{ "type": "Domain", "indicator": "cloud1dv.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/cloud1dv.com", "alexa": "http://www.alexa.com/siteinfo/cloud1dv.com", "indicator": "cloud1dv.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4050609945, "indicator": "cloud1dv.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 33, "pulses": [ { "id": "68639744272b5a4d16c46166", "name": "10 Things I Hate About Attribution: RomCom vs. TransferLoader", "description": "This report analyzes the activities of two threat actor clusters: TA829 and UNK_GreenSec. TA829 conducts both espionage and cybercrime operations using tools like SingleCamper and DustyHammock. UNK_GreenSec deploys TransferLoader malware leading to ransomware infections. The actors share similarities in infrastructure, delivery tactics, and lure themes, raising questions about their relationship. Four hypotheses are presented regarding their potential connection, ranging from shared third-party services to being the same actor. The report highlights the increasing overlap between cybercrime and espionage activities, making attribution more challenging in the current threat landscape.", "modified": "2025-07-01T08:09:37.616000", "created": "2025-07-01T08:07:32.903000", "tags": [ "transferloader", "singlecamper", "slipscreen", "ransomware", "hellcat", "dustyhammock", "morpheus", "meltingclaw", "romcom", "shadyhammock", "rustyclaw" ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader" ], "public": 1, "adversary": "TA829", "targeted_countries": [ "Ukraine", "United States of America" ], "malware_families": [ { "id": "SingleCamper", "display_name": "SingleCamper", "target": null }, { "id": "DustyHammock", "display_name": "DustyHammock", "target": null }, { "id": "TransferLoader", "display_name": "TransferLoader", "target": null }, { "id": "SlipScreen", "display_name": "SlipScreen", "target": null }, { "id": "RustyClaw", "display_name": "RustyClaw", "target": null }, { "id": "MeltingClaw", "display_name": "MeltingClaw", "target": null }, { "id": "ShadyHammock", "display_name": "ShadyHammock", "target": null }, { "id": "Morpheus", "display_name": "Morpheus", "target": null }, { "id": "HellCat", "display_name": "HellCat", "target": null } ], "attack_ids": [ { "id": "T1218.011", "name": "Rundll32", "display_name": "T1218.011 - Rundll32" }, { "id": "T1587.001", "name": "Malware", "display_name": "T1587.001 - Malware" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1588.001", "name": "Malware", "display_name": "T1588.001 - Malware" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "display_name": "T1547.001 - Registry Run Keys / Startup Folder" }, { "id": "T1588.002", "name": "Tool", "display_name": "T1588.002 - Tool" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1102.002", "name": "Bidirectional Communication", "display_name": "T1102.002 - Bidirectional Communication" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1102.001", "name": "Dead Drop Resolver", "display_name": "T1102.001 - Dead Drop Resolver" } ], "industries": [ "Defense" ], "TLP": "white", "cloned_from": null, "export_count": 44, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 10, "FileHash-SHA256": 14, "domain": 92, "hostname": 1 }, "indicator_count": 120, "is_author": false, "is_subscribing": null, "subscriber_count": 377433, "modified_text": "291 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b02c08f3d177fcddf371c3", "name": "Phishing | Mar 11, 2026 | Part 109/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 109/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T14:34:48.924000", "created": "2026-03-10T14:34:48.924000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1299, "domain": 701 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "39 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aed8fae50ec607fcbd7456", "name": "Phishing | Mar 10, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:28:10.409000", "created": "2026-03-09T14:28:10.409000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 715, "hostname": 1285 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "40 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad85917a38391d4e8a1600", "name": "Phishing | Mar 9, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:20:01.813000", "created": "2026-03-08T14:20:01.813000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1230, "domain": 770 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "41 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac34c13d5515a18320e67a", "name": "Phishing | Mar 8, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:22:55.544000", "created": "2026-03-07T14:22:55.544000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1230, "domain": 770 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "42 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aae1ff4fdd3f1d6b370572", "name": "Phishing | Mar 7, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:17:35.124000", "created": "2026-03-06T14:17:35.124000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1230, "domain": 