{ "type": "Domain", "indicator": "hitcon.org", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/hitcon.org", "alexa": "http://www.alexa.com/siteinfo/hitcon.org", "indicator": "hitcon.org", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3040723543, "indicator": "hitcon.org", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "69f46a108000bd36fe90d5be", "name": "APT29", "description": "In the latest episode of the LNK forensic analysis series, we look at how a malicious file was linked to a Chinese-speaking threat actor, who then modified the file to target a powershell program.", "modified": "2026-05-31T06:03:25.904000", "created": "2026-05-01T08:53:34.200000", "tags": [ "sha1", "ipv4", "sha256", "n cobalt", "n https", "strong", "rararchive", "backdoor", "n c2", "cobalt strike", "guloader", "cobaltstrike", "cobalt", "downloader", "april", "icedid", "dropper", "june", "trickbot", "donut", "fast", "payload", "unknown", "delphi", "noname", "anydesk", "blister", "quasar", "winnti", "somnia", "qakbot", "gogo", "netwire", "chrysalis", "download", "exploit", "netspy", "loader", "ursnif", "themida", "vidar", "doublezero", "voldemort", "next", "meterpreter", "tencent", "plugx", "shadow", "batloader", "redline stealer", "havoc", "resident", "decoy", "dump", "shellcode", "infostealer", "appe", "bumblebee", "emotet", "syscall", "acidrain", "credomap", "cozyduke", "ukraine", "daveshell", "cont", "refer", "fail", "first", "snake", "mega", "onlin", "grayrabbit", "open", "power", "august", "test", "path", "mimikatz", "nbtscan", "impacket", "comment", "install", "redline", "comet", "autoit", "wiper", "endurance", "sharphound", "psexec", "malicious", "service", "wind", "installer", "info", "confi", "remcosrat", "hermeticwiper", "isaacwiper", "graphsteel", "caddywiper", "grimplant", "industroyer2", "defense", "energy", "telecom", "media", "grapeloader", "wineloader", "envyscout", "sunburst", "panda", "metasploit", "sparkrat", "zbot", "darkgate", "finspy", "rhadamanthys", "warmcookie", "trojanspy", "diceloader", "asyncrat", "esxiargs", "webshell", "cerber", "azorult", "lokibot", "blackcat", "poortry", "cuba", "malcat", "ctrlt", "transform", "bazaar", "virustotal", "window", "pdf document", "iit app", "tools", "lucky", "injector", "handleref", "temp", "conti", "groupexchange", "group400", "grouprevil", "revilconti", "providerpath", "regexpandsz", "minidump", "groupuchebkac", "malware", "bypass", "adfind", "threat", "command", "procdump", "seatbelt", "below", "anydesk remote", "lsass", "powershell", "cookie", "android", "null", "sliver", "initial access", "code", "defender", "defense evasion", "enterprise", "powerview", "pipes", "cloud", "date", "poison", "advantage", "mind", "designer", "shell", "projector libra", "bazarloader", "figure", "file size", "transferxl", "palo alto", "iso image", "windows", "wildfire", "february", "alliance", "bazarbackdoor", "bokbot", "diavol", "shown", "hook", "threat spotlight", "manjusaka", "c2 server", "appliance", "cisco talos", "golang", "haixi mongol", "prefecture", "talos", "rust", "agent", "win64", "hello", "xor algorithms", "z85 ascii85", "base85", "ascii85", "compile", "z85 https", "threat analysis", "primary threat", "elf", "strike payload", "uri http", "post body", "lockbit", "sentinellabs", "c curl", "ip address", "lockbit black", "cyber threats", "investigations", "research", "expert perspective", "articles", "news", "reports", "learn", "trend vision", "vision one", "gootkit", "trend micro", "amsi telemetry", "micro", "gootkit loader", "security", "stop", "find", "life", "operations", "protect", "small", "carriers", "voice", "attack", "suncrypt", "revil", "sodinokibi", "kronos", "korean", "createobject", "javascript", "ascii value", "opens", "urls", "color1", "python script", "gootloader", "twitter", "python", "unc1151", "microbackdoor", "beacon", "base64", "github", "run registry", "putty", "persistence", "discord", "blackenergy", "state", "uac0056", "detection", "threatdown", "cybercrime has", "machinescale", "response", "nebula", "indirizzo", "il file", "questo cert", "italia", "il messaggio", "allegato", "covid19", "file pdf", "html", "serbia", "stata", "file location", "https traffic", "thursday", "windows host", "wireshark", "emotet run", "pakistan", "ttps", "shadowpad", "plugx backdoor", "kaspersky ics", "afghanistan", "malaysia", "march", "cert", "ntlm", "winrar", "assembly", "china chopper", "microsoft", "fancybear", "cozybear", "december", "strontium", "ransomhub", "matrix", "raspberry robin", "sofacy", "beatdrop", "quietexit", "cyclops", "knight", "bank", "facebook", "beer", "worm", "threat advisory", "ransomware", "threats", "securex", "avos", "unified access", "gateways", "avoslocker", "cisco secure", "vmware horizon", "darkcomet", "apt29", "nobelium", "stellarparticle", "shadow chaser", "file type", "sha256 hash", "html file", "pe32", "intel", "matanbuchus", "confluence", "data center", "server", "waf rule", "confluence data", "shut", "jars", "cvss", "update", "centerall", "mustang panda", "vietnam", "analyze", "dll file", "summary", "vincss", "vietnamese", "english", "unc2165", "evil corp", "fakeupdates", "dridex", "hades", "colorfake", "bitpaymer", "doppelpaymer", "wastedlocker", "megasync", "trojan", "payloadbin", "macaw", "cuba ransomware", "tor directory", "bughatch", "iis worker", "mare", "team", "zenpak", "impact", "mosquito", "exfiltration", "execution", "masquerading", "netsupport rat", "select", "script", "hash", "press enter", "http", "activexobject", "lnk file", "socgholish", "servhelper", "fakeupdate", "model", "socgholish netsupport", "netsupport", "ta551", "ryuk", "threat actor", "hta file", "trickbot c2", "sonatype", "drops cobalt", "strike", "pymafka", "open source", "contact us", "macos", "nexus", "demo", "protected", "friday", "gold blackburn", "ahnlab", "was1", "was2", "dc server", "coinminer", "ntlm hash", "january", "ad group", "darkside", "miner", "win32.bitcoinminer", "win32.agent", "frp", "transferxl url", "iso file", "bumblebee c2", "file name", "exotic lily", "transferxl urls", "function", "dropbox", "c2 dropbox", "c2clientmain", "filename", "av evasion", "syswhispers2", "dropbox loader", "stream", "mark", "back", "pcap", "ta578", "contact forms", "images evidence", "windows service", "main entry", "a service", "service main", "entry point", "windows context", "administrator", "concept", "https", "lazagne", "setmppreference", "use ie", "msie", "windows nt", "bloodhound", "wmiexec", "covenant", "empire", "poshc2", "organization", "cleanup", "winscp", "dword", "netscan", "http c2", "base64url", "c2 traffic", "netbios", "teamserver", "mask", "legezo", "windows event", "denis legezo", "september", "silent break", "windows system", "rc4 encryption", "sysdig", "plugx implant", "myanmar", "russia", "hong kong", "reddelta", "belarus", "digital certificates", "fileless malware", "malware descriptions", "malware technologies", "rat trojan", "targeted attacks", "silentbreak", "throwback", "linode", "slingshot", "inject", "patch", "magic", "mozilla", "false", "\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "\u30de\u30af\u30cb\u30ab\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9", "word", "stager", "url https", "windows10", "dll sideloading", "ida pro", "darkhotel", "oceanlotus", "mandiant", "boommic", "group policy", "smb beacon", "trello", "kerberos", "pass", "vaporrage", "platform sha256", "urls http", "unc2452", "opsec", "scale", "apt29 activity", "apt29 conduct", "global func", "vmware xfer", "edrepp", "vmware command", "dfir team", "abcd", "stealbit", "stdout", "hooks", "logic", "dfir report", "icedid malware", "icedid payload", "pty ltd", "goodware", "string", "desktop", "morphisec", "vmware identity", "morphisec labs", "core impact", "vmware", "workspace one", "access", "cve202222957", "cve202222958", "fortune", "jssloader", "stark", "moving", "please", "virtualbox", "registry", "windows logon", "hive", "varonis", "ai security", "proxyshell", "detect", "data risk", "google cloud", "trust", "varonis threat", "contact", "qbot", "void", "police", "pysa", "chisel", "files", "where", "pysa ransomware", "redacted", "force", "getchilditem", "aes key", "szdrf", "mespinoza", "target", "winapi", "edr hooks", "winapi call", "endpoint", "tracing", "api call", "direct system", "phase", "import", "outflank", "dll payload", "bumblebee dll", "programdata", "orion", "strings", "example", "zloader", "eset research", "atera agent", "eset", "aitb", "eset security", "tips", "silent", "night", "botnet", "teamviewer", "atera", "capture", "grantedaccess", "computer", "lsass memory", "targetimage", "sourceimage", "simulate", "atomic", "karakurt", "view", "hacking team", "sign", "contributors", "from karakurt", "appearance", "manage", "write", "star", "stars", "ruby", "footer", "birdwatch", "fin7", "easylook", "unc3381", "powerplant", "crowview", "boatlaunch", "stoneboat", "fowlgaze", "uuid variant", "hell", "ipfuscation", "james haughom", "ipfuscated", "gate variant", "gate", "rubeus", "wow64", "cp1250", "uuids", "touch", "blob", "hwinithlw", "sphw", "shathak", "conti affiliate", "valentine", "favorite", "rats", "ragnarlocker", "hellokitty", "squirrelwaffle", "uris", "http get", "post", "http post", "c2 profile", "accept", "vnc activity", "ms windows", "go downloader", "unc2589", "ta471", "sentinelone", "module stomp", "return address", "cobalt strikes", "rtlallocateheap", "use section", "dlls", "first detection", "apt41", "dustpan", "cve202144207", "cve202144228", "log4shell", "vmprotect", "deadeye", "keyplug", "filler", "confuserex", "badpotato", "task manager", "lsass process", "cisa", "bazar", "hancitor", "splashtop", "kportscan", "story", "emotet payload", "excel", "appdatalocal", "november", "emotet campaign", "vba macro", "cybercrime", "cybersecurity architect", "threat research", "jarm signature", "sha2", "jarm", "salesforce", "epoch", "emotet core", "epochs", "conti group", "emotet epoch", "trickbot group", "prior", "threat response", "unit", "socs", "hunters", "cyber", "mssql", "mssql server", "lemon duck", "asec analysis", "account", "kingminer", "vollgar", "mssql process", "cve20201472", "reg add", "regdword", "makes", "et exploit", "core", "possible", "comspec", "tracker", "userdomain", "appdata", "hide", "vbscript", "exclusionpath", "userpcname", "ipcount", "gozi", "cybereason", "exchange", "datoploader", "cybereason xdr", "report", "phishing", "pinkslipbot", "theft", "beyond", "never", "malwarebazaar", "strike activity", "filejust", "file contentsi", "vscode", "sublime editor", "windows exe", "utf8", "turla", "root", "msoffice", "nativezone", "kazuar", "bluenoroff", "customerloader", "muddywater", "chat", "overwatch", "aquatic panda", "log4j", "linux", "apache tomcat", "crowdstrike", "github project", "click", "fishmaster", "yanluowang", "thieflock", "scanner", "canthroid", "grabff", "symantec", "connectwise", "screenconnect", "fivehands", "browserpassview", "rundll32", "sharefinder", "wmic", "ping", "rollcoast", "south africa", "unc2190", "july", "tycoon", "unc2190 beacon", "latin", "arcane", "sabbath", "slovak", "slovakia", "albanian", "albania", "swedish", "turkish", "indonesia", "estonia", "armenia", "c2 data", "cyberchef", "javascript code", "rsa key", "remove", "get request", "xor key", "exploits & vulnerabilities", "managed xdr", "one marketplace", "lockfile", "attack overview", "stage", "conti gang", "datop", "handover", "kazakhstan", "os version", "winrm", "protocol", "enterpssession", "psrp", "windows remote", "source process", "stack", "rita", "threat feed", "myrtus", "harvester", "c activity", "artefactsfolder", "identity", "infectionid", "october", "main", "ad environment", "bazar c2", "networks", "d3desdecrypt", "nim malware", "jason", "part", "reaves6 min", "nimrodnimza", "rustybuer", "nimgrabber", "caesar", "file encryption", "nimrev", "discovery", "data", "mitre att", "powersploit", "leverage", "beaconloader", "doorme backdoor", "issuer cus", "apt group", "chamelgang", "doorme", "mcafee", "timestomp", "copy", "oilrig", "error", "body", "eternalblue", "zip file", "enable", "content", "vbs script", "word document", "maldoc", "form", "win api", "bazarloader dll", "intro conti", "coveware", "raas", "ransom", "ryuk ransomware", "cve202140444", "multiple", "north america", "europe", "asia", "html object", "mshtml engine", "sidewalk", "crosswalk", "c server", "sparklinggoblin", "google docs", "winnti group", "format", "darkshell", "motnug", "threat-intelligence", "apt", "nsa", "def con", "iso filesystem", "iocs", "recon village", "leviathan", "encrypt", "prophet spider", "oracle weblogic", "exception", "weblogic access", "class", "linux system", "egregor", "mountlocker", "radar", "front", "gotroj", "encoder", "stealer", "soar", "speed", "prophet", "classloader", "reconnaissance", "tech", "recon", "et cnc", "feodo tracker", "cnc server", "trigger", "alive", "spawn", "method", "http method", "jitter", "port", "beacon type", "later", "close", "browser", "chinese-speaking cybercrime", "google chrome", "microsoft word", "spear phishing", "luminousmoth", "honeymyte", "assistant", "username", "motc", "ministry", "local", "xll file", "docusign", "hancitor dll", "hancitor exe", "ficker stealer", "api hashing", "api hash", "monpass", "avast", "monpass client", "monpass web", "mongolia", "jan rubn", "discovered", "initial contact", "final", "watermark", "chanitor", "pony", "vawtrak", "uwaga", "falcon complete", "falcon", "wizard spider", "lime", "easy", "flex", "yahxz", "efno", "unc2465", "ngrok", "ultravnc", "methodology", "ngrok tunnel", "smokedham", "guard", "dllstageless", "submission", "size", "noblebaron", "itw name", "scout", "elite", "containedwithin", "withheld", "relatedto", "strike beacon", "matches no", "privacy", "description", "entropy", "restrict", "host ip", "owner", "igos", "germany", "file", "type", "artemis", "rozena", "razy", "khalesi", "\u30c7\u30b8\u30bf\u30eb\u7f72\u540d", "cobalt strike loader", "\u6a19\u7684\u578b\u653b\u6483", "strike loader", "iocindicator", "microsoft docs", "2 cobalt", "3 sigcheck", "1 microsoftdll", "powershell rat", "macro", "progression", "hackerman", "robinhood", "scan behavioral", "unusual port", "potential scan", "campo loader", "dfdownloader", "japan", "post method", "openfield", "blacktds", "public", "behaviour", "variant", "malicious file", "transfer", "control", "feature", "fireeye", "plink", "campo", "bazarcall", "xyzcampobb hxxp", "ioc510", "urlcampo", "20214", "headlines", "tlds", "duck", "beapy", "prometei", "umbrella", "wdigest", "iceid", "networkminer", "caploader", "network forensics", "ja3", "x.509", "sslbl", "1768.py", "didier stevens", "8da75e1f974d1011c91ed3110a4ded38", "e9b5e549363fa9fcb362b606b75d131dec6c020e", "0314b8cd45b636f38d07032dc8ed463295710460ea7a4e214c1de7b0e817aab6", "banusdona.top", "172.67.188.12", "f98711dfeeab9c8b4975b2f9a88d8fea", "c2bdc885083696b877ab6f0e05a9d968fd7cc2bb", "213e9c8bf7f6d0113193f785cb407f0e8900ba75b9131475796445c11f3ff37c", "momenturede.fun", "104.236.115.181", "96a535122aba4240e2c6370d0c9a09d3", "485ba347cf898e34a7455e0fd36b0bcf8b03ffd8", "11965662e146d97d3fa3288e119aefb2", "b63d7ad26df026f6cca07eae14bb10a0ddb77f41", "d45b3f9d93171c29a51f9c8011cd61aa44fcb474d59a0b68181bb690dbbf2ef5", "vaccnavalcod.website", "mazzappa.fun", "ameripermanentno.website", "odichaly.space", "83.97.20.176", "452e969c51882628dac65e38aff0f8e5ebee6e6b", "lesti.net", "185.141.26.140", "449c1967d1708d7056053bedb9e45781", "1ab39f1c8fb3f2af47b877cafda4ee09374d7bd3", "c7da494880130cdb52bd75dae1556a78f2298a8cc9a2e75ece8a57ca290880d3", "45.147.229.157", "1580103814", "luckymouse", "emissary panda", "apt 27", "apt27", "a0e9f5d64349fb13191bc781f81f42e1", "3b5074b1b5d032e5620f69f9f700ff0e", "erik hjelmvik", "monday", "openssl", "michael", "bazaloader", "anchor", "alex", "header", "getoperandvalue", "win32", "build", "trickbot crews", "cs loader", "trickbots cs", "trickbots crew", "google drive", "hancitor c2", "icmp", "dcdomainname", "dclocal", "base", "cnbuiltin", "cnusers", "security groups", "bitcoin", "sage", "svchost", "bits", "beacon dll", "started service", "beacon payload", "process hacker", "sleepex", "identifies", "crph", "smadavprotect32", "cec list", "meeting", "dll library", "ta800", "nim programming", "nimzaloader", "doesn", "json object", "c url", "trustinfo", "displayname", "dpiaware", "anchordns", "enjoy", "nimrod", "gecko", "khtml", "offensivenim", "sharpkatz", "crypter", "done", "sprite spider", "carbon spider", "esxi", "spider", "defray777", "pyxie", "hypervisor", "defray", "ransomexx", "sekur", "anunak", "harpy", "griffon", "unc2198", "maze", "maze ransomware", "file transfer", "mouseisland", "koadic", "photoloader", "ocean lotus", "mac os", "kerrdown", "human", "kerrdown sample", "macho", "tcp port", "systembc", "http traffic", "hatching triage", "directory", "endpoint1", "ryuk threat", "raindrop", "teardrop", "decrypt", "raindrop loader", "name file", "pl shellcode", "funnyswitch", "chm file", "config", "frombase64", "azaz09", "nltest", "regwrite", "exitendifif", "sleep", "regsz", "stwashington", "lredmond", "dircreate", "protection", "defenderspynet", "john", "doublepulsar", "amadey", "zeppelin", "apt & targeted attacks", "earth wendigo", "service worker", "xss attack", "domain", "learn more", "ck technique", "techniques", "emerging threat", "solarwinds", "breach", "dora", "pioneer", "solarstorm", "cortex xdr", "iot security", "atom", "supernova", "yara", "snort", "gap analysis", "keefarce", "safetykatz", "gadgettojscript", "sharpzerologon", "tuesday", "qakbot binary", "qakbot malspam", "qakbot malware", "windows binary", "malspam", "egregor payload", "threat alert", "sekhmet", "platform", "monitoring", "chacha", "notpetya", "bad rabbit", "internet", "tls server", "tls client", "server hello", "ja3s", "hello packet", "apache", "random", "vatet", "localappdata", "epochtime", "rapid7", "cash", "logmein", "swift", "radmin", "bazar loader", "highest", "certificate", "issuer org", "over", "ryuk domain", "infrastructure", "namecheap", "ryuk host", "monovm", "olol", "gnu c", "o2 o2", "marchx8664 g", "g o2", "sttx", "ltexas", "ooffice", "name", "basecamp", "userinit", "hack", "snow", "apt19", "yara rule", "chimera", "pe header", "vhash", "lpwstr lpbuffer", "startw", "request", "netwalker", "neshta", "mailto", "thor", "xmrig", "teamt5", "threatsonar anti-ransomware", "threatsonar", "threatvision", "cyber espionage", "ransom virus", "tt", "cyber threat hunters", "cyber espionage solutions", "threat analysis service", "incident response", "investigation services", "threat intelligence", "md5 