name": "Peeking at Reaper\u2019s surveillance operations", "description": "", "modified": "2023-04-17T18:01:57.645000", "created": "2023-03-18T18:10:29.864000", "tags": [ "Reaper", "APT", "espionage", "phishing", "PowerShell", "Chinotto", "backdoor", "CHM", "MSHTA", "AblyGo", "ExtremeVNC" ], "references": [ "https://blog.sekoia.io/peeking-at-reaper-surveillance-operations-against-north-korea-defectors/" ], "public": 1, "adversary": "Reaper", "targeted_countries": [], "malware_families": [ { "id": "AblyGo", "display_name": "AblyGo", "target": null }, { "id": "Chinotto", "display_name": "Chinotto", "target": null }, { "id": "ExtremeVNC", "display_name": "ExtremeVNC", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1212", "name": "Exploitation for Credential Access", "display_name": "T1212 - Exploitation for Credential Access" }, { "id": "T1503", "name": "Credentials from Web Browsers", "display_name": "T1503 - Credentials from Web Browsers" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 396, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "URL": 10, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 205, "YARA": 7, "domain": 5 }, "indicator_count": 229, "is_author": false, "is_subscribing": null, "subscriber_count": 386463, "modified_text": "1139 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a06a551635dbbeed40b21cd", "name": "Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign", "description": "", "modified": "2026-05-15T04:47:13.553000", "created": "2026-05-15T04:47:13.553000", "tags": [ "compiled python bytecode", "apt37", "environment variable obfuscation", "chinotto", "deepfake impersonation", "python backdoor", "spear-phishing", "scheduled tasks persistence", "lnk file" ], "references": [ "https://www.genians.co.kr/en/blog/threat_intelligence/python?hsCtaAttrib=343278473915" ], "public": 1, "adversary": "APT37", "targeted_countries": [], "malware_families": [ { "id": "Chinotto", "display_name": "Chinotto", "target": null } ], "attack_ids": [], "industries": [ "Defense", "Government" ], "TLP": "white", "cloned_from": "6a04a9a090a64de310cb0568", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 6, "CVE": 1, "FileHash-MD5": 11, "domain": 18 }, "indicator_count": 36, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "15 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a06a54fa41ca0f2894e09e0", "name": "Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign", "description": "", "modified": "2026-05-15T04:47:11.556000", "created": "2026-05-15T04:47:11.556000", "tags": [ "compiled python bytecode", "apt37", "environment variable obfuscation", "chinotto", "deepfake impersonation", "python backdoor", "spear-phishing", "scheduled tasks persistence", "lnk file" ], "references": [ "https://www.genians.co.kr/en/blog/threat_intelligence/python?hsCtaAttrib=343278473915" ], "public": 1, "adversary": "APT37", "targeted_countries": [], "malware_families": [ { "id": "Chinotto", "display_name": "Chinotto", "target": null } ], "attack_ids": [], "industries": [ "Defense", "Government" ], "TLP": "white", "cloned_from": "6a04a9a090a64de310cb0568", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 6, "CVE": 1, "FileHash-MD5": 11, "domain": 18 }, "indicator_count": 36, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "15 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a048d03417ba877dc0a4e1d", "name": "Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign", "description": "", "modified": "2026-05-13T14:38:59.926000", "created": "2026-05-13T14:38:59.926000", "tags": [ "c2 server", "lnk file", "figure", "north korea", "python bytecode", "compiled python", "python", "apt37 group", "python runtime", "offset", "powershell", "april", "initial access", "attack", "execution", "first", "code", "cookie", "path", "trojan", "malicious", "friday" ], "references": [ "https://www.genians.co.kr/en/blog/threat_intelligence/python?hsCtaAttrib=343278473915" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 7, "CVE": 1, "FileHash-MD5": 11, "URL": 1, "domain": 18, "email": 1, "hostname": 1 }, "indicator_count": 40, "is_author": false, "is_subscribing": null, "subscriber_count": 864, "modified_text": "17 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a047bb5f2b9d59bf3636161", "name": "EbeeMay2026 