770 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "43 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a996cbb987af1dd91fe410", "name": "Phishing | Mar 6, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 6, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T14:44:27.398000", "created": "2026-03-05T14:44:27.398000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1230, "domain": 770 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "44 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a8400ac4ced6fc81044a88", "name": "Phishing | Mar 5, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 5, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:22:02.776000", "created": "2026-03-04T14:22:02.776000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1230, "domain": 770 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "45 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6ed2f9fd270ba36569027", "name": "Phishing | Mar 4, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 4, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:16:15.882000", "created": "2026-03-03T14:16:15.882000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1230, "domain": 770 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "46 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5b325af50c0b8508d8114", "name": "Phishing | Mar 3, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 3, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T15:56:21.956000", "created": "2026-03-02T15:56:21.956000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1230, "domain": 770 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "47 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a51166929ba46649e8a996", "name": "Phishing | Mar 2, 2026 | Part 87/729", "description": "Phishing indicators. Date: Mar 2, 2026. Part 87/729. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T04:26:14.678000", "created": "2026-03-02T04:26:14.678000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1402, "domain": 598 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "47 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a43db668b997570e3029b6", "name": "Phishing | Mar 2, 2026 | Part 88/732", "description": "Phishing indicators. Date: Mar 2, 2026. Part 88/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T13:23:02.733000", "created": "2026-03-01T13:23:02.733000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1330, "domain": 670 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "48 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a4036e0a408a7ad262f92c", "name": "Phishing | Mar 1, 2026 | Part 88/732", "description": "Phishing indicators. Date: Mar 1, 2026. Part 88/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T09:14:22.964000", "created": "2026-03-01T09:14:22.964000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1330, "domain": 670 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "48 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a381b5d4f85a8df6d6eba9", "name": "Phishing | Mar 1, 2026 | Part 88/733", "description": "Phishing indicators. Date: Mar 1, 2026. Part 88/733. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T00:00:53.965000", "created": "2026-03-01T00:00:53.965000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1306, "domain": 694 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "48 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6997f8858ba3553118dd9cb3", "name": "Phishing | Feb 20, 2026 | Part 89/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 89/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-20T06:00:37.507000", "created": "2026-02-20T06:00:37.507000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 694, "hostname": 1306 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "57 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6997662100e2295e60ba2d67", "name": "Phishing | Feb 20, 2026 | Part 89/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 89/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T19:36:01.266000", "created": "2026-02-19T19:36:01.266000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 694, "hostname": 1306 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "58 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699726e378cd99f6d4f9129d", "name": "Phishing | Feb 20, 2026 | Part 89/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 89/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T15:06:11.959000", "created": "2026-02-19T15:06:11.959000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 694, "hostname": 1306 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "58 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699707af09eda173d5c5ce12", "name": "Phishing | Feb 19, 2026 | Part 89/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 89/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T12:53:03.893000", "created": "2026-02-19T12:53:03.893000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 