hash", "softether", "domain teamt5", "teamt5 teamt5", "plead", "pastebin", "travelex", "pos software", "gandcrab", "rat", "indigodrop", "msf shellcode", "msf downloader", "urlshxxp", "stages", "threatlabz", "india-china", "zscaler cloud", "dkmc framework", "gif header", "dkmc", "sandbox report", "publickey", "sandbox", "ntds", "beacon version", "console", "file creation", "file deletion", "rename", "or filefullname", "coronavirus", "tvrat", "gozi malware", "js file", "wscript", "msbuild", "msbuild project", "silent trinity", "threat grid", "lolbins", "cisco threat", "msbuild process", "naga", "trinity", "dos header", "sfx code", "sfx file", "export function", "mz header", "open process", "set current", "create", "apt2019", "2019 payload", "lnklnklnklnk", "1 docvbavbavba", "dllentry rat", "operation pawn", "storm", "midst intrusion", "pawn storm", "xtunnel", "hidedrv", "aurora", "blackshades", "conficker", "chapro", "dark comet", "dexter", "duqu", "gauss", "bridge", "hikit", "makadocs", "medre", "morto", "narilam", "onionduke", "rustock", "dorkbot", "spyeye", "stabuniq", "stuxnet", "tinba", "vobfus", "zeroaccess", "zeus", "zusy", "committee", "dnc network", "trump", "dnc hack", "donald trump", "neither", "general", "hill", "magazine", "mexico", "winids", "foozer", "downrage", "hydra", "remcom", "inc\\.", "bear", "wirelurker", "generic.933739", "python code", "zxkbdklakv", "seaduke", "cookie value", "bookmark server", "p4bnzr0", "duke" ], "references": [ "https://malcat.fr/blog/lnk-forensic-and-config-extraction-of-a-cobalt-strike-beacon/", "https://mp.weixin.qq.com/s/cGS8FocPnUdBconLbbaG-g", "https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/", "https://unit42.paloaltonetworks.com/bumblebee-malware-projector-libra/", "https://blog.talosintelligence.com/manjusaka-offensive-framework/", "https://cocomelonc.github.io/malware/2022/07/30/malware-av-evasion-8.html", "https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/", "https://www.trendmicro.com/en_us/research/22/g/gootkit-loaders-updated-tactics-and-fileless-delivery-of-cobalt-strike.html", "https://blog.nviso.eu/2022/07/20/analysis-of-a-trojanized-jquery-script-gootloader-unleashed/", "https://cloud.google.com/blog/topics/threat-intelligence/spear-phish-ukrainian-entities/", "https://www.threatdown.com/blog/cobalt-strikes-again-uac-0056-continues-to-target-ukraine-in-its-latest-campaign/", "https://cert.gov.ua/article/703548", "https://cert-agid.gov.it/news/il-malware-envyscout-apt29-e-stato-veicolato-anche-in-italia/", "https://isc.sans.edu/diary/Emotet%20infection%20with%20Cobalt%20Strike/28824", "https://cert.gov.ua/article/619229", "https://ics-cert.kaspersky.com/publications/reports/2022/06/27/attacks-on-industrial-control-systems-using-shadowpad/", "https://blog.bushidotoken.net/2022/06/overview-of-russian-gru-and-svr.html", "https://blog.talosintelligence.com/avoslocker-new-arsenal/", "https://isc.sans.edu/diary/rss/28752", "https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html", "https://kienmanowar.wordpress.com/2022/06/04/quicknote-cobaltstrike-smb-beacon-analysis-2/", "https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions", "https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis", "https://medium.com/walmartglobaltech/socgholish-campaigns-and-initial-access-kit-4c4283fea8ee", "https://thehackernews.com/2022/05/malware-analysis-trickbot.html", "https://www.sonatype.com/blog/new-pymafka-malicious-package-drops-cobalt-strike-on-macos-windows-linux", "https://asec.ahnlab.com/en/34549/", "https://isc.sans.edu/diary/Bumblebee+Malware+from+TransferXL+URLs/28664", "https://raw.githubusercontent.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/refs/heads/main/APT29_C2-Client_Dropbox_Loader/APT29-DropboxLoader_analysis.md", "https://redcanary.com/wp-content/uploads/2022/05/Gootloader.pdf", "https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf", "https://isc.sans.edu/diary/28636", "https://cocomelonc.github.io/tutorial/2022/05/09/malware-pers-4.html", "https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/", "https://unit42.paloaltonetworks.com/cobalt-strike-metadata-encoding-decoding/", "https://thehackernews.com/2022/05/this-new-fileless-malware-hides.html", "https://blog.talosintelligence.com/mustang-panda-targets-europe/", "https://securelist.com/a-new-secret-stash-for-fileless-malware/106393/", "https://security.macnica.co.jp/blog/2022/05/iso.html", "https://cloud.google.com/blog/topics/threat-intelligence/tracking-apt29-phishing-campaigns/", "https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt", "https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf", "https://cloud.google.com/blog/topics/threat-intelligence/unc2452-merged-into-apt29/", "https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/", "https://thedfirreport.com/2022/04/25/quantum-ransomware/", "https://www.morphisec.com/blog/vmware-identity-manager-attack-backdoor/", "https://cocomelonc.github.io/tutorial/2022/04/20/malware-pers-1.html", "https://www.varonis.com/blog/hive-ransomware-analysis", "https://www.sentinelone.com/blog/from-the-front-lines-peering-into-a-pysa-ransomware-attack/", "https://vanmieghem.io/blueprint-for-evading-edr-in-2022/", "https://www.cynet.com/blog/orion-threat-alert-flight-of-the-bumblebee/", "https://www.welivesecurity.com/2022/04/13/eset-takes-part-global-operation-disrupt-zloader-botnets/", "https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html", "https://github.com/infinitumitlabs/Karakurt-Hacking-Team-CTI", "https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/", "https://www.sentinelone.com/blog/hive-ransomware-deploys-novel-ipfuscation-technique/", "https://medium.com/walmartglobaltech/cobaltstrike-uuid-stager-ca7e82f7bb64", "https://resource.redcanary.com/rs/003-YRU-314/images/2022_ThreatDetectionReport_RedCanary.pdf", "https://www.esentire.com/blog/conti-affiliate-exposed-new-domain-names-ip-addresses-and-email-addresses-uncovered-by-esentire", "https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/", "https://isc.sans.edu/diary/Qakbot+infection+with+Cobalt+Strike+and+VNC+activity/28448", "https://www.sentinelone.com/blog/threat-actor-uac-0056-targeting-ukraine-with-fake-translation-software/", "https://www.arashparsa.com/catching-a-malware-with-no-name/", "https://cert.gov.ua/article/37704", "https://cloud.google.com/blog/topics/threat-intelligence/apt41-us-state-governments/", "https://thedfirreport.com/2022/03/07/2021-year-in-review/", "https://www.cynet.com/security-foundations/attack-techniques/new-wave-of-emotet-when-project-x-turns-into-y/", "https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage", "https://cyber.wtf/2022/03/23/what-the-packer/", "https://www.esentire.com/blog/icedid-to-cobalt-strike-in-under-20-minutes", "https://asec.ahnlab.com/en/31811/", "https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/", "https://medium.com/walmartglobaltech/signed-dll-campaigns-as-a-service-7760ac676489", "https://www.cybereason.com/blog/research/threat-analysis-report-datoploader-exploits-proxyshell-to-deliver-qbot-and-cobalt-strike", "https://forensicitguy.github.io/inspecting-powershell-cobalt-strike-beacon/", "https://blog.sekoia.io/nobeliums-envyscout-infection-chain-goes-in-the-registry-targeting-embassies/", "https://www.crowdstrike.com/en-us/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/", "https://www.security.com/threat-intelligence/yanluowang-ransomware-attacks-continue", "https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/", "https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/", "https://blog.nviso.eu/2021/11/17/cobalt-strike-decrypting-obfuscated-traffic-part-4/", "https://www.trendmicro.com/en_gb/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html", "https://www.truesec.com/hub/blog/proxyshell-qbot-and-conti-ransomware-combined-in-a-series-of-cyber-attacks", "https://www.threatdown.com/blog/a-multi-stage-powershell-based-attack-targets-kazakhstan/", "https://www.unh4ck.com/detection-engineering-and-threat-hunting/lateral-movement/detecting-conti-cobaltstrike-lateral-movement-techniques-part-1", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf", "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/", "https://www.security.com/threat-intelligence/harvester-new-apt-attacks-asia", "https://unit42.paloaltonetworks.com/bazarloader-network-reconnaissance/", "https://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-part-2-a28bffffa671", "https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/", "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/new-apt-group-chamelgang/#id3", "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/new-apt-group-chamelgang/", "https://www.cynet.com/security-foundations/attack-techniques/understanding-squirrelwaffle/", "https://thedfirreport.com/2021/09/13/bazarloader-to-conti-ransomware-in-32-hours/", "https://blog.gigamon.com/2021/09/10/rendering-threats-a-network-perspective/", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf", "https://documents.trendmicro.com/assets/white_papers/wp-earth-baku-an-apt-group-targeting-indo-pacific-countries.pdf", "https://www.welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/", "https://istrosec.com/blog/apt-sk-cobalt/", "https://www.crowdstrike.com/en-us/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/", "https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/", "https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/", "https://securelist.com/apt-luminousmoth/103332/", "https://isc.sans.edu/diary/rss/27618", "https://www.gendigital.com/blog/insights/research/decoding-cobalt-strike-understanding-payloads", "https://www.gendigital.com/blog/insights/research/backdoored-client-from-mongolian-ca-monpass", "https://thedfirreport.com/2021/06/28/hancitor-continues-to-push-cobalt-strike/", "https://www.crowdstrike.com/en-us/blog/how-falcon-complete-disrupts-ecrime-operators-wizard-spider/", "https://thedfirreport.com/2021/06/20/from-word-to-lateral-movement-in-1-hour/", "https://cloud.google.com/blog/topics/threat-intelligence/darkside-affiliate-supply-chain-software-compromise", "https://www.sentinelone.com/labs/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/", "https://www.cisa.gov/news-events/analysis-reports/ar21-148a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-148a", "https://www.lac.co.jp/lacwatch/report/20210521_002618.html", "https://www.ncsc.gov.ie/pdfs/HSE_Conti_140521_UPDATE.pdf", "https://www.guidepointsecurity.com/blog/from-zloader-to-darkside-a-ransomware-story/", "https://thedfirreport.com/2021/05/12/conti-ransomware/", "https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/", "https://cloud.google.com/blog/topics/threat-intelligence/shining-a-light-on-darkside-ransomware-operations/", "https://mal-eats.net/2021/05/10/campo_new_attack_campaign_targeting_japan/", "https://blog.talosintelligence.com/lemon-duck-spreads-wings/", "https://thedfirreport.com/2021/05/02/trickbot-brief-creds-and-beacons/", "https://www.netresec.com/?page=Blog&month=2021-04&post=Analysing-a-malware-PCAP-with-IcedID-and-Cobalt-Strike-traff", "https://isc.sans.edu/diary/27308", "https://medium.com/walmartglobaltech/trickbot-crews-new-cobaltstrike-loader-32c72b78e81c", "https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/", "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/", "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures", "https://www.qurium.org/alerts/targeted-malware-against-crph/", "https://www.proofpoint.com/us/blog/threat-insight/nimzaloader-ta800s-new-initial-access-malware", "https://thedfirreport.com/2021/03/08/bazar-drops-the-anchor/", "https://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-14cc543af811", "https://www.crowdstrike.com/en-us/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout", "https://cloud.google.com/blog/topics/threat-intelligence/melting-unc2198-icedid-to-ransomware-operations/", "https://raw.githubusercontent.com/AmnestyTech/investigations/refs/heads/master/2021-02-24_vietnam/README.md", "https://isc.sans.edu/diary/Excel+spreadsheets+push+SystemBC+malware/27060", "https://thedfirreport.com/2021/01/31/bazar-no-ryuk/", "https://www.security.com/threat-intelligence/solarwinds-raindrop-malware", "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/", "https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/", "https://medium.com/walmartglobaltech/man1-moskal-hancitor-and-a-side-of-ransomware-d77b4d991618", "https://www.trendmicro.com/en_us/research/21/a/earth-wendigo-injects-javascript-backdoor-to-service-worker-for-.html", "https://www.picussecurity.com/resource/blog/ttps-used-in-the-solarwinds-breach", "https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/", "https://unit42.paloaltonetworks.com/fireeye-red-team-tool-breach/", "https://isc.sans.edu/diary/rss/26862", "https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.pdf", "https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf", "https://www.cybereason.com/blog/cybereason-vs-egregor-ransomware", "https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a/", "https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/5/", "https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/", "https://raw.githubusercontent.com/ThreatConnect-Inc/research-team/refs/heads/master/IOCs/WizardSpider-UNC1878-Ryuk.csv", "https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/", "https://cloud.google.com/blog/topics/threat-intelligence/kegtap-and-singlemalt-with-a-ransomware-chaser/", "https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/refs/heads/master/China/APT/Chimera/Analysis.md", "https://thedfirreport.com/2020/10/08/ryuks-return/", "https://thedfirreport.com/2020/08/31/netwalker-ransomware-in-1-hour/", "https://teamt5.org/tw/posts/mjib-holds-briefing-on-chinese-hackers-attacks-on-taiwanese-government-agencies/", "https://i.blackhat.com/USA-20/Thursday/us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf", "https://www.security.com/threat-intelligence/sodinokibi-ransomware-cobalt-strike-pos", "https://blog.talosintelligence.com/indigodrop-maldocs-cobalt-strike/", "https://www.zscaler.com/blogs/security-research/targeted-attack-leverages-india-china-border-dispute-lure-victims", "https://www.sentinelone.com/labs/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/", "https://thedfirreport.com/2020/04/24/ursnif-via-lolbins/", "https://blog.talosintelligence.com/building-bypass-with-msbuild/", "https://tccontre.blogspot.com/2019/11/cobaltstrike-beacondll-your-not.html", "https://web-assets.esetstatic.com/wls/2019/10/ESET_Operation_Ghost_Dukes.pdf", "https://mp.weixin.qq.com/s/xPsEXp2J5IE7wNSMEVC24A", "https://contagiodump.blogspot.com/2017/02/russian-apt-apt28-collection-of-samples.html", "https://www.cisa.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf", "https://www.crowdstrike.com/en-us/blog/bears-midst-intrusion-democratic-national-committee/", "https://blog-assets.f-secure.com/wp-content/uploads/2020/03/18122307/F-Secure_Dukes_Whitepaper.pdf", "https://contagiodump.blogspot.com/2014/11/onionduke-samples.html", "https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/" ], "public": 1, "adversary": "Threat", "targeted_countries": [ "Czechia", "Ukraine", "Russian Federation", "Poland", "Belarus", "Lithuania", "Latvia", "Germany", "Pakistan", "Afghanistan", "Malaysia", "Greece", "Italy", "T\u00fcrkiye", "Portugal", "Brazil", "China", "Japan", "Korea, Republic of", "United States of America", "Mexico", "New Zealand", "Canada", "Georgia", "Iran, Islamic Republic of" ], "malware_families": [ { "id": "HandleRef", "display_name": "HandleRef", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Threat", "display_name": "Threat", "target": null }, { "id": "Primary Threat", "display_name": "Primary Threat", "target": null }, { "id": "BazarLoader", "display_name": "BazarLoader", "target": null }, { "id": "Bumblebee", "display_name": "Bumblebee", "target": null }, { "id": "ELF", "display_name": "ELF", "target": null }, { "id": "GootLoader", "display_name": "GootLoader", "target": null }, { "id": "Kronos", "display_name": "Kronos", "target": null }, { "id": "BEACON", "display_name": "BEACON", "target": null }, { "id": "MICROBACKDOOR", "display_name": "MICROBACKDOOR", "target": null }, { "id": "GRIMPLANT", "display_name": "GRIMPLANT", "target": null }, { "id": "GRAPHSTEEL", "display_name": "GRAPHSTEEL", "target": null }, { "id": "Shadowpad", "display_name": "Shadowpad", "target": null }, { "id": "PlugX", "display_name": "PlugX", "target": null }, { "id": "ShadowPad", "display_name": "ShadowPad", "target": null }, { "id": "Threat Analysis", "display_name": "Threat Analysis", "target": null }, { "id": "CredoMap", "display_name": "CredoMap", "target": null }, { "id": "StellarParticle", "display_name": "StellarParticle", "target": null }, { "id": "CozyBear", "display_name": "CozyBear", "target": null }, { "id": "Shadow Chaser", "display_name": "Shadow Chaser", "target": null }, { "id": "Raspberry Robin", "display_name": "Raspberry Robin", "target": null }, { "id": "RansomHub", "display_name": "RansomHub", "target": null }, { "id": "Cyclops", "display_name": "Cyclops", "target": null }, { "id": "FancyBear", "display_name": "FancyBear", "target": null }, { "id": "APT29", "display_name": "APT29", "target": null }, { "id": "AvosLocker", "display_name": "AvosLocker", "target": null }, { "id": "Matanbuchus", "display_name": "Matanbuchus", "target": null }, { "id": "HADES", "display_name": "HADES", "target": null }, { "id": "SocGholish NetSupport", "display_name": "SocGholish NetSupport", "target": null }, { "id": "SocGholish", "display_name": "SocGholish", "target": null }, { "id": "NetSupport", "display_name": "NetSupport", "target": null }, { "id": "Gold Blackburn", "display_name": "Gold Blackburn", "target": null }, { "id": "Conti", "display_name": "Conti", "target": null }, { "id": "Ryuk", "display_name": "Ryuk", "target": null }, { "id": "Trickbot", "display_name": "Trickbot", "target": null }, { "id": "Darkside", "display_name": "Darkside", "target": null }, { "id": "Win32.BitCoinMiner", "display_name": "Win32.BitCoinMiner", "target": null }, { "id": "Win32.Agent", "display_name": "Win32.Agent", "target": null }, { "id": "NbtScan", "display_name": "NbtScan", "target": null }, { "id": "Frp", "display_name": "Frp", "target": null }, { "id": "Pcap", "display_name": "Pcap", "target": null }, { "id": "BeaconLoader", "display_name": "BeaconLoader", "target": null }, { "id": "DoorMe", "display_name": "DoorMe", "target": null }, { "id": "Win API", "display_name": "Win API", "target": null }, { "id": "Generic.933739", "display_name": "Generic.933739", "target": null } ], "attack_ids": [], "industries": [ "Gas", "Government", "Defense", "Media", "Telecommunications", "Logistics", "Industrial", "Manufacturing", "Transport", "Transportation", "Diplomatic", "Foreign Affairs", "Academics", "Banking", "Aviation", "Political", "Energy", "Military", "Financial", "Legal", "Pharmaceutical", "Technology", "Aerospace" ], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "kikinumpav", "id": "385742", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3082, "FileHash-SHA1": 2478, "FileHash-SHA256": 4182, "URL": 3155, "CVE": 190, "SSLCertFingerprint": 41, "domain": 2991, "email": 58, "hostname": 2130, "YARA": 95 }, "indicator_count": 18402, "is_author": false, "is_subscribing": null, "subscriber_count": 14, "modified_text": "8 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698e93e1ab02db8c49e8c3ed", "name": "\u201cBroken Seal\u201d DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)", "description": "Forensic analysis indicates a DocuSign-themed phishing campaign using a deliberately invalid X.509 PKI seal (\u201cBroken Seal\u201d) to trigger fail-open verification logic in automated handlers. The delivery mechanism bypasses Secure Email Gateway (SEG) reputation checks by using encrypted channels and human-gated infrastructure. The payload is a fileless Process Hollowing (RunPE) malware that injects into RWX memory of legitimate processes to evade disk-based EDR.", "modified": "2026-05-17T15:52:35.396000", "created": "2026-02-13T03:00:49.872000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr", "My Independent research finds an intersect between different pdf DV versions being able to connect to Raspberry Pi devices as it was the FCC application document. Risk: Mac ID connectivity to all." ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28000, "FileHash-SHA256": 48374, "FileHash-MD5": 42596, "FileHash-SHA1": 23243, "hostname": 35654, "URL": 75758, "SSLCertFingerprint": 30, "CVE": 7585, "email": 316, "FileHash-IMPHASH": 8, "CIDR": 26205, "JA3": 1, "URI": 5, "IPv4": 574, "Mutex": 1 }, "indicator_count": 288350, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "13 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f4eba31a8adb1aa8e6654d", "name": "2016: Malware Analysis Report", "description": "", "modified": "2026-05-01T18:06:27.269000", "created": "2026-05-01T18:06:27.269000", "tags": [], "references": [ "2016-01-12 - The Magnificent FIN7- Revealing a Cybercriminal Threat Group.pdf", "2016-01-01 - Die erste Ransomware in JavaScript- Ransom32.pdf", "2016-01-12 - Trochilus RAT Evades Antivirus Detection, Used for Cyber-Espionage in South-East Asia.pdf", "2016-01-13 - Russian group behind 2013 Foreign Ministry hack.pdf", "2016-01-09 - Confirmation of a Coordinated Attack on the Ukrainian Power Grid.pdf", "2016-01-18 - Updated Blackmoon banking Trojan stays focused on South Korean banking customers.pdf", "2016-01-22 - PlugX APT Malware.pdf", "2016-01-21 - Android Spywaller- Firewall-Style Antivirus Blocking.pdf", "2016-01-22 - New Attacks Linked to C0d0so0 Group.pdf", "2016-01-22 - The Impact of Dragonfly Malware on Industrial Control Systems.pdf", "2016-01-24 - Scarlet Mimic- Years-Long Espionage Campaign Targets Minority Activists.pdf", "2016-01-25 - Hidden Tear Ransomware Developer Blackmailed by Malware Developers using his Code.pdf", "2016-01-23 - Imminent Monitor 4 RAT Analysis \u2013 A Glance.pdf", "2016-01-28 - BlackEnergy APT Attacks in Ukraine employ spearphishing with Word documents.pdf", "2016-01-28 - CenterPOS- An Evolving POS Threat.pdf", "2016-01-29 - From Linux to Windows \u2013 New Family of Cross-Platform Desktop Backdoors Discovered.pdf", "2016-01-29 - Malicious Office Files Dropping Kasidet And Dridex.pdf", "2016-02-03 - Emissary Trojan Changelog- Did Operation Lotus Blossom Cause It to Evolve-.pdf", "2016-01-22 - Sykipot APT Malware.pdf", "2016-02-05 - Vawtrak and UrlZone Banking Trojans Target Japan.pdf", "2016-02-08 - APT-style bank robberies increase with Metel, GCMAN and Carbanak 2.0 attacks.pdf", "2016-01-29 - VB2015 paper- It's A File Infector... It\u2019s Ransomware... It's Virlock.pdf", "2016-02-02 - Vipasana ransomware new ransom on the block.pdf", "2016-02-09 - DMA Locker Strikes Back.pdf", "2016-02-09 - Chinese Cyberspies Pivot To Russia In Wake Of Obama-Xi Pact.pdf", "2016-02-02 - DMA Locker- New Ransomware, But No Reason To Panic.pdf", "2016-02-12 - A Look Into Fysbis- Sofacy\u2019s Linux Backdoor.pdf", "2016-02-17 - Russian Police Prevented Massive Banking Sector Cyber Attack.pdf", "2016-02-09 - Bedep Lurking in Angler's Shadows.pdf", "2016-02-12 - Security Alert- Mazar BOT \u2013 the Android Malware That Can Erase Your Phone.pdf", "2016-02-09 - Poseidon Group- a Targeted Attack Boutique specializing in global cyber-espionage.pdf", "2016-02-17 - OceanLotus for OS X \u2013 an Application Bundle Pretending to be an Adobe Flash Update.pdf", "2016-02-21 - Source code for powerful Android banking malware is leaked.pdf", "2016-02-22 - Russian bank employees received fake job offers in targeted email attack.pdf", "2016-02-24 - Operation Blockbuster Coalition Ties Destructive Attacks to Lazarus Group.pdf", "2016-02-19 - Citadel 0.0.1.1 (Atmos).pdf", "2016-02-26 - Nymaim Moves Past Its Ransomware Roots - What Is Old Is New Again.pdf", "2016-02-24 - The DGA of Qakbot.T.pdf", "2016-03-01 - Look Into Locky Ransomware.pdf", "2016-03-01 - Taiwan Presidential Election- A Case Study on Thematic Targeting.pdf", "2016-02-29 - New Malware \u2018Rover\u2019 Targets Indian Ambassador to Afghanistan.pdf", "2016-02-29 - The \u201cHawkEye\u201d attack- how cybercrooks target small businesses for big money.pdf", "2016-02-25 - KeyBase Threat Grows Despite Public Takedown- A Picture is Worth a Thousand Words.pdf", "2016-03-07 - RedHat Hacker.asp.pdf", "2016-03-01 - Shrouded Crossbow Creators Behind BIFROSE for UNIX.pdf", "2016-02-18 - New Android Trojan \u201cXbot\u201d Phishes Credit Cards and Bank Accounts, Encrypts Devices for Ransom.pdf", "2016-03-03 - Attack on Zygote- a new twist in the evolution of mobile threats.pdf", "2016-03-11 - Cerber ransomware- new, but mature.pdf", "2016-03-04 - Tracing the Lineage of DarkSeoul.pdf", "2016-03-10 - Death Comes Calling- Thanatos-Alphabot Trojan Hits the Market.pdf", "2016-03-15 - Suckfly- Revealing the secret life of your code signing certificates.pdf", "2016-03-06 - Network detector for Winnti malware.pdf", "2016-03-11 - Gaudox - HTTP Bot (1.1.0.1) - C++-ASM - Ring3 Rootkit - Watchdog - Antis.pdf", "2016-03-11 - PowerSniff Malware Used in Macro-based Attacks.pdf", "2016-03-18 - Xor DDoS.pdf", "2016-03-09 - Korean Energy and Transportation Targets Attacked by OnionDog APT.pdf", "2016-03-14 - Massive Malvertising Campaign in US Leads to Angler Exploit Kit-BEDEP.pdf", "2016-03-14 - Digital Quartermaster Scenario Demonstrated in Attacks Against the Mongolian Government.pdf", "2016-03-18 - Teslacrypt Spam Campaign- \u201cUnpaid Issue\u2026\u201d.pdf", "2016-02-14 - PadCrypt The first ransomware with Live Support Chat and an Uninstaller.pdf", "2016-03-23 - SamSam- The Doctor Will See You, After He Pays The Ransom.pdf", "2016-03-20 - Hidden Tear Project- Forbidden Fruit Is the Sweetest.pdf", "2016-03-23 - Gozi ISFB Sourceccode.pdf", "2016-03-21 - OS X Malware Samples Analyzed.pdf", "2016-03-31 - Stored XSS Vulnerabilites on Foscam.pdf", "2016-03-25 - ProjectM- Link Found Between Pakistani Actor and Operation Transparent Tribe.pdf", "2016-03-24 - Maktub Locker \u2013 Beautiful And Dangerous.pdf", "2016-04-06 - Locky Ransomware Is Becoming More Sophisticated - Cybercriminals Continue Email Campaign Innovation.pdf", "2016-04-07 - FBI Quietly Admits to Multi-Year APT Attack, Sensitive Data Stolen.pdf", "2016-03-30 - Ransomware Deployed by Adversary with Established Foothold.pdf", "2016-03-29 - Taiwan targeted with new cyberespionage back doorTrojan.pdf", "2016-04-14 - Targeted Ransomware Activity.pdf", "2016-04-14 - Meet GozNym- The Banking Malware Offspring of Gozi ISFB and Nymaim.pdf", "2016-04-06 - Bootkit's development overview and trend (X).pdf", "2016-03-23 - New self?protecting USB trojan able to avoid detection.pdf", "2016-04-14 - Bedep has raised its game vs Bot Zombies.pdf", "2016-04-05 - SCADA Security Report 2016.pdf", "2016-04-01 - Petya \u2013 Taking Ransomware To The Low Level.pdf", "2016-04-11 - Manamecrypt \u2013 a ransomware that takes a different route.pdf", "2016-04-08 - CryptoHost Decrypted Locks files in a password protected RAR File.pdf", "2016-04-19 - MULTIGRAIN \u2013 Point of Sale Attackers Make an Unhealthy Addition to the Pantry.pdf", "2016-03-31 - The evolution of Brazilian Malware.pdf", "2016-04-16 - Ever Present Persistence - Established Footholds Seen in the Wild.pdf", "2016-04-21 - PoS Attacks Net Crooks 20 Million Stolen Bank Cards.pdf", "2016-04-26 - Digging deep for PLATINUM.pdf", "2016-04-21 - When entropy meets Shannon.pdf", "2016-04-22 - New Poison Ivy RAT Variant Targets Hong Kong Pro-Democracy Activists.pdf", "2016-03-11 - Gaudox - HTTP Bot (1.1.0.1) - CPlusPlus ASM - Ring3 Rootkit - Watchdog - Antis.pdf", "2016-04-19 - Trojan.GodzillaLoader (alias Godzilla Loader).pdf", "2016-04-22 - Tater- A PowerShell implementation of the Hot Potato Windows Privilege Escalation exploit..pdf", "2016-04-28 - Tick cyberespionage group zeros in on Japan.pdf", "2016-04-19 - Your Package Has Been Successfully Encrypted- TeslaCrypt 4.1A and the Malware Attack Chain.pdf", "2016-05-02 - Prince of Persia- Infy Malware Active In Decade of Targeted Attacks.pdf", "2016-04-27 - Freezer Paper around Free Meat.pdf", "2016-05-03 - The Continuing Evolution of Samas Ransomware.pdf", "2016-04-28 - Research Spotlight- The Resurgence of Qbot.pdf", "2016-05-05 - Sophisticated New Packer Identified in CryptXXX Ransomware Sample.pdf", "2016-05-11 - Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks.pdf", "2016-04-25 - Attackers Behind GozNym Trojan Set Sights on Europe.pdf", "2016-05-03 - A Universal Windows Bootkit.pdf", "2016-05-09 - KRBanker Targets South Korea Through Adware and Exploit Kits.pdf", "2016-05-12 - LatentBot \u2013 modularny i silnie zaciemniony bot.pdf", "2016-05-09 - PSEUDO-DARKLEECH ANGLER EK FROM 185.118.66.154 SENDS BEDEP-CRYPTXXX.pdf", "2016-05-04 - Petya- the two-in-one trojan.pdf", "2016-05-02 - Prince of Persia Hashes.pdf", "2016-05-13 - Cyber Heist Attribution.pdf", "2016-05-06 - 7ev3n ransomware turning \u2018HONE$T\u2019.pdf", "2016-05-10 - Setting Sights On Retail- AbaddonPOS Now Targeting Specific POS Software.pdf", "2016-05-12 - Chinese-language Ransomware \u2018SHUJIN\u2019 Makes An Appearance.pdf", "2016-05-16 - Vietnamese Bank Blocks $1 Million SWIFT Heist.pdf", "2016-05-12 - Hancitor and Ruckguv Reappear, Updated and With Vawtrak On Deck.pdf", "2016-05-15 - What We Can Learn From the Bangladesh Central Bank Cyber Heist.pdf", "2016-05-18 - Operation Groundbait- Espionage in Ukrainian war zones.pdf", "2016-05-09 - PseudoDarkLeech Angler EK from 185.118.66.154 sends Bedep-CryptXXX.pdf", "2016-05-17 - Indian organizations targeted in Suckfly attacks.pdf", "2016-05-23 - Technical Report about the Malware used in the Cyberespionage against RUAG.pdf", "2016-05-17 - ATM infector.pdf", "2016-06 - Form Grabber 2016 [Crome,FF,Opera,Thunderbird, Outlook IE Safari] Hack the world.pdf", "2016-05-27 - Evidence of Stronger Ties Between North Korea and SWIFT Banking Attacks.pdf", "2016-05-24 - New Wekby Attacks Use DNS Requests As Command and Control Mechanism.pdf", "2016-06-02 - FastPOS- Quick and Easy Credit Card Theft.pdf", "2016-04-27 - Freezer Paper around Free Meat (Repackaging Open Source BeEF for Tracking and More).pdf", "2016-05-19 - Petya and Mischa \u2013 Ransomware Duet (Part 1).pdf", "2016-05-19 - Petya and Mischa for All! The RaaS Boom Expands to Include the Petya-Mischa Combo.pdf", "2016-05-26 - The OilRig Campaign- Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor.pdf", "2016-05-26 - SWIFT attackers\u2019 malware linked to more financial attacks.pdf", "2016-05-20 - Special Report- Cyber thieves exploit banks' faith in SWIFT transfer network.pdf", "2016-06-03 - Cooking Up Autumn (Herbst) Ransomware.pdf", "2016-06-15 - Unsupported TeamViewer Versions Exploited For Backdoors, Keylogging.pdf", "2016-06-08 - Spear Phishing Attacks- Why They are Successful and How to Stop Them.pdf", "2016-06-14 - New Sofacy Attacks Against US Government Agency.pdf", "2016-05-22 - Cron has fallen.pdf", "2016-06-23 - Tracking Elirks Variants in Japan- Similarities to Previous Attacks.pdf", "2016-06-09 - Reverse-engineering DUBNIUM.pdf", "2016-06-07 - The Story of yet another ransom-fail-ware.pdf", "2016-06-22 - After Angler- Shift in Exploit Kit Landscape and New Crypto-Ransomware Activity.pdf", "2016-06-25 - SectorC08- Multi-Layered SFX in Recent Campaigns Target Ukraine.pdf", "2016-06-11 - The Chinese Hackers in the Back Office.pdf", "2016-06-15 - Bears in the Midst- Intrusion into the Democratic National Committee.pdf", "2016-06-17 - ScarCruft APT Group Used Latest Flash Zero Day in Two Dozen Attacks.pdf", "2016-05-22 - Operation Ke3chang Resurfaces With New TidePool Malware.pdf", "2016-06-29 - Apocalypse- Ransomware which targets companies through insecure RDP.pdf", "2016-06-06 - Everyone sees not what they want to see.pdf", "2016-06-28 - Prince of Persia \u2013 Game Over.pdf", "2016-06-17 - Operation Daybreak.pdf", "2016-06-23 - POS and Credit Cards- In the Line of Fire with \u201cPunkeyPOS\u201d.pdf", "2016-06-17 - In The Wild- Mobile Malware Implements New Features.pdf", "2016-06-10 - Petya and Mischa- ransomware duet (part 2).pdf", "2016-06-14 - CVE-2016-4171 \u2013 Adobe Flash Zero-day used in targeted attacks.pdf", "2016-06-24 - Ani-Shell.pdf", "2016-06-25 - Rokku Ransomware shows possible link with Chimera.pdf", "2016-07-01 - KeyBase - A New Keylogger on the Block.pdf", "2016-06-15 - Mofang- A politically motivated information stealing adversary.pdf", "2016-07-01 - How I Cracked a Keylogger and Ended Up in Someone's Inbox.pdf", "2016-06-21 - The Curious Case of an Unknown Trojan Targeting German-Speaking Users.pdf", "2016-07-14 - Technical Notes on Sakula.pdf", "2016-07-08 - Investigating the LuminosityLink Remote Access Trojan Configuration.pdf", "2016-07-13 - Troldesh ransomware influenced by (the) Da Vinci code.pdf", "2016-05-23 - DMA Locker 4.0- Known ransomware preparing for a massive distribution.pdf", "2016-07-11 - When Paying Out Doesn't Pay Off.pdf", "2016-07-20 - CrypMIC Ransomware Wants to Follow CryptXXX\u2019s Footsteps.pdf", "2016-07-22 - Stampado Ransomware campaign decrypted before it Started.pdf", "2016-07-21 - Canadian Man Behind Popular \u2018Orcus RAT\u2019.pdf", "2016-07-21 - Phishing Attacks Employ Old but Effective Password Stealer.pdf", "2016-07-07 - New threat dubbed Zepto Ransomware is spreading out with a new email spam campaign. It is a variant of the recent Locky Ransomware..pdf", "2016-07-25 - Patchwork cyberespionage group expands targets from governments to wide range of industries.pdf", "2016-07-26 - OTX Pulse on R980 ransomware.pdf", "2016-07-12 - Me and Mr. Robot- Tracking the Actor Behind the MAN1 Crypter.pdf", "2016-07-26 - Threat Actors Using Legitimate PayPal Accounts To Distribute Chthonic Banking Trojan.pdf", "2016-07-26 - Attack Delivers \u20189002\u2019 Trojan Through Google Drive.pdf", "2016-07-31 - China 1937CN Team Hackers Attack Airports in Vietnam.pdf", "2016-07-07 - NetTraveler APT Targets Russian, European Interests.pdf", "2016-07-18 - Third time (un)lucky \u2013 improved Petya is out.pdf", "2016-07-28 - Petya and Mischa For All Part II- They\u2019re Here\u2026.pdf", "2016-08-01 - CrowdStrike\u2019s New Methodology for Tracking eCrime.pdf", "2016-08 - Analysis of a packed Pony downloader.pdf", "2016-08-02 - Orcus \u2013 Birth of an unusual plugin builder RAT.pdf", "2016-07-08 - The Dropping Elephant \u2013 aggressive cyber-espionage in the Asian region.pdf", "2016-08-08 - Possibly Italy-Born Android RAT Reported in China, Find Bitdefender Researchers.pdf", "2016-08-08 - Doctor Web detected Linux Trojan written in Go.pdf", "2016-08-04 - What is Multigrain- Learn what makes this PoS malware different.pdf", "2016-08-08 - MONSOON - Analysis Of An APT Campaign.pdf", "2016-08-04 - Iranian Actor -Group5- Targeting Syrian Opposition.pdf", "2016-08-08 - Strider- Cyberespionage group turns eye of Sauron on targets.pdf", "2016-08-10 - CryptXXX - CrypMIC \u2013 intensywnie dystrybuowany ransomware w ramach exploit-kit\u00f3w.pdf", "2016-08-05 - Smoke Loader \u2013 downloader with a smokescreen still alive.pdf", "2016-08-08 - ProjectSauron- top level cyber-espionage platform covertly extracts encrypted government comms.pdf", "2016-08-18 - The Shadow Brokers.pdf", "2016-08-16 - Aveo Malware Family Targets Japanese Speaking Users.pdf", "2016-08-16 - Brazil Can\u2019t Catch a Break- After Panda Comes the Sphinx.pdf", "2016-08-22 - BLATSTING FUNKSPIEL.pdf", "2016-07-06 - New OSX-Keydnap malware is hungry for credentials.pdf", "2016-08-23 - GozNym Banking Trojan Targeting German Banks.pdf", "2016-08-22 - Trojan.Mutabaha.1.pdf", "2016-08-25 - Shakti Trojan - Technical Analysis.pdf", "2016-08-19 - New Hancitor Malware- Pimp my Downloaded.pdf", "2016-08-28 - FEINTCLOUD.pdf", "2016-08-23 - Russian hackers 'Fancy Bear' likely breached Olympic drug-testing agency and DNC, experts say.pdf", "2016-08-15 - Shakti Trojan- Document Thief.pdf", "2016-08-17 - Operation Ghoul- targeted attacks on industrial and engineering organizations.pdf", "2016-08-29 - Fantom ransomware impersonates Windows update.pdf", "2016-08-25 - Unpacking the spyware disguised as antivirus.pdf", "2016-08-29 - German Speakers Targeted by SPAM Leading to Ozone RAT.pdf", "2016-07-03 - Android Triada modular trojan.pdf", "2016-08-04 - Iran Threats Webpage.pdf", "2016-08-10 - Android Marcher- Continuously Evolving Mobile Malware.pdf", "2016-08-30 - OSX-Keydnap spreads via signed Transmission application.pdf", "2016-09-01 - TADAQUEOUS moments.pdf", "2016-08-30 - Pythons and Unicorns and Hancitor\u2026Oh My! Decoding Binaries Through Emulation.pdf", "2016-07-12 - Malware Discovered \u2013 SFG- Furtim Malware Analysis.pdf", "2016-09-02 - Necurs \u2013 hybrid spam botnet.pdf", "2016-08-29 - Nightmare on Tor Street- Ursnif variant Dreambot adds Tor functionality.pdf", "2016-07-30 - Luminosity RAT - Re-purposed.pdf", "2016-08-07 - Strider- Cyberespionage group turns eye of Sauron on