Pt2", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-05-13T13:25:09.112000", "created": "2026-05-13T13:25:09.112000", "tags": [ "filehashsha256", "filehashmd5", "filehashsha1", "cve20250921 cve", "cve20260300 cve", "cve20261281 cve", "cve20261340 cve", "cve20261731 cve", "cve20261357 cve", "cve20259501 cve", "yara" ], "references": [ "IOCs.csv" ], "public": 1, "adversary": "JDownloader, DarkCloud, Chaos Ransomware, APT29, Shadow-Earth-053", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 66, "URL": 45, "CVE": 23, "FileHash-MD5": 232, "FileHash-SHA1": 239, "FileHash-SHA256": 264, "domain": 130, "email": 3, "hostname": 41 }, "indicator_count": 1043, "is_author": false, "is_subscribing": null, "subscriber_count": 40, "modified_text": "17 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a02da5139868596248b6e77", "name": "Python Backdoor Threat Analysis Following an AI Deepfake Impersonation Campaign", "description": "", "modified": "2026-05-12T07:44:17.728000", "created": "2026-05-12T07:44:17.728000", "tags": [ "c2 server", "lnk file", "figure", "north korea", "python bytecode", "compiled python", "python", "apt37 group", "python runtime", "offset", "powershell", "april", "initial access", "attack", "execution", "first", "code", "cookie", "path", "trojan", "malicious", "friday" ], "references": [ "https://www.genians.co.kr/en/blog/threat_intelligence/python" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 7, "CVE": 1, "FileHash-MD5": 11, "URL": 1, "domain": 18, "email": 1, "hostname": 1 }, "indicator_count": 40, "is_author": false, "is_subscribing": null, "subscriber_count": 278, "modified_text": "18 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642376d69766b6feb6e46df6", "name": "InQuest - 28-03-2023", "description": "", "modified": "2023-04-27T23:00:42.616000", "created": "2023-03-28T23:23:02.048000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 889, "URL": 1468, "hostname": 297, "FileHash-SHA256": 199, "FileHash-MD5": 54, "FileHash-SHA1": 11 }, "indicator_count": 2918, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "1129 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64485fe1b2fa503cff822d9a", "name": "Twitter Feed - suyog41 - 25-04-2023", "description": "", "modified": "2023-04-25T23:18:57.189000", "created": "2023-04-25T23:18:57.189000", "tags": [], "references": [ "https://twitter.com/suyog41/status/1650807252843102208" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "FileHash-MD5": 1 }, "indicator_count": 2, "is_author": false, "is_subscribing": null, "subscriber_count": 1620, "modified_text": "1131 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "641c46982eec05bf5ed54647", "name": "Peeking at Reaper\u2019s surveillance operations - SEKOIA.IO Blog", "description": "A survey conducted by security researchers on two C2s of the North Korea-nexus intrusion set Reaper (aka APT37) led to the uncovering of several phishing web pages, new PowerShell implants, and a signature malware.", "modified": "2023-04-22T12:00:17.550000", "created": "2023-03-23T12:31:20.940000", "tags": [ "cku", "chinotto", "ablygo", "reaper", "powershell", "kaspersky", "data", "command", "dprk", "http", "html", "dlls", "malicious", "conti", "android", "copy", "next" ], "references": [ "https://blog.sekoia.io/peeking-at-reaper-surveillance-operations-against-north-korea-defectors/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "AblyGo", "display_name": "AblyGo", "target": null }, { "id": "Chinotto", "display_name": "Chinotto", "target": null }, { "id": "CKU", "display_name": "CKU", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1078", "name": "Valid Accounts", "display_name": "T1078 - Valid Accounts" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" } ], "industries": [ "Journalists" ], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 13, "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 205, "YARA": 7, "domain": 5 }, "indicator_count": 234, "is_author": false, "is_subscribing": null, "subscriber_count": 862, "modified_text": "1134 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "attiferstudio.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "attiferstudio.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780191444.0575457 }