694, "hostname": 1306 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "58 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6996318b3918740f7513af13", "name": "Phishing | Feb 19, 2026 | Part 89/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 89/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T21:39:23.076000", "created": "2026-02-18T21:39:23.076000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 694, "hostname": 1306 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "59 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69957292ea6b0925002aeba6", "name": "Phishing | Feb 18, 2026 | Part 89/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 89/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T08:04:34.112000", "created": "2026-02-18T08:04:34.112000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 694, "hostname": 1306 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "59 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6994c9a41957a42fa93d1de9", "name": "Phishing | Feb 18, 2026 | Part 89/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 89/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-17T20:03:48.500000", "created": "2026-02-17T20:03:48.500000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 694, "hostname": 1306 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "60 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699496f61633a22cc1ac4d05", "name": "Phishing | Feb 18, 2026 | Part 89/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 89/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-17T16:27:34.864000", "created": "2026-02-17T16:27:34.864000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 694, "hostname": 1306 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "60 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6992950e8a5c3490c48d256b", "name": "Phishing | Feb 16, 2026 | Part 90/741", "description": "Phishing indicators. Date: Feb 16, 2026. Part 90/741. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-16T03:54:54.896000", "created": "2026-02-16T03:54:54.896000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 778, "hostname": 1222 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "61 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699155b783e64d51ac343dca", "name": "Phishing | Feb 15, 2026 | Part 92/749", "description": "Phishing indicators. Date: Feb 15, 2026. Part 92/749. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-15T05:12:23.811000", "created": "2026-02-15T05:12:23.811000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1330, "domain": 670 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "62 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69908726fb3a9b0c4af24091", "name": "Phishing | Feb 15, 2026 | Part 93/754", "description": "Phishing indicators. Date: Feb 15, 2026. Part 93/754. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-14T14:31:02.812000", "created": "2026-02-14T14:31:02.812000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1318, "domain": 682 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "63 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698c59535179a84816d4e08e", "name": "Phishing | Feb 11, 2026 | Part 104/783", "description": "Phishing indicators. Date: Feb 11, 2026. Part 104/783. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-11T10:26:27.788000", "created": "2026-02-11T10:26:27.788000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1253, "domain": 747 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "66 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6981a87383c86b1cb83f5eb8", "name": "Phishing | 2026-01-31 | Part 36/163", "description": "Phishing indicators. Date: 2026-01-31. Part 36/163. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-03T07:49:07.180000", "created": "2026-02-03T07:49:07.180000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 7334, "domain": 2666 }, "indicator_count": 10000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "74 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "689dbd6fc683062764f4f07c", "name": "EbeeAugust2025 Pt2", "description": "", "modified": "2025-10-02T13:04:51.166000", "created": "2025-08-14T10:41:51.150000", "tags": [], "references": [ "Aug-Week2.