targets.pdf", "2016-09-04 - BLATSTING Command-and-Control protocol.pdf", "2016-09-11 - BUZZDIRECTION- BLATSTING reloaded.pdf", "2016-08-11 - Smrss32 (.encrypted) Ransomware Help & Support - _HOW_TO_Decrypt.bmp.pdf", "2016-07-05 - New Backdoor Allows Full Access to Mac Systems, Bitdefender Warns.pdf", "2016-09-08 - Doctor Web discovers Linux Trojan written in Rust.pdf", "2016-09-06 - Buckeye cyberespionage group shifts gaze from US to Hong Kong.pdf", "2016-08-22 - VB Dropper and Shellcode for Hancitor Reveal New Techniques Behind Uptick.pdf", "2016-09-08 - The Philadelphia Ransomware offers a Mercy Button for Compassionate Criminals.pdf", "2016-07-08 - GootKit- Bobbing and Weaving to Avoid Prying Eyes.pdf", "2016-09-20 - Hackers lurking, parliamentarians told _ News _ DW _ 20.09.2016.pdf", "2016-09-13 - H1N1- Technical analysis reveals new capabilities.pdf", "2016-09-17 - A few notes on SECONDDATE's C&C protocol.pdf", "2016-09-13 - The curious case of BLATSTING's RSA implementation.pdf", "2016-09-11 - Free Darktrack RAT Has the Potential of Being the Best RAT on the Market Search.pdf", "2016-09-06 - Blatsting C&C Transcript.pdf", "2016-09-16 - Tofsee \u2013 modular spambot.pdf", "2016-09-07 - The Missing Piece \u2013 Sophisticated OS X Backdoor Discovered.pdf", "2016-09-20 - Inside Petya and Mischa ransomware.pdf", "2016-09-22 - Book of Eli- African targeted attacks.pdf", "2016-09-23 - Dissecting a Hacktivist\u2019s DDoS Tool- Saphyra Revealed.pdf", "2016-09-23 - SECONDDATE in action.pdf", "2016-09-27 - New Voldemort-Nagini Ransomware Virus Infection.pdf", "2016-09-09 - GOVRAT V2.0 - Attacking US military and government.pdf", "2016-09-15 - MILE TEA- Cyber Espionage Campaign Targets Asia Pacific Businesses and Government Agencies.pdf", "2016-09-19 - Untangling the Ripper ATM Malware.pdf", "2016-09-22 - Zeus Delivered by DELoader to Defraud Customers of Canadian Banks.pdf", "2016-09-20 - Hackers lurking, parliamentarians told.pdf", "2016-09-26 - Sofacy\u2019s \u2018Komplex\u2019 OS X Trojan.pdf", "2016-09-21 - Reversing GO binaries like a pro.pdf", "2016-09-16 - iSpy Keylogger.pdf", "2016-09-13 - DualToy- New Windows Trojan Sideloads Risky Apps to Android and iOS Devices.pdf", "2016-09-14 - BkSoD by Ransomware- HDDCryptor Uses Commercial Tools to Encrypt Network Shares and Lock HDDs.pdf", "2016-09-21 - KrebsOnSecurity Hit With Record DDoS.pdf", "2016-09-20 - Meanwhile in Britain, Qadars v3 Hardens Evasion, Targets 18 UK Banks.pdf", "2016-09-05 - Pok\u00e9mon-themed Umbreon Linux Rootkit Hits x86, ARM Systems.pdf", "2016-09-23 - Hancitor (AKA Chanitor) observed using multiple attack approaches.pdf", "2016-09-27 - Komplex Mac backdoor answers old questions.pdf", "2016-09-28 - Highly Evasive Code Injection Awaits User Interaction Before Delivering Malware.pdf", "2016-09-28 - Belling the BEAR.pdf", "2016-09-28 - Introducing Her Royal Highness the Princess Locker Ransomware.pdf", "2016-09-27 - Threat Spotlight- GozNym.pdf", "2016-09-29 - TeamXRat- Brazilian cybercrime meets ransomware.pdf", "2016-09-30 - Hacked Steam accounts spreading Remote Access Trojan.pdf", "2016-10-03 - Remsec driver analysis.pdf", "2016-10-01 - \u2018Shadow Brokers\u2019 Whine That Nobody Is Buying Their Hacked NSA Files.pdf", "2016-10-17 - RotorCrypt (RotoCrypt) Ransomware Support Topic - .tar, .c400, .c300, .GRANIT.pdf", "2016-10-01 - Source Code for IoT Botnet \u2018Mirai\u2019 Released.pdf", "2016-09-28 - Confucius Says\u2026Malware Families Get Further By Abusing Legitimate Websites.pdf", "2016-10-10 - Remsec driver analysis - Part 2.pdf", "2016-10-10 - How France's TV5 was almost destroyed by 'Russian hackers'.pdf", "2016-10-05 - FastPOS Updates in Time for the Retail Sale Season.pdf", "2016-09-29 - Want Tofsee My Pictures- A Botnet Gets Aggressive.pdf", "2016-10-11 - Remsec driver analysis - Part 3.pdf", "2016-10-17 - New-looking Sundown EK drops Smoke Loader, Kronos banker.pdf", "2016-10-09 - SiteIntel- Cyber Caliphate Army.pdf", "2016-10-17 - \u2018DealersChoice\u2019 is Sofacy\u2019s Flash Player Exploit Platform.pdf", "2016-10-27 - Inside the Gootkit C&C server.pdf", "2016-10-04 - OilRig Malware Campaign Updates Toolset and Expands Targets.pdf", "2016-10-03 - Polyglot \u2013 the fake CTB-locker.pdf", "2016-10-20 - TheMoon - A P2P botnet targeting Home Routers.pdf", "2016-10-18 - Digitally Signed Malware Targeting Gaming Companies.pdf", "2016-10-17 - A Tale of Two Targets.pdf", "2016-10-24 - Introducing TrickBot, Dyreza\u2019s successor.pdf", "2016-11-02 - Exposing the EGO MARKET- the cybercrime performed by the Linux-Moose botnet.pdf", "2016-10-24 - Evasive Malware Detects and Defeats Virtual Machine Analysis.pdf", "2016-10-27 - In-Dev Ransomware forces you do to Survey before unlocking Computer.pdf", "2016-11-09 - Tricks of the Trade- A Deeper Look Into TrickBot\u2019s Machinations.pdf", "2016-10-28 - zxshell repository.pdf", "2016-10-31 - Second Shadow Brokers dump released.pdf", "2016-11-09 - Down the H-W0rm Hole with Houdini\u2019s RAT.pdf", "2016-10-26 - Moonlight \u2013 Targeted attacks in the Middle East.pdf", "2016-10-15 - TrickBot- We Missed you, Dyre.pdf", "2016-11-14 - Doctor Web discovers a botnet that attacks Russian banks.pdf", "2016-11-10 - Floki Bot and the stealthy dropper.pdf", "2016-11-08 - Analysis of iOSGuiInject Adware Library.pdf", "2016-11-02 - Linux-Moose- Still breathing.pdf", "2016-10-25 - TrickBot Banker Insights.pdf", "2016-11-01 - Ursnif Malware- Deep Technical Dive.pdf", "2016-10-11 - Odinaff- New Trojan used in high level financial attacks.pdf", "2016-11-14 - Ransoc Desktop Locking Ransomware Ransacks Local Files and Social Media Profiles.pdf", "2016-10-27 - Mirai DDoS Botnet- Source Code & Binary Analysis.pdf", "2016-11-15 - CryptoLuck Ransomware being Malvertised via RIG-E Exploit Kits.pdf", "2016-11-02 - Nymaim Malware- Deep Technical Dive \u2013 Adventures in Evasive Malware.pdf", "2016-11-15 - ScanPOS, new POS malware being distributed by Kronos.pdf", "2016-11-07 - Little Trickbot Growing Up- New Campaign.pdf", "2016-11-08 - Analysis of IOS.GUIINJECT Adware Library.pdf", "2016-11-08 - SPAMTORTE VERSION 2- DISCOVERY OF AN ADVANCED, MULTILAYERED SPAMBOT CAMPAIGN THAT IS BACK WITH A VENGEANCE.pdf", "2016-10-21 - BITTER- a targeted attack against Pakistan.pdf", "2016-11-15 - Kronos Banking Trojan Used to Deliver New Point-of-Sale Malware.pdf", "2016-10-27 - BLACKGEAR Espionage Campaign Evolves, Adds Japan To Target List.pdf", "2016-10-25 - Houdini\u2019s Magic Reappearance.pdf", "2016-11-23 - InPage zero-day exploit used to attack financial institutions in Asia.pdf", "2016-11-30 - Bladabindi Remains A Constant Threat By Using Dynamic DNS Services.pdf", "2016-11-17 - It\u2019s Parliamentary - KeyBoy and the targeting of the Tibetan Community.pdf", "2016-11-22 - Cobalt hackers executed massive, synchronized ATM heists across Europe, Russia.pdf", "2016-10-03 - On the StrongPity Waterhole Attacks Targeting Italian and Belgian Encryption Users.pdf", "2016-11-21 - PrincessLocker \u2013 ransomware with not so royal encryption.pdf", "2016-11-21 - Android malware analysis with Radare- Dissecting the Triada Trojan.pdf", "2016-11-17 - Princess Locker decryptor.pdf", "2016-11-28 - NetWire RAT Steals Payment Card Data.pdf", "2016-12-08 - Thyssenkrupp victim of cyber attack.pdf", "2016-12-06 - Deep Analysis of the Online Banking Botnet TrickBot.pdf", "2016-12-07 - The TrickBot Evolution.pdf", "2016-12-07 - August in November- New Information Stealer Hits the Scene.pdf", "2016-12-06 - August in November- New Information Stealer Hits the Scene.pdf", "2016-11-28 - A New All-in-One Botnet- Proteus.pdf", "2016-12-09 - Now Mirai Has DGA Feature Built in.pdf", "2016-12-01 - CNACOM - Open Source Exploitation via Strategic Web Compromise.pdf", "2016-12-07 - Floki Bot Strikes, Talos and Flashpoint Respond.pdf", "2016-12-14 - MiKey - A Linux keylogger.pdf", "2016-12-19 - Dismantling a Nuclear Bot.pdf", "2016-12-09 - -Proof of Concept- CryptoWire Ransomware Spawns Lomix and UltraLocker Families.pdf", "2016-12-26 - Rocket Kitten.pdf", "2016-12-14 - Kaspersky Security Bulletin 2016. Review of the year. Overall statistics for 2016.pdf", "2016-12-14 - Twin zero-day attacks- PROMETHIUM and NEODYMIUM target individuals in Europe.pdf", "2016-12-27 - Pegasus internals- Technical Teardown of the Pegasus malware and Trident exploit chain.pdf", "2016-12-16 - Bayrob- Three suspects extradited to face charges in US.pdf", "2016-12-20 - Alice- A Lightweight, Compact, No-Nonsense ATM Malware.pdf", "2016-12-29 - Some notes on IoCs.pdf", "2016-12-15 - Let It Ride- The Sofacy Group\u2019s DealersChoice Attacks Continue.pdf", "2016-12-22 - Tofsee Spambot features .ch DGA - Reversal and Countermesaures.pdf", "2016-12-23 - Emsisoft Decryptor for GlobeImposter.pdf", "2016-11-30 - Shamoon 2- Return of the Disttrack Wiper.pdf", "2016-11-23 - Analysis- Ursnif - spying on your data since 2007.pdf", "2016-12-09 - New Exo Android Trojan Sold on Hacking Forums, Dark Web.pdf", "APT C 03.pdf", "2016-12-28 - Switcher- Android joins the \u2018attack-the-router\u2019 club.pdf", "2016-12-27 - ANALYSIS OF AUGUST STEALER MALWARE.pdf", "2016-11-30 - Shamoon- Back from the dead and destructive as ever.pdf", "Asruex.pdf", "2016-11-22 - Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy.pdf", "Aveo.pdf", "attack delivers 9002 trojan through google drive.pdf", "APT-C-09 (2).pdf", "Black Energy APT.pdf", "Cisco HayStack.pdf", "Dust Storm Infographic.pdf", "Apt 2015 (2).pdf", "Dissecting the malware in inocnation campaign.pdf", "Dynasty.pdf", "NetTraveler.pdf", "Houdini.s.Magic.Reappearance.pdf", "Operation Blockbuster Ex Summary.pdf", "Operation Dust Storm.pdf", "2016-01-22 - CVE-2015-4400 - Backdoorbot, Network Configuration Leak on a Connected Doorbell.pdf", "2016-01-26 - URLZone Zones in on Japan.pdf", "2016-01-21 - NetTraveler Spear-Phishing Email Targets Diplomat of Uzbekistan.pdf", "2016-04-13 - Ghosts in the Endpoint.pdf", "2016-05-25 - CVE-2015-2545- overview of current threats.pdf", "2016-05-29 - Keep Calm and (Don\u2019t) Enable Macros- A New Threat Actor Targets UAE Dissidents.pdf", "2016-12-01 - Alert (TA16-336A)- Avalanche (crimeware-as-a-service infrastructure).pdf", "2016-12-13 - The rise of TeleBots- Analyzing disruptive KillDisk attacks.pdf", "2016-12-09 - Windows 10- protection, detection, and response against recent Depriz malware attacks.pdf", "2016-12-15 - Goldeneye Ransomware \u2013 the Petya-Mischa combo rebranded.pdf", "2016-12-20 - New Linux-Rakos threat- devices and servers under SSH scan (again).pdf", "2016-12-29 - GRIZZLY STEPPE \u2013 Russian Malicious Cyber Activity.pdf", "A tale of two targets.pdf", "APT-C-15.pdf", "Attack on Ukraine Power Grid.pdf", "Bears in the Midst Intrusion into the Democratic National Committee \u00bb.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1065", "name": "Uncommonly Used Port", "display_name": "T1065 - Uncommonly Used Port" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1085", "name": "Rundll32", "display_name": "T1085 - Rundll32" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1124", "name": "System Time Discovery", "display_name": "T1124 - System Time Discovery" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1193", "name": "Spearphishing Attachment", "display_name": "T1193 - Spearphishing Attachment" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "kikinumpav", "id": "385742", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 561, "FileHash-MD5": 1150, "FileHash-SHA256": 1957, "URL": 1407, "domain": 1246, "hostname": 1684, "FileHash-SHA1": 433, "CVE": 54, "email": 60, "BitcoinAddress": 4, "YARA": 1 }, "indicator_count": 8557, "is_author": false, "is_subscribing": null, "subscriber_count": 12, "modified_text": "29 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698d30c03b57c38dff915023", "name": "Double Umbrella AS15169/AS21928: This evaluates a critical structural convergence between Google (AS15169) and T-Mobile USA (AS21928) within the global Tier-1 routing backbone", "description": "Research credit: msudosos, The research identifies a high-fidelity pattern where traffic from dual origins commingles within a restricted lateral transit hub, allowing for horizontal movement across backbone providers that typically maintain distinct trust boundaries. Specifically, the Content Origin (Umbrella A) originated by Google (AS15169) reaches the core backbone through a high-trust sequence involving Arelion (AS1299), NTT (AS2914), and GTT (AS3257). Simultaneously, the Mobile Origin (Umbrella B) originated by T-Mobile USA (AS21928) enters the backbone via Cogent (AS174) and Lumen (AS3356). The findings designate Lumen (AS3356) as the central lateral hub where traffic pivots horizontally between the \u201cCore Five\u201d partners-including Zayo (AS6461) and Hurricane Electric (AS6939) \u2014before leaking to international sub-transit peers like Sparkle (AS6762) and Telxius (AS12956), finally exiting at global edge points such as PCCW (AS3491) and Tata (AS6453).", "modified": "2026-03-29T06:02:00.914000", "created": "2026-02-12T01:45:36.128000", "tags": [ "The dynamics of the mudoSOSIntersectalign with sophisticated adv" ], "references": [ "as15169" ], "public": 1, "adversary": "Adversary Profile: Salt Typhoon Alignment The architectural gap identified by mudoSO mirrors the act", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 3, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URI": 1, "domain": 2661, "URL": 6810, "hostname": 2147, "email": 56, "FileHash-SHA256": 2781, "CVE": 172, "FileHash-MD5": 365, "FileHash-SHA1": 344, "IPv4": 1, "CIDR": 20940 }, "indicator_count": 36278, "is_author": false, "is_subscribing": null, "subscriber_count": 73, "modified_text": "63 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bf64e1d5e06aa6207f78de", "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "description": "", "modified": "2026-03-27T00:30:39.055000", "created": "2026-03-22T03:41:21.863000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr" ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": "698e93e1ab02db8c49e8c3ed", "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 27572, "FileHash-SHA256": 46076, "FileHash-MD5": 42177, "FileHash-SHA1": 22874, "hostname": 33438, "URL": 74810, "SSLCertFingerprint": 21, "CVE": 7579, "email": 297, "FileHash-IMPHASH": 8, "CIDR": 26203, "JA3": 1 }, "indicator_count": 281056, "is_author": false, "is_subscribing": null, "subscriber_count": 149, "modified_text": "65 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bf64eccb5d39a90a3c391e", "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "description": "", "modified": "2026-03-27T00:30:39.055000", "created": "2026-03-22T03:41:32.565000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr" ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": "698e93e1ab02db8c49e8c3ed", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 27572, "FileHash-SHA256": 46076, "FileHash-MD5": 42177, "FileHash-SHA1": 22874, "hostname": 33438, "URL": 74810, "SSLCertFingerprint": 21, "CVE": 7579, "email": 297, "FileHash-IMPHASH": 8, "CIDR": 26203, "JA3": 1 }, "indicator_count": 281056, "is_author": false, "is_subscribing": null, "subscriber_count": 152, "modified_text": "65 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "", "https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/", "https://www.sonatype.com/blog/new-pymafka-malicious-package-drops-cobalt-strike-on-macos-windows-linux", "2016-08-10 - Android Marcher- Continuously Evolving Mobile Malware.pdf", "2016-11-01 - Ursnif Malware- Deep Technical Dive.pdf", "https://documents.trendmicro.com/assets/white_papers/wp-earth-baku-an-apt-group-targeting-indo-pacific-countries.pdf", "2016-10-24 - Introducing TrickBot, Dyreza\u2019s successor.pdf", "2016-11-08 - Analysis of IOS.GUIINJECT Adware Library.pdf", "2016-04-28 - Research Spotlight- The Resurgence of Qbot.pdf", "2016-06-02 - FastPOS- Quick and Easy Credit Card Theft.pdf", "2016-01-22 - CVE-2015-4400 - Backdoorbot, Network Configuration Leak on a Connected Doorbell.pdf", "https://www.esentire.com/blog/icedid-to-cobalt-strike-in-under-20-minutes", "2016-03-11 - PowerSniff Malware Used in Macro-based Attacks.pdf", "https://www.sentinelone.com/blog/hive-ransomware-deploys-novel-ipfuscation-technique/", "https://www.esentire.com/blog/conti-affiliate-exposed-new-domain-names-ip-addresses-and-email-addresses-uncovered-by-esentire", "https://i.blackhat.com/USA-20/Thursday/us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf", "https://mp.weixin.qq.com/s/xPsEXp2J5IE7wNSMEVC24A", "https://www.cynet.com/security-foundations/attack-techniques/understanding-squirrelwaffle/", "https://isc.sans.edu/diary/Excel+spreadsheets+push+SystemBC+malware/27060", "2016-10-10 - Remsec driver analysis - Part 2.pdf", "2016-03-09 - Korean Energy and Transportation Targets Attacked by OnionDog APT.pdf", "2016-02-09 - Chinese Cyberspies Pivot To Russia In Wake Of Obama-Xi Pact.pdf", "2016-02-22 - Russian bank employees received fake job offers in targeted email attack.pdf", "2016-04-14 - Targeted Ransomware Activity.pdf", "2016-12-28 - Switcher- Android joins the \u2018attack-the-router\u2019 club.pdf", "2016-11-21 - Android malware analysis with Radare- Dissecting the Triada Trojan.pdf", "https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/", "https://blog.talosintelligence.com/mustang-panda-targets-europe/", "2016-05-29 - Keep Calm and (Don\u2019t) Enable Macros- A New Threat Actor Targets UAE Dissidents.pdf", "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/new-apt-group-chamelgang/#id3", "2016-01-28 - CenterPOS- An Evolving POS Threat.pdf", "https://blog.talosintelligence.com/avoslocker-new-arsenal/", "https://www.threatdown.com/blog/cobalt-strikes-again-uac-0056-continues-to-target-ukraine-in-its-latest-campaign/", "2016-07-01 - How I Cracked a Keylogger and Ended Up in Someone's Inbox.pdf", "2016-06-21 - The Curious Case of an Unknown Trojan Targeting German-Speaking Users.pdf", "2016-09-23 - Hancitor (AKA Chanitor) observed using multiple attack approaches.pdf", "2016-06-28 - Prince of Persia \u2013 Game Over.pdf", "https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/", "2016-02-29 - New Malware \u2018Rover\u2019 Targets Indian Ambassador to Afghanistan.pdf", "2016-09-13 - The curious case of BLATSTING's RSA implementation.pdf", "https://isc.sans.edu/diary/Qakbot+infection+with+Cobalt+Strike+and+VNC+activity/28448", "2016-05-25 - CVE-2015-2545- overview of current threats.pdf", "2016-08-22 - VB Dropper and Shellcode for Hancitor Reveal New Techniques Behind Uptick.pdf", "2016-11-17 - Princess Locker decryptor.pdf", "2016-06-29 - Apocalypse- Ransomware which targets companies through insecure RDP.pdf", "2016-11-02 - Nymaim Malware- Deep Technical Dive \u2013 Adventures in Evasive Malware.pdf", "2016-12-01 - CNACOM - Open Source Exploitation via Strategic Web Compromise.pdf", "https://www.morphisec.com/blog/vmware-identity-manager-attack-backdoor/", "https://blog.talosintelligence.com/building-bypass-with-msbuild/", "2016-05-02 - Prince of Persia Hashes.pdf", "2016-08-25 - Shakti Trojan - Technical Analysis.pdf", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "https://blog.sekoia.io/nobeliums-envyscout-infection-chain-goes-in-the-registry-targeting-embassies/", "2016-09-28 - Introducing Her Royal Highness the Princess Locker Ransomware.pdf", "https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/", "2016-12-01 - Alert (TA16-336A)- Avalanche (crimeware-as-a-service infrastructure).pdf", "https://thedfirreport.com/2021/01/31/bazar-no-ryuk/", "2016-11-14 - Ransoc Desktop Locking Ransomware Ransacks Local Files and Social Media Profiles.pdf", "2016-03-11 - Cerber ransomware- new, but mature.pdf", "2016-07-26 - Attack Delivers \u20189002\u2019 Trojan Through Google Drive.pdf", "2016-10-25 - Houdini\u2019s Magic Reappearance.pdf", "2016-04-27 - Freezer Paper around Free Meat (Repackaging Open Source BeEF for Tracking and More).pdf", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "2016-05-22 - Cron has fallen.pdf", "2016-07-30 - Luminosity RAT - Re-purposed.pdf", "2016-05-12 - LatentBot \u2013 modularny i silnie zaciemniony bot.pdf", "https://cert.gov.ua/article/703548", "https://cert.gov.ua/article/619229", "2016-08-18 - The Shadow Brokers.pdf", "2016-04-07 - FBI Quietly Admits to Multi-Year APT Attack, Sensitive Data Stolen.pdf", "https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/", "2016-09-20 - Inside Petya and Mischa ransomware.pdf", "https://www.crowdstrike.com/en-us/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout", "2016-11-15 - Kronos Banking Trojan Used to Deliver New Point-of-Sale Malware.pdf", "https://blog.talosintelligence.com/lemon-duck-spreads-wings/", "2016-07-31 - China 1937CN Team Hackers Attack Airports in Vietnam.pdf", "2016-02-02 - DMA Locker- New Ransomware, But No Reason To Panic.pdf", "https://blog.talosintelligence.com/manjusaka-offensive-framework/", "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/", "2016-04-19 - MULTIGRAIN \u2013 Point of Sale Attackers Make an Unhealthy Addition to the Pantry.pdf", "2016-07-14 - Technical Notes on Sakula.pdf", "https://www.security.com/threat-intelligence/harvester-new-apt-attacks-asia", "https://www.sentinelone.com/labs/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/", "2016-02-02 - Vipasana ransomware new ransom on the block.pdf", "2016-06-06 - Everyone sees not what they want to see.pdf", "https://www.gendigital.com/blog/insights/research/backdoored-client-from-mongolian-ca-monpass", "https://www.cybereason.com/blog/research/threat-analysis-report-datoploader-exploits-proxyshell-to-deliver-qbot-and-cobalt-strike", "https://thedfirreport.com/2020/04/24/ursnif-via-lolbins/", "2016-12-07 - Floki Bot Strikes, Talos and Flashpoint Respond.pdf", "2016-09-19 - Untangling the Ripper ATM Malware.pdf", "2016-02-09 - Bedep Lurking in Angler's Shadows.pdf", "2016-09-05 - Pok\u00e9mon-themed Umbreon Linux Rootkit Hits x86, ARM Systems.pdf", "2016-01-21 - NetTraveler Spear-Phishing Email Targets Diplomat of Uzbekistan.pdf", "https://thedfirreport.com/2021/06/28/hancitor-continues-to-push-cobalt-strike/", "NetTraveler.pdf", "2016-11-08 - Analysis of iOSGuiInject Adware Library.pdf", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr", "https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf", "https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/refs/heads/master/China/APT/Chimera/Analysis.md", "2016-11-30 - Shamoon 2- Return of the Disttrack Wiper.pdf", "2016-03-06 - Network detector for Winnti malware.pdf", "https://isc.sans.edu/diary/Emotet%20infection%20with%20Cobalt%20Strike/28824", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "2016-05-24 - New Wekby Attacks Use DNS Requests As Command and Control Mechanism.pdf", "2016-10-05 - FastPOS Updates in Time for the Retail Sale Season.pdf", "2016-10-03 - Remsec driver analysis.pdf", "2016-04-06 - Bootkit's development overview and trend (X).pdf", "2016-09-23 - Dissecting a Hacktivist\u2019s DDoS Tool- Saphyra Revealed.pdf", "2016-11-09 - Down the H-W0rm Hole with Houdini\u2019s RAT.pdf", "2016-01-22 - The Impact of Dragonfly Malware on Industrial Control Systems.pdf", "2016-07-13 - Troldesh ransomware influenced by (the) Da Vinci code.pdf", "2016-10-31 - Second Shadow Brokers dump released.pdf", "https://blog.bushidotoken.net/2022/06/overview-of-russian-gru-and-svr.html", "https://www.picussecurity.com/resource/blog/ttps-used-in-the-solarwinds-breach", "2016-08-22 - Trojan.Mutabaha.1.pdf", "https://www.crowdstrike.com/en-us/blog/how-falcon-complete-disrupts-ecrime-operators-wizard-spider/", "https://blog-assets.f-secure.com/wp-content/uploads/2020/03/18122307/F-Secure_Dukes_Whitepaper.pdf", "A tale of two targets.pdf", "https://www.welivesecurity.com/2022/04/13/eset-takes-part-global-operation-disrupt-zloader-botnets/", "https://www.cisa.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf", "2016-06-22 - After Angler- Shift in Exploit Kit Landscape and New Crypto-Ransomware Activity.pdf", "2016-11-07 - Little Trickbot Growing Up- New Campaign.pdf", "https://security.macnica.co.jp/blog/2022/05/iso.html", "2016-03-11 - Gaudox - HTTP Bot (1.1.0.1) - CPlusPlus ASM - Ring3 Rootkit - Watchdog - Antis.pdf", "2016-12-23 - Emsisoft Decryptor for GlobeImposter.pdf", "Attack on Ukraine Power Grid.pdf", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "2016-10-01 - Source Code for IoT Botnet \u2018Mirai\u2019 Released.pdf", "2016-08-28 - FEINTCLOUD.pdf", "2016-01-18 - Updated Blackmoon banking Trojan stays focused on South Korean banking customers.pdf", "2016-04-14 - Meet GozNym- The Banking Malware Offspring of Gozi ISFB and Nymaim.pdf", "2016-08-08 - MONSOON - Analysis Of An APT Campaign.pdf", "https://www.varonis.com/blog/hive-ransomware-analysis", "https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf", "Houdini.s.Magic.Reappearance.pdf", "2016-12-15 - Goldeneye Ransomware \u2013 the Petya-Mischa combo rebranded.pdf", "https://thedfirreport.com/2020/10/08/ryuks-return/", "Operation Dust Storm.pdf", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "My Independent research finds an intersect between different pdf DV versions being able to connect to Raspberry Pi devices as it was the FCC application document. Risk: Mac ID connectivity to all.", "2016-02-25 - KeyBase Threat Grows Despite Public Takedown- A Picture is Worth a Thousand Words.pdf", "2016-07-07 - New threat dubbed Zepto Ransomware is spreading out with a new email spam campaign. It is a variant of the recent Locky Ransomware..pdf", "https://redcanary.com/wp-content/uploads/2022/05/Gootloader.pdf", "2016-02-09 - DMA Locker Strikes Back.pdf", "https://www.security.com/threat-intelligence/yanluowang-ransomware-attacks-continue", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "https://www.sentinelone.com/blog/from-the-front-lines-peering-into-a-pysa-ransomware-attack/", "2016-11-22 - Cobalt hackers executed massive, synchronized ATM heists across Europe, Russia.pdf", "Bears in the Midst Intrusion into the Democratic National Committee \u00bb.pdf", "2016-03-21 - OS X Malware Samples Analyzed.pdf", "2016-09-29 - Want Tofsee My Pictures- A Botnet Gets Aggressive.pdf", "https://kienmanowar.wordpress.com/2022/06/04/quicknote-cobaltstrike-smb-beacon-analysis-2/", "2016-11-30 - Bladabindi Remains A Constant Threat By Using Dynamic DNS Services.pdf", "2016-05-13 - Cyber Heist Attribution.pdf", "https://isc.sans.edu/diary/28636", "https://www.trendmicro.com/en_gb/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html", "2016-05-06 - 7ev3n ransomware turning \u2018HONE$T\u2019.pdf", "2016-10-20 - TheMoon - A P2P botnet targeting Home Routers.pdf", "2016-03-04 - Tracing the Lineage of DarkSeoul.pdf", "2016-11-02 - Linux-Moose- Still breathing.pdf", "2016-11-21 - PrincessLocker \u2013 ransomware with not so royal encryption.pdf", "2016-09-28 - Belling the BEAR.pdf", "2016-03-15 - Suckfly- Revealing the secret life of your code signing certificates.pdf", "2016-09-16 - Tofsee \u2013 modular spambot.pdf", "2016-09-14 - BkSoD by Ransomware- HDDCryptor Uses Commercial Tools to Encrypt Network Shares and Lock HDDs.pdf", "2016-10-17 - A Tale of Two Targets.pdf", "https://web-assets.esetstatic.com/wls/2019/10/ESET_Operation_Ghost_Dukes.pdf", "2016-08-15 - Shakti Trojan- Document Thief.pdf", "2016-10-27 - Mirai DDoS Botnet- Source Code & Binary Analysis.pdf", "2016-03-25 - ProjectM- Link Found Between Pakistani Actor and Operation Transparent Tribe.pdf", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf", "2016-11-23 - Analysis- Ursnif - spying on your data since 2007.pdf", "2016-05-09 - PSEUDO-DARKLEECH ANGLER EK FROM 185.118.66.154 SENDS BEDEP-CRYPTXXX.pdf", "https://blog.nviso.eu/2021/11/17/cobalt-strike-decrypting-obfuscated-traffic-part-4/", "https://unit42.paloaltonetworks.com/bazarloader-network-reconnaissance/", "2016-06 - Form Grabber 2016 [Crome,FF,Opera,Thunderbird, Outlook IE Safari] Hack the world.pdf", "2016-05-19 - Petya and Mischa \u2013 Ransomware Duet (Part 1).pdf", "https://contagiodump.blogspot.com/2014/11/onionduke-samples.html", "https://ics-cert.kaspersky.com/publications/reports/2022/06/27/attacks-on-industrial-control-systems-using-shadowpad/", "https://blog.talosintelligence.com/indigodrop-maldocs-cobalt-strike/", "2016-02-19 - Citadel 0.0.1.1 (Atmos).pdf", "2016-11-09 - Tricks of the Trade- A Deeper Look Into TrickBot\u2019s Machinations.pdf", "2016-02-05 - Vawtrak and UrlZone Banking Trojans Target Japan.pdf", "https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/", "2016-02-12 - A Look Into Fysbis- Sofacy\u2019s Linux Backdoor.pdf", "2016-05-11 - Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks.pdf", "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/new-apt-group-chamelgang/", "2016-04-27 - Freezer Paper around Free Meat.pdf", "2016-08-08 - Strider- Cyberespionage group turns eye of Sauron on targets.pdf", "2016-04-21 - When entropy meets Shannon.pdf", "https://thedfirreport.com/2020/08/31/netwalker-ransomware-in-1-hour/", "https://www.qurium.org/alerts/targeted-malware-against-crph/", "2016-04-28 - Tick cyberespionage group zeros in on Japan.pdf", "2016-12-20 - New Linux-Rakos threat- devices and servers under SSH scan (again).pdf", "2016-01-25 - Hidden Tear Ransomware Developer Blackmailed by Malware Developers using his Code.pdf", "2016-09-08 - The Philadelphia Ransomware offers a Mercy Button for Compassionate Criminals.pdf", "2016-10-11 - Odinaff- New Trojan used in high level financial attacks.pdf", "https://tccontre.blogspot.com/2019/11/cobaltstrike-beacondll-your-not.html", "2016-08-05 - Smoke Loader \u2013 downloader with a smokescreen still alive.pdf", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/", "2016-07-03 - Android Triada modular trojan.pdf", "2016-10-03 - On the StrongPity Waterhole Attacks Targeting Italian and Belgian Encryption Users.pdf", "2016-03-14 - Massive Malvertising Campaign in US Leads to Angler Exploit Kit-BEDEP.pdf", "2016-06-25 - Rokku Ransomware shows possible link with Chimera.pdf", "https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf", "2016-07-08 - GootKit- Bobbing and Weaving to Avoid Prying Eyes.pdf", "2016-02-14 - PadCrypt The first ransomware with Live Support Chat and an Uninstaller.pdf", "https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/", "https://cloud.google.com/blog/topics/threat-intelligence/tracking-apt29-phishing-campaigns/", "https://resource.redcanary.com/rs/003-YRU-314/images/2022_ThreatDetectionReport_RedCanary.pdf", "2016-03-30 - Ransomware Deployed by Adversary with Established Foothold.pdf", "2016-06-23 - POS and Credit Cards- In the Line of Fire with \u201cPunkeyPOS\u201d.pdf", "https://medium.com/walmartglobaltech/socgholish-campaigns-and-initial-access-kit-4c4283fea8ee", "https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/", "https://www.gendigital.com/blog/insights/research/decoding-cobalt-strike-understanding-payloads", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "2016-04-26 - Digging deep for PLATINUM.pdf", "2016-05-17 - ATM infector.pdf", "2016-07-26 - OTX Pulse on R980 ransomware.pdf", "2016-06-09 - Reverse-engineering DUBNIUM.pdf", "https://asec.ahnlab.com/en/31811/", "https://www.unh4ck.com/detection-engineering-and-threat-hunting/lateral-movement/detecting-conti-cobaltstrike-lateral-movement-techniques-part-1", "https://cloud.google.com/blog/topics/threat-intelligence/darkside-affiliate-supply-chain-software-compromise", "2016-09-17 - A few notes on SECONDDATE's C&C protocol.pdf", "https://www.sentinelone.com/labs/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/", "2016-01-12 - The Magnificent FIN7- Revealing a Cybercriminal Threat Group.pdf", "https://thehackernews.com/2022/05/this-new-fileless-malware-hides.html", "https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/", "2016-03-20 - Hidden Tear Project- Forbidden Fruit Is the Sweetest.pdf", "2016-07-11 - When Paying Out Doesn't Pay Off.pdf", "https://www.crowdstrike.com/en-us/blog/bears-midst-intrusion-democratic-national-committee/", "2016-07-22 - Stampado Ransomware campaign decrypted before it Started.pdf", "2016-03-31 - The evolution of Brazilian Malware.pdf", "2016-08-29 - Nightmare on Tor Street- Ursnif variant Dreambot adds Tor functionality.pdf", "2016-06-17 - In The Wild- Mobile Malware Implements New Features.pdf", "https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html", "2016-09-27 - Komplex Mac backdoor answers old questions.pdf", "2016-06-17 - Operation Daybreak.pdf", "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "2016-04-05 - SCADA Security Report 2016.pdf", "2016-08-01 - CrowdStrike\u2019s New Methodology for Tracking eCrime.pdf", "2016-05-05 - Sophisticated New Packer Identified in CryptXXX Ransomware Sample.pdf", "2016-03-24 - Maktub Locker \u2013 Beautiful And Dangerous.pdf", "2016-09-20 - Hackers lurking, parliamentarians told _ News _ DW _ 20.09.2016.pdf", "2016-11-08 - SPAMTORTE VERSION 2- DISCOVERY OF AN ADVANCED, MULTILAYERED SPAMBOT CAMPAIGN THAT IS BACK WITH A VENGEANCE.pdf", "2016-08-30 - Pythons and Unicorns and Hancitor\u2026Oh My! Decoding Binaries Through Emulation.pdf", "2016-07-08 - The Dropping Elephant \u2013 aggressive cyber-espionage in the Asian region.pdf", "2016-05-16 - Vietnamese Bank Blocks $1 Million SWIFT Heist.pdf", "https://www.trendmicro.com/en_us/research/22/g/gootkit-loaders-updated-tactics-and-fileless-delivery-of-cobalt-strike.html", "2016-12-29 - GRIZZLY STEPPE \u2013 Russian Malicious Cyber Activity.pdf", "https://www.truesec.com/hub/blog/proxyshell-qbot-and-conti-ransomware-combined-in-a-series-of-cyber-attacks", "2016-12-20 - Alice- A Lightweight, Compact, No-Nonsense ATM Malware.pdf", "Verification failure observed in automated verification handlers during sandbox replay.", "2016-12-06 - August in November- New Information Stealer Hits the Scene.pdf", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "2016-08-04 - What is Multigrain- Learn what makes this PoS malware different.pdf", "2016-03-10 - Death Comes Calling- Thanatos-Alphabot Trojan Hits the Market.pdf", "https://unit42.paloaltonetworks.com/bumblebee-malware-projector-libra/", "2016-02-08 - APT-style bank robberies increase with Metel, GCMAN and Carbanak 2.0 attacks.pdf", "2016-09-22 - Book of Eli- African targeted attacks.pdf", "2016-11-23 - InPage zero-day exploit used to attack financial institutions in Asia.pdf", "https://unit42.paloaltonetworks.com/fireeye-red-team-tool-breach/", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "2016-02-17 - Russian Police Prevented Massive Banking Sector Cyber Attack.pdf", "https://blog.gigamon.com/2021/09/10/rendering-threats-a-network-perspective/", "2016-07-25 - Patchwork cyberespionage group expands targets from governments to wide range of industries.pdf", "2016-12-09 - -Proof of Concept- CryptoWire Ransomware Spawns Lomix and UltraLocker Families.pdf", "2016-06-11 - The Chinese Hackers in the Back Office.pdf", "2016-10-10 - How France's TV5 was almost destroyed by 'Russian hackers'.pdf", "2016-03-23 - Gozi ISFB Sourceccode.pdf", "2016-09-20 - Meanwhile in Britain, Qadars v3 Hardens Evasion, Targets 18 UK Banks.pdf", "2016-02-29 - The \u201cHawkEye\u201d attack- how cybercrooks target small businesses for big money.pdf", "2016-03-29 - Taiwan targeted with new cyberespionage back doorTrojan.pdf", "2016-09-27 - Threat Spotlight- GozNym.pdf", "2016-08-17 - Operation Ghoul- targeted attacks on industrial and engineering organizations.pdf", "https://www.cynet.com/security-foundations/attack-techniques/new-wave-of-emotet-when-project-x-turns-into-y/", "2016-03-18 - Xor DDoS.pdf", "2016-12-13 - The rise of TeleBots- Analyzing disruptive KillDisk attacks.pdf", "https://isc.sans.edu/diary/Bumblebee+Malware+from+TransferXL+URLs/28664", "https://vanmieghem.io/blueprint-for-evading-edr-in-2022/", "2016-07-21 - Canadian Man Behind Popular \u2018Orcus RAT\u2019.pdf", "https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt", "2016-08-04 - Iranian Actor -Group5- Targeting Syrian Opposition.pdf", "https://www.ncsc.gov.ie/pdfs/HSE_Conti_140521_UPDATE.pdf", "2016-04-25 - Attackers Behind GozNym Trojan Set Sights on Europe.pdf", "2016-02-24 - Operation Blockbuster Coalition Ties Destructive Attacks to Lazarus Group.pdf", "2016-10-15 - TrickBot- We Missed you, Dyre.pdf", "2016-03-23 - SamSam- The Doctor Will See You, After He Pays The Ransom.pdf", "2016-01-21 - Android Spywaller- Firewall-Style Antivirus Blocking.pdf", "2016-09-27 - New Voldemort-Nagini Ransomware Virus Infection.pdf", "2016-05-12 - Chinese-language Ransomware \u2018SHUJIN\u2019 Makes An Appearance.pdf", "https://cert-agid.gov.it/news/il-malware-envyscout-apt29-e-stato-veicolato-anche-in-italia/", "2016-12-14 - MiKey - A Linux keylogger.pdf", "2016-10-11 - Remsec driver analysis - Part 3.pdf", "2016-12-15 - Let It Ride- The Sofacy Group\u2019s DealersChoice Attacks Continue.pdf", "2016-12-14 - Twin zero-day attacks- PROMETHIUM and NEODYMIUM target individuals in Europe.pdf", "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/", "2016-08-02 - Orcus \u2013 Birth of an unusual plugin builder RAT.pdf", "https://thedfirreport.com/2021/03/08/bazar-drops-the-anchor/", "2016-12-16 - Bayrob- Three suspects extradited to face charges in US.pdf", "2016-11-28 - A New All-in-One Botnet- Proteus.pdf", "2016-12-06 - Deep Analysis of the Online Banking Botnet TrickBot.pdf", "2016-11-14 - Doctor Web discovers a botnet that attacks Russian banks.pdf", "2016-06-23 - Tracking Elirks Variants in Japan- Similarities to Previous Attacks.pdf", "https://cloud.google.com/blog/topics/threat-intelligence/unc2452-merged-into-apt29/", "2016-07-06 - New OSX-Keydnap malware is hungry for credentials.pdf", "https://thedfirreport.com/2021/06/20/from-word-to-lateral-movement-in-1-hour/", "2016-01-26 - URLZone Zones in on Japan.pdf", "2016-09-13 - DualToy- New Windows Trojan Sideloads Risky Apps to Android and iOS Devices.pdf", "2016-06-15 - Mofang- A politically motivated information stealing adversary.pdf", "2016-08-23 - GozNym Banking Trojan Targeting German Banks.pdf", "2016-12-27 - ANALYSIS OF AUGUST STEALER MALWARE.pdf", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "2016-02-09 - Poseidon Group- a Targeted Attack Boutique specializing in global cyber-espionage.pdf", "https://cloud.google.com/blog/topics/threat-intelligence/melting-unc2198-icedid-to-ransomware-operations/", "2016-09-23 - SECONDDATE in action.pdf", "2016-09-04 - BLATSTING Command-and-Control protocol.pdf", "2016-12-09 - Windows 10- protection, detection, and response against recent Depriz malware attacks.pdf", "2016-12-07 - August in November- New Information Stealer Hits the Scene.pdf", "https://blog.nviso.eu/2022/07/20/analysis-of-a-trojanized-jquery-script-gootloader-unleashed/", "2016-09-02 - Necurs \u2013 hybrid spam botnet.pdf", "https://teamt5.org/tw/posts/mjib-holds-briefing-on-chinese-hackers-attacks-on-taiwanese-government-agencies/", "2016-07-18 - Third time (un)lucky \u2013 improved Petya is out.pdf", "2016-10-09 - SiteIntel- Cyber Caliphate Army.pdf", "https://cloud.google.com/blog/topics/threat-intelligence/kegtap-and-singlemalt-with-a-ransomware-chaser/", "https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis", "2016-01-28 - BlackEnergy APT Attacks in Ukraine employ spearphishing with Word documents.pdf", "2016-05-04 - Petya- the two-in-one trojan.pdf", "https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/", "2016-09-30 - Hacked Steam accounts spreading Remote Access Trojan.pdf", "https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/", "2016-12-08 - Thyssenkrupp victim of cyber attack.pdf", "2016-08-29 - German Speakers Targeted by SPAM Leading to Ozone RAT.pdf", "https://www.cisa.gov/news-events/analysis-reports/ar21-148a", "2016-12-09 - New Exo Android Trojan Sold on Hacking Forums, Dark Web.pdf", "https://isc.sans.edu/diary/rss/28752", "2016-03-14 - Digital Quartermaster Scenario Demonstrated in Attacks Against the Mongolian Government.pdf", "2016-11-10 - Floki Bot and the stealthy dropper.pdf", "2016-10-21 - BITTER- a targeted attack against Pakistan.pdf", "2016-02-21 - Source code for powerful Android banking malware is leaked.pdf", "2016-04-14 - Bedep has raised its game vs Bot Zombies.pdf", "2016-07-26 - Threat Actors Using Legitimate PayPal Accounts To Distribute Chthonic Banking Trojan.pdf", "2016-10-27 - BLACKGEAR Espionage Campaign Evolves, Adds Japan To Target List.pdf", "https://medium.com/walmartglobaltech/cobaltstrike-uuid-stager-ca7e82f7bb64", "https://www.security.com/threat-intelligence/sodinokibi-ransomware-cobalt-strike-pos", "2016-07-12 - Malware Discovered \u2013 SFG- Furtim Malware Analysis.pdf", "https://www.trendmicro.com/en_us/research/21/a/earth-wendigo-injects-javascript-backdoor-to-service-worker-for-.html", "2016-11-28 - NetWire RAT Steals Payment Card Data.pdf", "https://www.netresec.com/?page=Blog&month=2021-04&post=Analysing-a-malware-PCAP-with-IcedID-and-Cobalt-Strike-traff", "https://medium.com/walmartglobaltech/signed-dll-campaigns-as-a-service-7760ac676489", "2016-08-08 - Possibly Italy-Born Android RAT Reported in China, Find Bitdefender Researchers.pdf", "https://www.zscaler.com/blogs/security-research/targeted-attack-leverages-india-china-border-dispute-lure-victims", "2016-06-14 - CVE-2016-4171 \u2013 Adobe Flash Zero-day used in targeted attacks.pdf", "2016-12-26 - Rocket Kitten.pdf", "2016-09-21 - Reversing GO binaries like a pro.pdf", "2016-05-10 - Setting Sights On Retail- AbaddonPOS Now Targeting Specific POS Software.pdf", "2016-05-27 - Evidence of Stronger Ties Between North Korea and SWIFT Banking Attacks.pdf", "https://github.com/infinitumitlabs/Karakurt-Hacking-Team-CTI", "https://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-part-2-a28bffffa671", "https://medium.com/walmartglobaltech/man1-moskal-hancitor-and-a-side-of-ransomware-d77b4d991618", "2016-07-07 - NetTraveler APT Targets Russian, European Interests.pdf", "2016-04-06 - Locky Ransomware Is Becoming More Sophisticated - Cybercriminals Continue Email Campaign Innovation.pdf", "attack delivers 9002 trojan through google drive.pdf", "https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.pdf", "2016-01-29 - Malicious Office Files Dropping Kasidet And Dridex.pdf", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "2016-09-21 - KrebsOnSecurity Hit With Record DDoS.pdf", "https://www.cybereason.com/blog/cybereason-vs-egregor-ransomware", "Dissecting the malware in inocnation campaign.pdf", "APT-C-15.pdf", "2016-02-18 - New Android Trojan \u201cXbot\u201d Phishes Credit Cards and Bank Accounts, Encrypts Devices for Ransom.pdf", "2016-12-27 - Pegasus internals- Technical Teardown of the Pegasus malware and Trident exploit chain.pdf", "2016-06-10 - Petya and Mischa- ransomware duet (part 2).pdf", "2016-04-21 - PoS Attacks Net Crooks 20 Million Stolen Bank Cards.pdf", "2016-01-12 - Trochilus RAT Evades Antivirus Detection, Used for Cyber-Espionage in South-East Asia.pdf", "2016-11-02 - Exposing the EGO MARKET- the cybercrime performed by the Linux-Moose botnet.pdf", "2016-09-26 - Sofacy\u2019s \u2018Komplex\u2019 OS X Trojan.pdf", "2016-01-22 - PlugX APT Malware.pdf", "2016-10-01 - \u2018Shadow Brokers\u2019 Whine That Nobody Is Buying Their Hacked NSA Files.pdf", "2016-05-18 - Operation Groundbait- Espionage in Ukrainian war zones.pdf", "https://cocomelonc.github.io/tutorial/2022/04/20/malware-pers-1.html", "2016-01-22 - New Attacks Linked to C0d0so0 Group.pdf", "https://cloud.google.com/blog/topics/threat-intelligence/spear-phish-ukrainian-entities/", "https://thedfirreport.com/2022/03/07/2021-year-in-review/", "https://isc.sans.edu/diary/rss/26862", "2016-09-16 - iSpy Keylogger.pdf", "2016-12-29 - Some notes on IoCs.pdf", "2016-10-28 - zxshell repository.pdf", "2016-08-30 - OSX-Keydnap spreads via signed Transmission application.pdf", "2016-05-20 - Special Report- Cyber thieves exploit banks' faith in SWIFT transfer network.pdf", "APT C 03.pdf", "2016-01-24 - Scarlet Mimic- Years-Long Espionage Campaign Targets Minority Activists.pdf", "2016-04-19 - Trojan.GodzillaLoader (alias Godzilla Loader).pdf", "2016-02-26 - Nymaim Moves Past Its Ransomware Roots - What Is Old Is New Again.pdf", "2016-02-24 - The DGA of Qakbot.T.pdf", "https://forensicitguy.github.io/inspecting-powershell-cobalt-strike-beacon/", "https://raw.githubusercontent.com/AmnestyTech/investigations/refs/heads/master/2021-02-24_vietnam/README.md", "2016-11-15 - ScanPOS, new POS malware being distributed by Kronos.pdf", "2016-05-09 - PseudoDarkLeech Angler EK from 185.118.66.154 sends Bedep-CryptXXX.pdf", "2016-10-17 - \u2018DealersChoice\u2019 is Sofacy\u2019s Flash Player Exploit Platform.pdf", "https://asec.ahnlab.com/en/34549/", "https://www.crowdstrike.com/en-us/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/", "https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage", "https://mal-eats.net/2021/05/10/campo_new_attack_campaign_targeting_japan/", "2016-04-11 - Manamecrypt \u2013 a ransomware that takes a different route.pdf", "https://medium.com/walmartglobaltech/trickbot-crews-new-cobaltstrike-loader-32c72b78e81c", "https://www.welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/", "2016-09-15 - MILE TEA- Cyber Espionage Campaign Targets Asia Pacific Businesses and Government Agencies.pdf", "https://securelist.com/a-new-secret-stash-for-fileless-malware/106393/", "2016-09-07 - The Missing Piece \u2013 Sophisticated OS X Backdoor Discovered.pdf", "2016-10-27 - Inside the Gootkit C&C server.pdf", "https://www.cynet.com/blog/orion-threat-alert-flight-of-the-bumblebee/", "2016-06-07 - The Story of yet another ransom-fail-ware.pdf", "2016-05-23 - DMA Locker 4.0- Known ransomware preparing for a massive distribution.pdf", "2016-10-25 - TrickBot Banker Insights.pdf", "2016-05-22 - Operation Ke3chang Resurfaces With New TidePool Malware.pdf", "2016-05-17 - Indian organizations targeted in Suckfly attacks.pdf", "2016-10-18 - Digitally Signed Malware Targeting Gaming Companies.pdf", "https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/5/", "https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/", "2016-01-29 - VB2015 paper- It's A File Infector... It\u2019s Ransomware... It's Virlock.pdf", "2016-01-13 - Russian group behind 2013 Foreign Ministry hack.pdf", "2016-10-17 - New-looking Sundown EK drops Smoke Loader, Kronos banker.pdf", "2016-12-22 - Tofsee Spambot features .ch DGA - Reversal and Countermesaures.pdf", "https://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-14cc543af811", "https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/", "2016-08-16 - Aveo Malware Family Targets Japanese Speaking Users.pdf", "2016-04-22 - Tater- A PowerShell implementation of the Hot Potato Windows Privilege Escalation exploit..pdf", "2016-04-22 - New Poison Ivy RAT Variant Targets Hong Kong Pro-Democracy Activists.pdf", "2016-05-15 - What We Can Learn From the Bangladesh Central Bank Cyber Heist.pdf", "2016-03-03 - Attack on Zygote- a new twist in the evolution of mobile threats.pdf", "2016-03-11 - Gaudox - HTTP Bot (1.1.0.1) - C++-ASM - Ring3 Rootkit - Watchdog - Antis.pdf", "https://cocomelonc.github.io/malware/2022/07/30/malware-av-evasion-8.html", "2016-10-27 - In-Dev Ransomware forces you do to Survey before unlocking Computer.pdf", "https://www.arashparsa.com/catching-a-malware-with-no-name/", "https://thedfirreport.com/2021/09/13/bazarloader-to-conti-ransomware-in-32-hours/", "2016-09-28 - Confucius Says\u2026Malware Families Get Further By Abusing Legitimate Websites.pdf", "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures", "2016-08-08 - ProjectSauron- top level cyber-espionage platform covertly extracts encrypted government comms.pdf", "2016-07-28 - Petya and Mischa For All Part II- They\u2019re Here\u2026.pdf", "2016-02-17 - OceanLotus for OS X \u2013 an Application Bundle Pretending to be an Adobe Flash Update.pdf", "https://raw.githubusercontent.com/ThreatConnect-Inc/research-team/refs/heads/master/IOCs/WizardSpider-UNC1878-Ryuk.csv", "2016-01-23 - Imminent Monitor 4 RAT Analysis \u2013 A Glance.pdf", "2016-03-01 - Shrouded Crossbow Creators Behind BIFROSE for UNIX.pdf", "2016-06-14 - New Sofacy Attacks Against US Government Agency.pdf", "https://thedfirreport.com/2022/04/25/quantum-ransomware/", "2016-08-08 - Doctor Web detected Linux Trojan written in Go.pdf", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-148a", "https://isc.sans.edu/diary/rss/27618", "2016-06-15 - Unsupported TeamViewer Versions Exploited For Backdoors, Keylogging.pdf", "2016-11-30 - Shamoon- Back from the dead and destructive as ever.pdf", "2016-07-05 - New Backdoor Allows Full Access to Mac Systems, Bitdefender Warns.pdf", "Operation Blockbuster Ex Summary.pdf", "Aveo.pdf", "https://thedfirreport.com/2021/05/02/trickbot-brief-creds-and-beacons/", "2016-10-26 - Moonlight \u2013 Targeted attacks in the Middle East.pdf", "2016-12-19 - Dismantling a Nuclear Bot.pdf", "2016-09-06 - Blatsting C&C Transcript.pdf", "2016-09-13 - H1N1- Technical analysis reveals new capabilities.pdf", "2016-08-22 - BLATSTING FUNKSPIEL.pdf", "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/", "2016-07-20 - CrypMIC Ransomware Wants to Follow CryptXXX\u2019s Footsteps.pdf", "2016-05-09 - KRBanker Targets South Korea Through Adware and Exploit Kits.pdf", "Apt 2015 (2).pdf", "https://www.proofpoint.com/us/blog/threat-insight/nimzaloader-ta800s-new-initial-access-malware", "2016-03-07 - RedHat Hacker.asp.pdf", "https://www.sentinelone.com/blog/threat-actor-uac-0056-targeting-ukraine-with-fake-translation-software/", "2016-03-01 - Look Into Locky Ransomware.pdf", "2016-03-23 - New self?protecting USB trojan able to avoid detection.pdf", "2016-01-09 - Confirmation of a Coordinated Attack on the Ukrainian Power Grid.pdf", "https://malcat.fr/blog/lnk-forensic-and-config-extraction-of-a-cobalt-strike-beacon/", "2016-11-17 - It\u2019s Parliamentary - KeyBoy and the targeting of the Tibetan Community.pdf", "2016-07-01 - KeyBase - A New Keylogger on the Block.pdf", "2016-08-10 - CryptXXX - CrypMIC \u2013 intensywnie dystrybuowany ransomware w ramach exploit-kit\u00f3w.pdf", "2016-01-29 - From Linux to Windows \u2013 New Family of Cross-Platform Desktop Backdoors Discovered.pdf", "2016-05-19 - Petya and Mischa for All! The RaaS Boom Expands to Include the Petya-Mischa Combo.pdf", "2016-05-26 - The OilRig Campaign- Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor.pdf", "2016-08-16 - Brazil Can\u2019t Catch a Break- After Panda Comes the Sphinx.pdf", "2016-08-29 - Fantom ransomware impersonates Windows update.pdf", "2016-09-29 - TeamXRat- Brazilian cybercrime meets ransomware.pdf", "2016-08-25 - Unpacking the spyware disguised as antivirus.pdf", "2016-08-19 - New Hancitor Malware- Pimp my Downloaded.pdf", "https://cyber.wtf/2022/03/23/what-the-packer/", "2016-10-17 - RotorCrypt (RotoCrypt) Ransomware Support Topic - .tar, .c400, .c300, .GRANIT.pdf", "Dynasty.pdf", "2016-05-03 - A Universal Windows Bootkit.pdf", "https://mp.weixin.qq.com/s/cGS8FocPnUdBconLbbaG-g", "2016-06-24 - Ani-Shell.pdf", "https://isc.sans.edu/diary/27308", "Dust Storm Infographic.pdf", "https://cloud.google.com/blog/topics/threat-intelligence/apt41-us-state-governments/", "https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf", "2016-08-07 - Strider- Cyberespionage group turns eye of Sauron on targets.pdf", "2016-08 - Analysis of a packed Pony downloader.pdf", "2016-09-01 - TADAQUEOUS moments.pdf", "2016-03-18 - Teslacrypt Spam Campaign- \u201cUnpaid Issue\u2026\u201d.pdf", "https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions", "2016-04-19 - Your Package Has Been Successfully Encrypted- TeslaCrypt 4.1A and the Malware Attack Chain.pdf", "as15169", "2016-08-11 - Smrss32 (.encrypted) Ransomware Help & Support - _HOW_TO_Decrypt.bmp.pdf", "https://raw.githubusercontent.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/refs/heads/main/APT29_C2-Client_Dropbox_Loader/APT29-DropboxLoader_analysis.md", "2016-09-08 - Doctor Web discovers Linux Trojan written in Rust.pdf", "2016-06-15 - Bears in the Midst- Intrusion into the Democratic National Committee.pdf", "2016-05-03 - The Continuing Evolution of Samas Ransomware.pdf", "2016-09-11 - Free Darktrack RAT Has the Potential of Being the Best RAT on the Market Search.pdf", "https://cert.gov.ua/article/37704", "https://thehackernews.com/2022/05/malware-analysis-trickbot.html", "Asruex.pdf", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "2016-10-03 - Polyglot \u2013 the fake CTB-locker.pdf", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "2016-01-22 - Sykipot APT Malware.pdf", "https://securelist.com/apt-luminousmoth/103332/", "https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/", "2016-05-02 - Prince of Persia- Infy Malware Active In Decade of Targeted Attacks.pdf", "2016-08-04 - Iran Threats Webpage.pdf", "2016-06-17 - ScarCruft APT Group Used Latest Flash Zero Day in Two Dozen Attacks.pdf", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "https://www.crowdstrike.com/en-us/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/", "2016-01-01 - Die erste Ransomware in JavaScript- Ransom32.pdf", "2016-07-21 - Phishing Attacks Employ Old but Effective Password Stealer.pdf", "2016-05-26 - SWIFT attackers\u2019 malware linked to more financial attacks.pdf", "https://unit42.paloaltonetworks.com/cobalt-strike-metadata-encoding-decoding/", "2016-02-03 - Emissary Trojan Changelog- Did Operation Lotus Blossom Cause It to Evolve-.pdf", "2016-11-22 - Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy.pdf", "Black Energy APT.pdf", "2016-09-06 - Buckeye cyberespionage group shifts gaze from US to Hong Kong.pdf", "2016-05-12 - Hancitor and Ruckguv Reappear, Updated and With Vawtrak On Deck.pdf", "2016-09-20 - Hackers lurking, parliamentarians told.pdf", "2016-03-01 - Taiwan Presidential Election- A Case Study on Thematic Targeting.pdf", "2016-12-14 - Kaspersky Security Bulletin 2016. Review of the year. Overall statistics for 2016.pdf", "https://www.threatdown.com/blog/a-multi-stage-powershell-based-attack-targets-kazakhstan/", "2016-04-16 - Ever Present Persistence - Established Footholds Seen in the Wild.pdf", "https://cocomelonc.github.io/tutorial/2022/05/09/malware-pers-4.html", "2016-10-04 - OilRig Malware Campaign Updates Toolset and Expands Targets.pdf", "https://thedfirreport.com/2021/05/12/conti-ransomware/", "https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/", "2016-12-07 - The TrickBot Evolution.pdf", "2016-03-31 - Stored XSS Vulnerabilites on Foscam.pdf", "https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a/", "https://contagiodump.blogspot.com/2017/02/russian-apt-apt28-collection-of-samples.html", "2016-09-11 - BUZZDIRECTION- BLATSTING reloaded.pdf", "2016-10-24 - Evasive Malware Detects and Defeats Virtual Machine Analysis.pdf", "https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html", "2016-06-03 - Cooking Up Autumn (Herbst) Ransomware.pdf", "2016-07-08 - Investigating the LuminosityLink Remote Access Trojan Configuration.pdf", "2016-08-23 - Russian hackers 'Fancy Bear' likely breached Olympic drug-testing agency and DNC, experts say.pdf", "https://www.guidepointsecurity.com/blog/from-zloader-to-darkside-a-ransomware-story/", "2016-09-09 - GOVRAT V2.0 - Attacking US military and government.pdf", "2016-12-09 - Now Mirai Has DGA Feature Built in.pdf", "2016-09-28 - Highly Evasive Code Injection Awaits User Interaction Before Delivering Malware.pdf", "https://cloud.google.com/blog/topics/threat-intelligence/shining-a-light-on-darkside-ransomware-operations/", "Cisco