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 476, "FileHash-SHA1": 551, "FileHash-SHA256": 521, "URL": 92, "domain": 216, "email": 2, "hostname": 68 }, "indicator_count": 1926, "is_author": false, "is_subscribing": null, "subscriber_count": 38, "modified_text": "198 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68660d05b657f67ed01a1472", "name": "10 Things I Hate About Attribution: RomCom vs. TransferLoader", "description": "", "modified": "2025-07-03T04:54:29.945000", "created": "2025-07-03T04:54:29.945000", "tags": [ "transferloader", "singlecamper", "slipscreen", "ransomware", "hellcat", "dustyhammock", "morpheus", "meltingclaw", "romcom", "shadyhammock", "rustyclaw" ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader" ], "public": 1, "adversary": "TA829", "targeted_countries": [ "Ukraine", "United States of America" ], "malware_families": [ { "id": "SingleCamper", "display_name": "SingleCamper", "target": null }, { "id": "DustyHammock", "display_name": "DustyHammock", "target": null }, { "id": "TransferLoader", "display_name": "TransferLoader", "target": null }, { "id": "SlipScreen", "display_name": "SlipScreen", "target": null }, { "id": "RustyClaw", "display_name": "RustyClaw", "target": null }, { "id": "MeltingClaw", "display_name": "MeltingClaw", "target": null }, { "id": "ShadyHammock", "display_name": "ShadyHammock", "target": null }, { "id": "Morpheus", "display_name": "Morpheus", "target": null }, { "id": "HellCat", "display_name": "HellCat", "target": null } ], "attack_ids": [ { "id": "T1218.011", "name": "Rundll32", "display_name": "T1218.011 - Rundll32" }, { "id": "T1587.001", "name": "Malware", "display_name": "T1587.001 - Malware" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1588.001", "name": "Malware", "display_name": "T1588.001 - Malware" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "display_name": "T1547.001 - Registry Run Keys / Startup Folder" }, { "id": "T1588.002", "name": "Tool", "display_name": "T1588.002 - Tool" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1102.002", "name": "Bidirectional Communication", "display_name": "T1102.002 - Bidirectional Communication" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1102.001", "name": "Dead Drop Resolver", "display_name": "T1102.001 - Dead Drop Resolver" } ], "industries": [ "Defense" ], "TLP": "white", "cloned_from": "68639744272b5a4d16c46166", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 10, "FileHash-SHA256": 14, "domain": 92, "hostname": 1 }, "indicator_count": 120, "is_author": false, "is_subscribing": null, "subscriber_count": 264, "modified_text": "289 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "686493f010c30085b34ccfe6", "name": "IOC&TTP - 10 Things I Hate About Attribution RomCom vs. TransferLoader", "description": "\u672c\u62a5\u544a\u5206\u6790\u4e86\u4e24\u4e2a\u5a01\u80c1\u6d3b\u52a8\u96c6\u7fa4\uff1aTA829\uff08RomCom) \u548c UNK_GreenSec\uff08TransferLoader\uff09\uff0c\u5b83\u4eec\u5177\u6709\u9ad8\u5ea6\u76f8\u4f3c\u7684\u6218\u672f\u3001\u6280\u672f\u548c\u7a0b\u5e8f\uff08TTPs\uff09\u3001\u57fa\u7840\u8bbe\u65bd\u548c\u90ae\u4ef6\u8bf1\u9975\u7b56\u7565\uff0c\u4f46\u5176\u5f52\u5c5e\u5c1a\u4e0d\u660e\u786e\u3002TA829\u662f\u4e00\u4e2a\u5177\u6709\u91d1\u878d\u52a8\u673a\u5e76\u6d89\u53ca\u95f4\u8c0d\u6d3b\u52a8\u7684\u884c\u4e3a\u8005\uff0c\u53ef\u80fd\u4e0e\u4fc4\u7f57\u65af\u6709\u5173\uff1b\u800cUNK_GreenSec\u662f\u4e00\u4e2a\u53ef\u80fd\u76f8\u4e92\u5173\u8054\u4f46\u66f4\u503e\u5411\u4e8e\u7eaf\u7cb9\u7f51\u7edc\u72af\u7f6a\u7684\u96c6\u7fa4\u3002\u4e24\u8005\u5747\u4f7f\u7528\u5fae\u578b\u8def\u7531\u5668\u4ee3\u7406\uff08REM Proxy\uff09\u548c\u518d\u5b9a\u5411\u94fe\uff0c\u5728\u9493\u9c7c\u90ae\u4ef6\u4e2d\u4f7f\u7528\u7b80\u5386/\u6295\u8bc9\u7b49\u4e3b\u9898\uff0c\u90e8\u7f72\u5404\u81ea\u72ec\u7acb\u7684\u6076\u610f\u7a0b\u5e8f\uff08RomCom\u5bb6\u65cf\u5de5\u5177\u94fe\u4e0eTransferLoader\uff09\u3002\u62a5\u544a\u4e5f\u63d0\u51fa\u4e86\u56db\u79cd\u53ef\u80fd\u7684\u5f52\u5c5e\u5047\u8bbe\uff0c\u4f53\u73b0\u4e86\u7f51\u7edc\u5a01\u80c1\u751f\u6001\u7cfb\u7edf\u4e2d\u7f51\u7edc\u72af\u7f6a\u4e0e\u95f4\u8c0d\u6d3b\u52a8\u7684\u878d\u5408\u8d8b\u52bf\u3002", "modified": "2025-07-02T02:05:46.780000", "created": "2025-07-02T02:05:36.582000", "tags": [ "transferloader", "singlecamper", "slipscreen", "ransomware", "hellcat", "dustyhammock", "morpheus", "meltingclaw", "romcom", "shadyhammock", "rustyclaw" ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader" ], "public": 1, "adversary": "TA829", "targeted_countries": [ "Ukraine", "United States of America" ], "malware_families": [ { "id": "SingleCamper", "display_name": "SingleCamper", "target": null }, { "id": "DustyHammock", "display_name": "DustyHammock", "target": null }, { "id": "TransferLoader", "display_name": "TransferLoader", "target": null }, { "id": "SlipScreen", "display_name": "SlipScreen", "target": null }, { "id": "RustyClaw", "display_name": "RustyClaw", "target": null }, { "id": "MeltingClaw", "display_name": "MeltingClaw", "target": null }, { "id": "ShadyHammock", "display_name": "ShadyHammock", "target": null }, { "id": "Morpheus", "display_name": "Morpheus", "target": null }, { "id": "HellCat", "display_name": "HellCat", "target": null } ], "attack_ids": [ { "id": "T1218.011", "name": "Rundll32", "display_name": "T1218.011 - Rundll32" }, { "id": "T1587.001", "name": "Malware", "display_name": "T1587.001 - Malware" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1588.001", "name": "Malware", "display_name": "T1588.001 - Malware" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "display_name": "T1547.001 - Registry Run Keys / Startup Folder" }, { "id": "T1588.002", "name": "Tool", "display_name": "T1588.002 - Tool" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1102.002", "name": "Bidirectional Communication", "display_name": "T1102.002 - Bidirectional Communication" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1102.001", "name": "Dead Drop Resolver", "display_name": "T1102.001 - Dead Drop Resolver" } ], "industries": [ "Defense" ], "TLP": "white", "cloned_from": "68639744272b5a4d16c46166", "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "celestre", "id": "295357", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 10, "FileHash-SHA256": 14, "domain": 92, "hostname": 1 }, "indicator_count": 120, "is_author": false, "is_subscribing": null, "subscriber_count": 119, "modified_text": "290 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "686457bec73826e391598c91", "name": "xxxxxxx", "description": "", "modified": "2025-07-01T21:48:46.460000", "created": "2025-07-01T21:48:46.460000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ESFBSOCTCR", "id": "200541", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 8, "FileHash-SHA1": 8, "FileHash-SHA256": 8, "domain": 59, "hostname": 1 }, "indicator_count": 84, "is_author": false, "is_subscribing": null, "subscriber_count": 85, "modified_text": "291 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6863ca1f92e3d9b7fc2c3b03", "name": "10 Things I Hate About Attribution: RomCom vs. TransferLoader | Proofpoint US", "description": "", "modified": "2025-07-01T11:44:31.683000", "created": "2025-07-01T11:44:31.683000", "tags": [ "ta829", "unkgreensec", "transferloader", "proofpoint", "dustyhammock", "singlecamper", "rem proxy", "ttps", "dlls", "february", "ukraine", "rust", "meltingclaw", "window", "april", "shadyhammock", "august", "metasploit", "june", "morpheus", "hellcat", "danabot", "sunseed" ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 10, "FileHash-SHA256": 14, "domain": 107, "hostname": 2 }, "indicator_count": 136, "is_author": false, "is_subscribing": null, "subscriber_count": 845, "modified_text": "291 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68193adfb05639ffa7a5fd0a", "name": "Organizations Targetted by Operation Deceptive Prospect via Feedback Portals", "description": "Operation Deceptive Prospect was a cyber espionage campaign that a Cyber\nSecurity Researchers discovered and linked to the RomCom threat cell.", "modified": "2025-05-05T22:25:35.280000", "created": "2025-05-05T22:25:35.280000", "tags": [ "hashes", "sha256" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cryptocti", "id": "110256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 3, "FileHash-SHA256": 3, "domain": 20 }, "indicator_count": 29, "is_author": false, "is_subscribing": null, "subscriber_count": 485, "modified_text": "348 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader", "https://ltna.com.au/cyber", "Aug-Week2.pdf" ], "related": { "alienvault": { "adversary": [ "TA829" ], "malware_families": [ "Singlecamper", "Slipscreen", "Dustyhammock", "Rustyclaw", "Transferloader", "Hellcat", "Meltingclaw", "Shadyhammock", "Morpheus" ], "industries": [ "Defense" ] }, "other": { "adversary": [ "TA829" ], "malware_families": [ "Singlecamper", "Slipscreen", "Dustyhammock", "Rustyclaw", "Transferloader", "Hellcat", "Meltingclaw", "Shadyhammock", "Morpheus" ], "industries": [ "Defense" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 33, "pulses": [ { "id": "68639744272b5a4d16c46166", "name": "10 Things I Hate About Attribution: RomCom vs. TransferLoader", "description": "This report analyzes the activities of two threat actor clusters: TA829 and UNK_GreenSec. TA829 conducts both espionage and cybercrime operations using tools like SingleCamper and DustyHammock. UNK_GreenSec deploys TransferLoader malware leading to ransomware infections. The actors share similarities in infrastructure, delivery tactics, and lure themes, raising questions about their relationship. Four hypotheses are presented regarding their potential connection, ranging from shared third-party services to being the same actor. The report highlights the increasing overlap between cybercrime and espionage activities, making attribution more challenging in the current threat landscape.", "modified": "2025-07-01T08:09:37.616000", "created": "2025-07-01T08:07:32.903000", "tags": [ "transferloader", "singlecamper", "slipscreen", "ransomware", "hellcat", "dustyhammock", "morpheus", "meltingclaw", "romcom", "shadyhammock", "rustyclaw" ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/10-things-i-hate-about-attribution-romcom-vs-transferloader" ], "public": 1, "adversary": "TA829", "targeted_countries": [ "Ukraine", "United States of America" ], "malware_families": [ { "id": "SingleCamper", "display_name": "SingleCamper", "target": null }, { "id": "DustyHammock", "display_name": "DustyHammock", "target": null }, { "id": "TransferLoader", "display_name": "TransferLoader", "target": null }, { "id": "SlipScreen", "display_name": "SlipScreen", "target": null }, { "id": "RustyClaw", "display_name": "RustyClaw", "target": null }, { "id": "MeltingClaw", "display_name": "MeltingClaw", "target": null }, { "id": "ShadyHammock", "display_name": "ShadyHammock", "target": null }, { "id": "Morpheus", "display_name": "Morpheus", "target": null }, { "id": "HellCat", "display_name": "HellCat", "target": null } ], "attack_ids": [ { "id": "T1218.011", "name": "Rundll32", "display_name": "T1218.011 - Rundll32" }, { "id": "T1587.001", "name": "Malware", "display_name": "T1587.001 - Malware" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1588.001", "name": "Malware", "display_name": "T1588.001 - Malware" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "display_name": "T1547.001 - Registry Run Keys / Startup Folder" }, { "id": "T1588.002", "name": "Tool", "display_name": "T1588.002 - Tool" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1102.002", "name": "Bidirectional Communication", "display_name": "T1102.002 - Bidirectional Communication" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1102.001", "name": "Dead Drop Resolver", "display_name": "T1102.001 - Dead Drop Resolver" } ], "industries": [ "Defense" ], "TLP": "white", "cloned_from": null, "export_count": 44, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 10, "FileHash-SHA256": 14, "domain": 92, "hostname": 1 }, "indicator_count": 120, "is_author": false, "is_subscribing": null, "subscriber_count": 377433, "modified_text": "291 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b02c08f3d177fcddf371c3", "name": "Phishing | Mar 11, 2026 | Part 109/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 109/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T14:34:48.924000", "created": "2026-03-10T14:34:48.924000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1299, "domain": 701 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "39 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aed8fae50ec607fcbd7456", "name": "Phishing | Mar 10, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:28:10.409000", "created": "2026-03-09T14:28:10.409000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 715, "hostname": 1285 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "40 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad85917a38391d4e8a1600", "name": "Phishing | Mar 9, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:20:01.813000", "created": "2026-03-08T14:20:01.813000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1230, "domain": 770 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "41 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac34c13d5515a18320e67a", "name": "Phishing | Mar 8, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:22:55.544000", "created": "2026-03-07T14:22:55.544000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1230, "domain": 770 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "42 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aae1ff4fdd3f1d6b370572", "name": "Phishing | Mar 7, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:17:35.124000", "created": "2026-03-06T14:17:35.124000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1230, "domain": 770 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "43 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a996cbb987af1dd91fe410", "name": "Phishing | Mar 6, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 6, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T14:44:27.398000", "created": "2026-03-05T14:44:27.398000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1230, "domain": 770 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "44 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a8400ac4ced6fc81044a88", "name": "Phishing | Mar 5, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 5, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:22:02.776000", "created": "2026-03-04T14:22:02.776000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1230, "domain": 770 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "45 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6ed2f9fd270ba36569027", "name": "Phishing | Mar 4, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 4, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:16:15.882000", "created": "2026-03-03T14:16:15.882000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1230, "domain": 770 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "46 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5b325af50c0b8508d8114", "name": "Phishing | Mar 3, 2026 | Part 86/726", "description": "Phishing indicators. Date: Mar 3, 2026. Part 86/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T15:56:21.956000", "created": "2026-03-02T15:56:21.956000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1230, "domain": 770 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 64, "modified_text": "47 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "cloud1dv.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "cloud1dv.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1776551252.0158944 }