HayStack.pdf", "https://istrosec.com/blog/apt-sk-cobalt/", "https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/", "2016-07-12 - Me and Mr. Robot- Tracking the Actor Behind the MAN1 Crypter.pdf", "2016-04-01 - Petya \u2013 Taking Ransomware To The Low Level.pdf", "2016-05-23 - Technical Report about the Malware used in the Cyberespionage against RUAG.pdf", "https://www.security.com/threat-intelligence/solarwinds-raindrop-malware", "2016-04-13 - Ghosts in the Endpoint.pdf", "https://www.lac.co.jp/lacwatch/report/20210521_002618.html", "2016-06-25 - SectorC08- Multi-Layered SFX in Recent Campaigns Target Ukraine.pdf", "2016-02-12 - Security Alert- Mazar BOT \u2013 the Android Malware That Can Erase Your Phone.pdf", "2016-09-22 - Zeus Delivered by DELoader to Defraud Customers of Canadian Banks.pdf", "2016-06-08 - Spear Phishing Attacks- Why They are Successful and How to Stop Them.pdf", "2016-04-08 - CryptoHost Decrypted Locks files in a password protected RAR File.pdf", "APT-C-09 (2).pdf", "https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/", "2016-11-15 - CryptoLuck Ransomware being Malvertised via RIG-E Exploit Kits.pdf" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "Adversary Profile: Salt Typhoon Alignment The architectural gap identified by mudoSO mirrors the act", "Threat" ], "malware_families": [ "Ryuk", "Win api", "Microbackdoor", "Win32.bitcoinminer", "Socgholish netsupport", "Beacon", "Shadowpad", "Doorme", "Matanbuchus", "Primary threat", "Generic.933739", "Conti", "Nbtscan", "Kronos", "Frp", "Grimplant", "Credomap", "Cyclops", "Fancybear", "Threat analysis", "Elf", "Darkside", "Pcap", "Avoslocker", "Gold blackburn", "Graphsteel", "Plugx", "Socgholish", "Threat", "Gootloader", "Bazarloader", "Cozybear", "Handleref", "Apt29", "Netsupport", "Win32.agent", "Ransomhub", "Trickbot", "Hades", "Bumblebee", "Stellarparticle", "Cobalt strike", "Raspberry robin", "Shadow chaser", "Beaconloader" ], "industries": [ "Military", "Banking", "Financial", "Telecommunications", "Academics", "Aerospace", "Energy", "Political", "Media", "Industrial", "Gas", "Defense", "Technology", "Aviation", "Manufacturing", "Transport", "Foreign affairs", "Pharmaceutical", "Transportation", "Legal", "Diplomatic", "Logistics", "Legal, financial, healthcare, government, municipal, real-estate, enterprise-technology, critical-in", "Government" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "69f46a108000bd36fe90d5be", "name": "APT29", "description": "In the latest episode of the LNK forensic analysis series, we look at how a malicious file was linked to a Chinese-speaking threat actor, who then modified the file to target a powershell program.", "modified": "2026-05-31T06:03:25.904000", "created": "2026-05-01T08:53:34.200000", "tags": [ "sha1", "ipv4", "sha256", "n cobalt", "n https", "strong", "rararchive", "backdoor", "n c2", "cobalt strike", "guloader", "cobaltstrike", "cobalt", "downloader", "april", "icedid", "dropper", "june", "trickbot", "donut", "fast", "payload", "unknown", "delphi", "noname", "anydesk", "blister", "quasar", "winnti", "somnia", "qakbot", "gogo", "netwire", "chrysalis", "download", "exploit", "netspy", "loader", "ursnif", "themida", "vidar", "doublezero", "voldemort", "next", "meterpreter", "tencent", "plugx", "shadow", "batloader", "redline stealer", "havoc", "resident", "decoy", "dump", "shellcode", "infostealer", "appe", "bumblebee", "emotet", "syscall", "acidrain", "credomap", "cozyduke", "ukraine", "daveshell", "cont", "refer", "fail", "first", "snake", "mega", "onlin", "grayrabbit", "open", "power", "august", "test", "path", "mimikatz", "nbtscan", "impacket", "comment", "install", "redline", "comet", "autoit", "wiper", "endurance", "sharphound", "psexec", "malicious", "service", "wind", "installer", "info", "confi", "remcosrat", "hermeticwiper", "isaacwiper", "graphsteel", "caddywiper", "grimplant", "industroyer2", "defense", "energy", "telecom", "media", "grapeloader", "wineloader", "envyscout", "sunburst", "panda", "metasploit", "sparkrat", "zbot", "darkgate", "finspy", "rhadamanthys", "warmcookie", "trojanspy", "diceloader", "asyncrat", "esxiargs", "webshell", "cerber", "azorult", "lokibot", "blackcat", "poortry", "cuba", "malcat", "ctrlt", "transform", "bazaar", "virustotal", "window", "pdf document", "iit app", "tools", "lucky", "injector", "handleref", "temp", "conti", "groupexchange", "group400", "grouprevil", "revilconti", "providerpath", "regexpandsz", "minidump", "groupuchebkac", "malware", "bypass", "adfind", "threat", "command", "procdump", "seatbelt", "below", "anydesk remote", "lsass", "powershell", "cookie", "android", "null", "sliver", "initial access", "code", "defender", "defense evasion", "enterprise", "powerview", "pipes", "cloud", "date", "poison", "advantage", "mind", "designer", "shell", "projector libra", "bazarloader", "figure", "file size", "transferxl", "palo alto", "iso image", "windows", "wildfire", "february", "alliance", "bazarbackdoor", "bokbot", "diavol", "shown", "hook", "threat spotlight", "manjusaka", "c2 server", "appliance", "cisco talos", "golang", "haixi mongol", "prefecture", "talos", "rust", "agent", "win64", "hello", "xor algorithms", "z85 ascii85", "base85", "ascii85", "compile", "z85 https", "threat analysis", "primary threat", "elf", "strike payload", "uri http", "post body", "lockbit", "sentinellabs", "c curl", "ip address", "lockbit black", "cyber threats", "investigations", "research", "expert perspective", "articles", "news", "reports", "learn", "trend vision", "vision one", "gootkit", "trend micro", "amsi telemetry", "micro", "gootkit loader", "security", "stop", "find", "life", "operations", "protect", "small", "carriers", "voice", "attack", "suncrypt", "revil", "sodinokibi", "kronos", "korean", "createobject", "javascript", "ascii value", "opens", "urls", "color1", "python script", "gootloader", "twitter", "python", "unc1151", "microbackdoor", "beacon", "base64", "github", "run registry", "putty", "persistence", "discord", "blackenergy", "state", "uac0056", "detection", "threatdown", "cybercrime has", "machinescale", "response", "nebula", "indirizzo", "il file", "questo cert", "italia", "il messaggio", "allegato", "covid19", "file pdf", "html", "serbia", "stata", "file location", "https traffic", "thursday", "windows host", "wireshark", "emotet run", "pakistan", "ttps", "shadowpad", "plugx backdoor", "kaspersky ics", "afghanistan", "malaysia", "march", "cert", "ntlm", "winrar", "assembly", "china chopper", "microsoft", "fancybear", "cozybear", "december", "strontium", "ransomhub", "matrix", "raspberry robin", "sofacy", "beatdrop", "quietexit", "cyclops", "knight", "bank", "facebook", "beer", "worm", "threat advisory", "ransomware", "threats", "securex", "avos", "unified access", "gateways", "avoslocker", "cisco secure", "vmware horizon", "darkcomet", "apt29", "nobelium", "stellarparticle", "shadow chaser", "file type", "sha256 hash", "html file", "pe32", "intel", "matanbuchus", "confluence", "data center", "server", "waf rule", "confluence data", "shut", "jars", "cvss", "update", "centerall", "mustang panda", "vietnam", "analyze", "dll file", "summary", "vincss", "vietnamese", "english", "unc2165", "evil corp", "fakeupdates", "dridex", "hades", "colorfake", "bitpaymer", "doppelpaymer", "wastedlocker", "megasync", "trojan", "payloadbin", "macaw", "cuba ransomware", "tor directory", "bughatch", "iis worker", "mare", "team", "zenpak", "impact", "mosquito", "exfiltration", "execution", "masquerading", "netsupport rat", "select", "script", "hash", "press enter", "http", "activexobject", "lnk file", "socgholish", "servhelper", "fakeupdate", "model", "socgholish netsupport", "netsupport", "ta551", "ryuk", "threat actor", "hta file", "trickbot c2", "sonatype", "drops cobalt", "strike", "pymafka", "open source", "contact us", "macos", "nexus", "demo", "protected", "friday", "gold blackburn", "ahnlab", "was1", "was2", "dc server", "coinminer", "ntlm hash", "january", "ad group", "darkside", "miner", "win32.bitcoinminer", "win32.agent", "frp", "transferxl url", "iso file", "bumblebee c2", "file name", "exotic lily", "transferxl urls", "function", "dropbox", "c2 dropbox", "c2clientmain", "filename", "av evasion", "syswhispers2", "dropbox loader", "stream", "mark", "back", "pcap", "ta578", "contact forms", "images evidence", "windows service", "main entry", "a service", "service main", "entry point", "windows context", "administrator", "concept", "https", "lazagne", "setmppreference", "use ie", "msie", "windows nt", "bloodhound", "wmiexec", "covenant", "empire", "poshc2", "organization", "cleanup", "winscp", "dword", "netscan", "http c2", "base64url", "c2 traffic", "netbios", "teamserver", "mask", "legezo", "windows event", "denis legezo", "september", "silent break", "windows system", "rc4 encryption", "sysdig", "plugx implant", "myanmar", "russia", "hong kong", "reddelta", "belarus", "digital certificates", "fileless malware", "malware descriptions", "malware technologies", "rat trojan", "targeted attacks", "silentbreak", "throwback", "linode", "slingshot", "inject", "patch", "magic", "mozilla", "false", "\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "\u30de\u30af\u30cb\u30ab\u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u30b9", "word", "stager", "url https", "windows10", "dll sideloading", "ida pro", "darkhotel", "oceanlotus", "mandiant", "boommic", "group policy", "smb beacon", "trello", "kerberos", "pass", "vaporrage", "platform sha256", "urls http", "unc2452", "opsec", "scale", "apt29 activity", "apt29 conduct", "global func", "vmware xfer", "edrepp", "vmware command", "dfir team", "abcd", "stealbit", "stdout", "hooks", "logic", "dfir report", "icedid malware", "icedid payload", "pty ltd", "goodware", "string", "desktop", "morphisec", "vmware identity", "morphisec labs", "core impact", "vmware", "workspace one", "access", "cve202222957", "cve202222958", "fortune", "jssloader", "stark", "moving", "please", "virtualbox", "registry", "windows logon", "hive", "varonis", "ai security", "proxyshell", "detect", "data risk", "google cloud", "trust", "varonis threat", "contact", "qbot", "void", "police", "pysa", "chisel", "files", "where", "pysa ransomware", "redacted", "force", "getchilditem", "aes key", "szdrf", "mespinoza", "target", "winapi", "edr hooks", "winapi call", "endpoint", "tracing", "api call", "direct system", "phase", "import", "outflank", "dll payload", "bumblebee dll", "programdata", "orion", "strings", "example", "zloader", "eset research", "atera agent", "eset", "aitb", "eset security", "tips", "silent", "night", "botnet", "teamviewer", "atera", "capture", "grantedaccess", "computer", "lsass memory", "targetimage", "sourceimage", "simulate", "atomic", "karakurt", "view", "hacking team", "sign", "contributors", "from karakurt", "appearance", "manage", "write", "star", "stars", "ruby", "footer", "birdwatch", "fin7", "easylook", "unc3381", "powerplant", "crowview", "boatlaunch", "stoneboat", "fowlgaze", "uuid variant", "hell", "ipfuscation", "james haughom", "ipfuscated", "gate variant", "gate", "rubeus", "wow64", "cp1250", "uuids", "touch", "blob", "hwinithlw", "sphw", "shathak", "conti affiliate", "valentine", "favorite", "rats", "ragnarlocker", "hellokitty", "squirrelwaffle", "uris", "http get", "post", "http post", "c2 profile", "accept", "vnc activity", "ms windows", "go downloader", "unc2589", "ta471", "sentinelone", "module stomp", "return address", "cobalt strikes", "rtlallocateheap", "use section", "dlls", "first detection", "apt41", "dustpan", "cve202144207", "cve202144228", "log4shell", "vmprotect", "deadeye", "keyplug", "filler", "confuserex", "badpotato", "task manager", "lsass process", "cisa", "bazar", "hancitor", "splashtop", "kportscan", "story", "emotet payload", "excel", "appdatalocal", "november", "emotet campaign", "vba macro", "cybercrime", "cybersecurity architect", "threat research", "jarm signature", "sha2", "jarm", "salesforce", "epoch", "emotet core", "epochs", "conti group", "emotet epoch", "trickbot group", "prior", "threat response", "unit", "socs", "hunters", "cyber", "mssql", "mssql server", "lemon duck", "asec analysis", "account", "kingminer", "vollgar", "mssql process", "cve20201472", "reg add", "regdword", "makes", "et exploit", "core", "possible", "comspec", "tracker", "userdomain", "appdata", "hide", "vbscript", "exclusionpath", "userpcname", "ipcount", "gozi", "cybereason", "exchange", "datoploader", "cybereason xdr", "report", "phishing", "pinkslipbot", "theft", "beyond", "never", "malwarebazaar", "strike activity", "filejust", "file contentsi", "vscode", "sublime editor", "windows exe", "utf8", "turla", "root", "msoffice", "nativezone", "kazuar", "bluenoroff", "customerloader", "muddywater", "chat", "overwatch", "aquatic panda", "log4j", "linux", "apache tomcat", "crowdstrike", "github project", "click", "fishmaster", "yanluowang", "thieflock", "scanner", "canthroid", "grabff", "symantec", "connectwise", "screenconnect", "fivehands", "browserpassview", "rundll32", "sharefinder", "wmic", "ping", "rollcoast", "south africa", "unc2190", "july", "tycoon", "unc2190 beacon", "latin", "arcane", "sabbath", "slovak", "slovakia", "albanian", "albania", "swedish", "turkish", "indonesia", "estonia", "armenia", "c2 data", "cyberchef", "javascript code", "rsa key", "remove", "get request", "xor key", "exploits & vulnerabilities", "managed xdr", "one marketplace", "lockfile", "attack overview", "stage", "conti gang", "datop", "handover", "kazakhstan", "os version", "winrm", "protocol", "enterpssession", "psrp", "windows remote", "source process", "stack", "rita", "threat feed", "myrtus", "harvester", "c activity", "artefactsfolder", "identity", "infectionid", "october", "main", "ad environment", "bazar c2", "networks", "d3desdecrypt", "nim malware", "jason", "part", "reaves6 min", "nimrodnimza", "rustybuer", "nimgrabber", "caesar", "file encryption", "nimrev", "discovery", "data", "mitre att", "powersploit", "leverage", "beaconloader", "doorme backdoor", "issuer cus", "apt group", "chamelgang", "doorme", "mcafee", "timestomp", "copy", "oilrig", "error", "body", "eternalblue", "zip file", "enable", "content", "vbs script", "word document", "maldoc", "form", "win api", "bazarloader dll", "intro conti", "coveware", "raas", "ransom", "ryuk ransomware", "cve202140444", "multiple", "north america", "europe", "asia", "html object", "mshtml engine", "sidewalk", "crosswalk", "c server", "sparklinggoblin", "google docs", "winnti group", "format", "darkshell", "motnug", "threat-intelligence", "apt", "nsa", "def con", "iso filesystem", "iocs", "recon village", "leviathan", "encrypt", "prophet spider", "oracle weblogic", "exception", "weblogic access", "class", "linux system", "egregor", "mountlocker", "radar", "front", "gotroj", "encoder", "stealer", "soar", "speed", "prophet", "classloader", "reconnaissance", "tech", "recon", "et cnc", "feodo tracker", "cnc server", "trigger", "alive", "spawn", "method", "http method", "jitter", "port", "beacon type", "later", "close", "browser", "chinese-speaking cybercrime", "google chrome", "microsoft word", "spear phishing", "luminousmoth", "honeymyte", "assistant", "username", "motc", "ministry", "local", "xll file", "docusign", "hancitor dll", "hancitor exe", "ficker stealer", "api hashing", "api hash", "monpass", "avast", "monpass client", "monpass web", "mongolia", "jan rubn", "discovered", "initial contact", "final", "watermark", "chanitor", "pony", "vawtrak", "uwaga", "falcon complete", "falcon", "wizard spider", "lime", "easy", "flex", "yahxz", "efno", "unc2465", "ngrok", "ultravnc", "methodology", "ngrok tunnel", "smokedham", "guard", "dllstageless", "submission", "size", "noblebaron", "itw name", "scout", "elite", "containedwithin", "withheld", "relatedto", "strike beacon", "matches no", "privacy", "description", "entropy", "restrict", "host ip", "owner", "igos", "germany", "file", "type", "artemis", "rozena", "razy", "khalesi", "\u30c7\u30b8\u30bf\u30eb\u7f72\u540d", "cobalt strike loader", "\u6a19\u7684\u578b\u653b\u6483", "strike loader", "iocindicator", "microsoft docs", "2 cobalt", "3 sigcheck", "1 microsoftdll", "powershell rat", "macro", "progression", "hackerman", "robinhood", "scan behavioral", "unusual port", "potential scan", "campo loader", "dfdownloader", "japan", "post method", "openfield", "blacktds", "public", "behaviour", "variant", "malicious file", "transfer", "control", "feature", "fireeye", "plink", "campo", "bazarcall", "xyzcampobb hxxp", "ioc510", "urlcampo", "20214", "headlines", "tlds", "duck", "beapy", "prometei", "umbrella", "wdigest", "iceid", "networkminer", "caploader", "network forensics", "ja3", "x.509", "sslbl", "1768.py", "didier stevens", "8da75e1f974d1011c91ed3110a4ded38", "e9b5e549363fa9fcb362b606b75d131dec6c020e", "0314b8cd45b636f38d07032dc8ed463295710460ea7a4e214c1de7b0e817aab6", "banusdona.top", "172.67.188.12", "f98711dfeeab9c8b4975b2f9a88d8fea", "c2bdc885083696b877ab6f0e05a9d968fd7cc2bb", "213e9c8bf7f6d0113193f785cb407f0e8900ba75b9131475796445c11f3ff37c", "momenturede.fun", "104.236.115.181", "96a535122aba4240e2c6370d0c9a09d3", "485ba347cf898e34a7455e0fd36b0bcf8b03ffd8", "11965662e146d97d3fa3288e119aefb2", "b63d7ad26df026f6cca07eae14bb10a0ddb77f41", "d45b3f9d93171c29a51f9c8011cd61aa44fcb474d59a0b68181bb690dbbf2ef5", "vaccnavalcod.website", "mazzappa.fun", "ameripermanentno.website", "odichaly.space", "83.97.20.176", "452e969c51882628dac65e38aff0f8e5ebee6e6b", "lesti.net", "185.141.26.140", "449c1967d1708d7056053bedb9e45781", "1ab39f1c8fb3f2af47b877cafda4ee09374d7bd3", "c7da494880130cdb52bd75dae1556a78f2298a8cc9a2e75ece8a57ca290880d3", "45.147.229.157", "1580103814", "luckymouse", "emissary panda", "apt 27", "apt27", "a0e9f5d64349fb13191bc781f81f42e1", "3b5074b1b5d032e5620f69f9f700ff0e", "erik hjelmvik", "monday", "openssl", "michael", "bazaloader", "anchor", "alex", "header", "getoperandvalue", "win32", "build", "trickbot crews", "cs loader", "trickbots cs", "trickbots crew", "google drive", "hancitor c2", "icmp", "dcdomainname", "dclocal", "base", "cnbuiltin", "cnusers", "security groups", "bitcoin", "sage", "svchost", "bits", "beacon dll", "started service", "beacon payload", "process hacker", "sleepex", "identifies", "crph", "smadavprotect32", "cec list", "meeting", "dll library", "ta800", "nim programming", "nimzaloader", "doesn", "json object", "c url", "trustinfo", "displayname", "dpiaware", "anchordns", "enjoy", "nimrod", "gecko", "khtml", "offensivenim", "sharpkatz", "crypter", "done", "sprite spider", "carbon spider", "esxi", "spider", "defray777", "pyxie", "hypervisor", "defray", "ransomexx", "sekur", "anunak", "harpy", "griffon", "unc2198", "maze", "maze ransomware", "file transfer", "mouseisland", "koadic", "photoloader", "ocean lotus", "mac os", "kerrdown", "human", "kerrdown sample", "macho", "tcp port", "systembc", "http traffic", "hatching triage", "directory", "endpoint1", "ryuk threat", "raindrop", "teardrop", "decrypt", "raindrop loader", "name file", "pl shellcode", "funnyswitch", "chm file", "config", "frombase64", "azaz09", "nltest", "regwrite", "exitendifif", "sleep", "regsz", "stwashington", "lredmond", "dircreate", "protection", "defenderspynet", "john", "doublepulsar", "amadey", "zeppelin", "apt & targeted attacks", "earth wendigo", "service worker", "xss attack", "domain", "learn more", "ck technique", "techniques", "emerging threat", "solarwinds", "breach", "dora", "pioneer", "solarstorm", "cortex xdr", "iot security", "atom", "supernova", "yara", "snort", "gap analysis", "keefarce", "safetykatz", "gadgettojscript", "sharpzerologon", "tuesday", "qakbot binary", "qakbot malspam", "qakbot malware", "windows binary", "malspam", "egregor payload", "threat alert", "sekhmet", "platform", "monitoring", "chacha", "notpetya", "bad rabbit", "internet", "tls server", "tls client", "server hello", "ja3s", "hello packet", "apache", "random", "vatet", "localappdata", "epochtime", "rapid7", "cash", "logmein", "swift", "radmin", "bazar loader", "highest", "certificate", "issuer org", "over", "ryuk domain", "infrastructure", "namecheap", "ryuk host", "monovm", "olol", "gnu c", "o2 o2", "marchx8664 g", "g o2", "sttx", "ltexas", "ooffice", "name", "basecamp", "userinit", "hack", "snow", "apt19", "yara rule", "chimera", "pe header", "vhash", "lpwstr lpbuffer", "startw", "request", "netwalker", "neshta", "mailto", "thor", "xmrig", "teamt5", "threatsonar anti-ransomware", "threatsonar", "threatvision", "cyber espionage", "ransom virus", "tt", "cyber threat hunters", "cyber espionage solutions", "threat analysis service", "incident response", "investigation services", "threat intelligence", "md5 hash", "softether", "domain teamt5", "teamt5 teamt5", "plead", "pastebin", "travelex", "pos software", "gandcrab", "rat", "indigodrop", "msf shellcode", "msf downloader", "urlshxxp", "stages", "threatlabz", "india-china", "zscaler cloud", "dkmc framework", "gif header", "dkmc", "sandbox report", "publickey", "sandbox", "ntds", "beacon version", "console", "file creation", "file deletion", "rename", "or filefullname", "coronavirus", "tvrat", "gozi malware", "js file", "wscript", "msbuild", "msbuild project", "silent trinity", "threat grid", "lolbins", "cisco threat", "msbuild process", "naga", "trinity", "dos header", "sfx code", "sfx file", "export function", "mz header", "open process", "set current", "create", "apt2019", "2019 payload", "lnklnklnklnk", "1 docvbavbavba", "dllentry rat", "operation pawn", "storm", "midst intrusion", "pawn storm", "xtunnel", "hidedrv", "aurora", "blackshades", "conficker", "chapro", "dark comet", "dexter", "duqu", "gauss", "bridge", "hikit", "makadocs", "medre", "morto", "narilam", "onionduke", "rustock", "dorkbot", "spyeye", "stabuniq", "stuxnet", "tinba", "vobfus", "zeroaccess", "zeus", "zusy", "committee", "dnc network", "trump", "dnc hack", "donald trump", "neither", "general", "hill", "magazine", "mexico", "winids", "foozer", "downrage", "hydra", "remcom", "inc\\.", "bear", "wirelurker", "generic.933739", "python code", "zxkbdklakv", "seaduke", "cookie value", "bookmark server", "p4bnzr0", "duke" ], "references": [ "https://malcat.fr/blog/lnk-forensic-and-config-extraction-of-a-cobalt-strike-beacon/", "https://mp.weixin.qq.com/s/cGS8FocPnUdBconLbbaG-g", "https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/", "https://unit42.paloaltonetworks.com/bumblebee-malware-projector-libra/", "https://blog.talosintelligence.com/manjusaka-offensive-framework/", "https://cocomelonc.github.io/malware/2022/07/30/malware-av-evasion-8.html", "https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/", "https://www.trendmicro.com/en_us/research/22/g/gootkit-loaders-updated-tactics-and-fileless-delivery-of-cobalt-strike.html", "https://blog.nviso.eu/2022/07/20/analysis-of-a-trojanized-jquery-script-gootloader-unleashed/", "https://cloud.google.com/blog/topics/threat-intelligence/spear-phish-ukrainian-entities/", "https://www.threatdown.com/blog/cobalt-strikes-again-uac-0056-continues-to-target-ukraine-in-its-latest-campaign/", "https://cert.gov.ua/article/703548", "https://cert-agid.gov.it/news/il-malware-envyscout-apt29-e-stato-veicolato-anche-in-italia/", "https://isc.sans.edu/diary/Emotet%20infection%20with%20Cobalt%20Strike/28824", "https://cert.gov.ua/article/619229", "https://ics-cert.kaspersky.com/publications/reports/2022/06/27/attacks-on-industrial-control-systems-using-shadowpad/", "https://blog.bushidotoken.net/2022/06/overview-of-russian-gru-and-svr.html", "https://blog.talosintelligence.com/avoslocker-new-arsenal/", "https://isc.sans.edu/diary/rss/28752", "https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html", "https://kienmanowar.wordpress.com/2022/06/04/quicknote-cobaltstrike-smb-beacon-analysis-2/", "https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions", "https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis", "https://medium.com/walmartglobaltech/socgholish-campaigns-and-initial-access-kit-4c4283fea8ee", "https://thehackernews.com/2022/05/malware-analysis-trickbot.html", "https://www.sonatype.com/blog/new-pymafka-malicious-package-drops-cobalt-strike-on-macos-windows-linux", "https://asec.ahnlab.com/en/34549/", "https://isc.sans.edu/diary/Bumblebee+Malware+from+TransferXL+URLs/28664", "https://raw.githubusercontent.com/Dump-GUY/Malware-analysis-and-Reverse-engineering/refs/heads/main/APT29_C2-Client_Dropbox_Loader/APT29-DropboxLoader_analysis.md", "https://redcanary.com/wp-content/uploads/2022/05/Gootloader.pdf", "https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf", "https://isc.sans.edu/diary/28636", "https://cocomelonc.github.io/tutorial/2022/05/09/malware-pers-4.html", "https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/", "https://unit42.paloaltonetworks.com/cobalt-strike-metadata-encoding-decoding/", "https://thehackernews.com/2022/05/this-new-fileless-malware-hides.html", "https://blog.talosintelligence.com/mustang-panda-targets-europe/", "https://securelist.com/a-new-secret-stash-for-fileless-malware/106393/", "https://security.macnica.co.jp/blog/2022/05/iso.html", "https://cloud.google.com/blog/topics/threat-intelligence/tracking-apt29-phishing-campaigns/", "https://documents.trendmicro.com/assets/txt/earth-berberoka-windows-iocs-2.txt", "https://cert.ssi.gouv.fr/uploads/20220427_NP_TLPWHITE_ANSSI_FIN7.pdf", "https://cloud.google.com/blog/topics/threat-intelligence/unc2452-merged-into-apt29/", "https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/", "https://thedfirreport.com/2022/04/25/quantum-ransomware/", "https://www.morphisec.com/blog/vmware-identity-manager-attack-backdoor/", "https://cocomelonc.github.io/tutorial/2022/04/20/malware-pers-1.html", "https://www.varonis.com/blog/hive-ransomware-analysis", "https://www.sentinelone.com/blog/from-the-front-lines-peering-into-a-pysa-ransomware-attack/", "https://vanmieghem.io/blueprint-for-evading-edr-in-2022/", "https://www.cynet.com/blog/orion-threat-alert-flight-of-the-bumblebee/", "https://www.welivesecurity.com/2022/04/13/eset-takes-part-global-operation-disrupt-zloader-botnets/", "https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html", "https://github.com/infinitumitlabs/Karakurt-Hacking-Team-CTI", "https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/", "https://www.sentinelone.com/blog/hive-ransomware-deploys-novel-ipfuscation-technique/", "https://medium.com/walmartglobaltech/cobaltstrike-uuid-stager-ca7e82f7bb64", "https://resource.redcanary.com/rs/003-YRU-314/images/2022_ThreatDetectionReport_RedCanary.pdf", "https://www.esentire.com/blog/conti-affiliate-exposed-new-domain-names-ip-addresses-and-email-addresses-uncovered-by-esentire", "https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/", "https://isc.sans.edu/diary/Qakbot+infection+with+Cobalt+Strike+and+VNC+activity/28448", "https://www.sentinelone.com/blog/threat-actor-uac-0056-targeting-ukraine-with-fake-translation-software/", "https://www.arashparsa.com/catching-a-malware-with-no-name/", "https://cert.gov.ua/article/37704", "https://cloud.google.com/blog/topics/threat-intelligence/apt41-us-state-governments/", "https://thedfirreport.com/2022/03/07/2021-year-in-review/", "https://www.cynet.com/security-foundations/attack-techniques/new-wave-of-emotet-when-project-x-turns-into-y/", "https://www.fortinet.com/blog/threat-research/nobelium-returns-to-the-political-world-stage", "https://cyber.wtf/2022/03/23/what-the-packer/", "https://www.esentire.com/blog/icedid-to-cobalt-strike-in-under-20-minutes", "https://asec.ahnlab.com/en/31811/", "https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/", "https://medium.com/walmartglobaltech/signed-dll-campaigns-as-a-service-7760ac676489", "https://www.cybereason.com/blog/research/threat-analysis-report-datoploader-exploits-proxyshell-to-deliver-qbot-and-cobalt-strike", "https://forensicitguy.github.io/inspecting-powershell-cobalt-strike-beacon/", "https://blog.sekoia.io/nobeliums-envyscout-infection-chain-goes-in-the-registry-targeting-embassies/", "https://www.crowdstrike.com/en-us/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/", "https://www.security.com/threat-intelligence/yanluowang-ransomware-attacks-continue", "https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/", "https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/", "https://blog.nviso.eu/2021/11/17/cobalt-strike-decrypting-obfuscated-traffic-part-4/", "https://www.trendmicro.com/en_gb/research/21/k/analyzing-proxyshell-related-incidents-via-trend-micro-managed-x.html", "https://www.truesec.com/hub/blog/proxyshell-qbot-and-conti-ransomware-combined-in-a-series-of-cyber-attacks", "https://www.threatdown.com/blog/a-multi-stage-powershell-based-attack-targets-kazakhstan/", "https://www.unh4ck.com/detection-engineering-and-threat-hunting/lateral-movement/detecting-conti-cobaltstrike-lateral-movement-techniques-part-1", "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-009.pdf", "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/", "https://www.security.com/threat-intelligence/harvester-new-apt-attacks-asia", "https://unit42.paloaltonetworks.com/bazarloader-network-reconnaissance/", "https://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-part-2-a28bffffa671", "https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/", "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/new-apt-group-chamelgang/#id3", "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/new-apt-group-chamelgang/", "https://www.cynet.com/security-foundations/attack-techniques/understanding-squirrelwaffle/", "https://thedfirreport.com/2021/09/13/bazarloader-to-conti-ransomware-in-32-hours/", "https://blog.gigamon.com/2021/09/10/rendering-threats-a-network-perspective/", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf", "https://documents.trendmicro.com/assets/white_papers/wp-earth-baku-an-apt-group-targeting-indo-pacific-countries.pdf", "https://www.welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/", "https://istrosec.com/blog/apt-sk-cobalt/", "https://www.crowdstrike.com/en-us/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/", "https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/", "https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/", "https://securelist.com/apt-luminousmoth/103332/", "https://isc.sans.edu/diary/rss/27618", "https://www.gendigital.com/blog/insights/research/decoding-cobalt-strike-understanding-payloads", "https://www.gendigital.com/blog/insights/research/backdoored-client-from-mongolian-ca-monpass", "https://thedfirreport.com/2021/06/28/hancitor-continues-to-push-cobalt-strike/", "https://www.crowdstrike.com/en-us/blog/how-falcon-complete-disrupts-ecrime-operators-wizard-spider/", "https://thedfirreport.com/2021/06/20/from-word-to-lateral-movement-in-1-hour/", "https://cloud.google.com/blog/topics/threat-intelligence/darkside-affiliate-supply-chain-software-compromise", "https://www.sentinelone.com/labs/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/", "https://www.cisa.gov/news-events/analysis-reports/ar21-148a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-148a", "https://www.lac.co.jp/lacwatch/report/20210521_002618.html", "https://www.ncsc.gov.ie/pdfs/HSE_Conti_140521_UPDATE.pdf", "https://www.guidepointsecurity.com/blog/from-zloader-to-darkside-a-ransomware-story/", "https://thedfirreport.com/2021/05/12/conti-ransomware/", "https://mal-eats.net/en/2021/05/11/campo_new_attack_campaign_targeting_japan/", "https://cloud.google.com/blog/topics/threat-intelligence/shining-a-light-on-darkside-ransomware-operations/", "https://mal-eats.net/2021/05/10/campo_new_attack_campaign_targeting_japan/", "https://blog.talosintelligence.com/lemon-duck-spreads-wings/", "https://thedfirreport.com/2021/05/02/trickbot-brief-creds-and-beacons/", "https://www.netresec.com/?page=Blog&month=2021-04&post=Analysing-a-malware-PCAP-with-IcedID-and-Cobalt-Strike-traff", "https://isc.sans.edu/diary/27308", "https://medium.com/walmartglobaltech/trickbot-crews-new-cobaltstrike-loader-32c72b78e81c", "https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/", "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/", "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures", "https://www.qurium.org/alerts/targeted-malware-against-crph/", "https://www.proofpoint.com/us/blog/threat-insight/nimzaloader-ta800s-new-initial-access-malware", "https://thedfirreport.com/2021/03/08/bazar-drops-the-anchor/", "https://medium.com/walmartglobaltech/investigation-into-the-state-of-nim-malware-14cc543af811", "https://www.crowdstrike.com/en-us/blog/carbon-spider-sprite-spider-target-esxi-servers-with-ransomware/?utm_campaign=blog&utm_medium=soc&utm_source=twtr&utm_content=sprout", "https://cloud.google.com/blog/topics/threat-intelligence/melting-unc2198-icedid-to-ransomware-operations/", "https://raw.githubusercontent.com/AmnestyTech/investigations/refs/heads/master/2021-02-24_vietnam/README.md", "https://isc.sans.edu/diary/Excel+spreadsheets+push+SystemBC+malware/27060", "https://thedfirreport.com/2021/01/31/bazar-no-ryuk/", "https://www.security.com/threat-intelligence/solarwinds-raindrop-malware", "https://global.ptsecurity.com/en/research/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/", "https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/", "https://medium.com/walmartglobaltech/man1-moskal-hancitor-and-a-side-of-ransomware-d77b4d991618", "https://www.trendmicro.com/en_us/research/21/a/earth-wendigo-injects-javascript-backdoor-to-service-worker-for-.html", "https://www.picussecurity.com/resource/blog/ttps-used-in-the-solarwinds-breach", "https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/", "https://unit42.paloaltonetworks.com/fireeye-red-team-tool-breach/", "https://isc.sans.edu/diary/rss/26862", "https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations-wp.pdf", "https://i.blackhat.com/eu-20/Wednesday/eu-20-Clarke-Its-Not-FINished-The-Evolving-Maturity-In-Ransomware-Operations.pdf", "https://www.cybereason.com/blog/cybereason-vs-egregor-ransomware", "https://engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a/", "https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/5/", "https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/", "https://raw.githubusercontent.com/ThreatConnect-Inc/research-team/refs/heads/master/IOCs/WizardSpider-UNC1878-Ryuk.csv", "https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/", "https://cloud.google.com/blog/topics/threat-intelligence/kegtap-and-singlemalt-with-a-ransomware-chaser/", "https://raw.githubusercontent.com/StrangerealIntel/CyberThreatIntel/refs/heads/master/China/APT/Chimera/Analysis.md", "https://thedfirreport.com/2020/10/08/ryuks-return/", "https://thedfirreport.com/2020/08/31/netwalker-ransomware-in-1-hour/", "https://teamt5.org/tw/posts/mjib-holds-briefing-on-chinese-hackers-attacks-on-taiwanese-government-agencies/", "https://i.blackhat.com/USA-20/Thursday/us-20-Chen-Operation-Chimera-APT-Operation-Targets-Semiconductor-Vendors.pdf", "https://www.security.com/threat-intelligence/sodinokibi-ransomware-cobalt-strike-pos", "https://blog.talosintelligence.com/indigodrop-maldocs-cobalt-strike/", "https://www.zscaler.com/blogs/security-research/targeted-attack-leverages-india-china-border-dispute-lure-victims", "https://www.sentinelone.com/labs/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/", "https://thedfirreport.com/2020/04/24/ursnif-via-lolbins/", "https://blog.talosintelligence.com/building-bypass-with-msbuild/", "https://tccontre.blogspot.com/2019/11/cobaltstrike-beacondll-your-not.html", "https://web-assets.esetstatic.com/wls/2019/10/ESET_Operation_Ghost_Dukes.pdf", "https://mp.weixin.qq.com/s/xPsEXp2J5IE7wNSMEVC24A", "https://contagiodump.blogspot.com/2017/02/russian-apt-apt28-collection-of-samples.html", "https://www.cisa.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf", "https://www.crowdstrike.com/en-us/blog/bears-midst-intrusion-democratic-national-committee/", "https://blog-assets.f-secure.com/wp-content/uploads/2020/03/18122307/F-Secure_Dukes_Whitepaper.pdf", "https://contagiodump.blogspot.com/2014/11/onionduke-samples.html", "https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/" ], "public": 1, "adversary": "Threat", "targeted_countries": [ "Czechia", "Ukraine", "Russian Federation", "Poland", "Belarus", "Lithuania", "Latvia", "Germany", "Pakistan", "Afghanistan", "Malaysia", "Greece", "Italy", "T\u00fcrkiye", "Portugal", "Brazil", "China", "Japan", "Korea, Republic of", "United States of America", "Mexico", "New Zealand", "Canada", "Georgia", "Iran, Islamic Republic of" ], "malware_families": [ { "id": "HandleRef", "display_name": "HandleRef", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Threat", "display_name": "Threat", "target": null }, { "id": "Primary Threat", "display_name": "Primary Threat", "target": null }, { "id": "BazarLoader", "display_name": "BazarLoader", "target": null }, { "id": "Bumblebee", "display_name": "Bumblebee", "target": null }, { "id": "ELF", "display_name": "ELF", "target": null }, { "id": "GootLoader", "display_name": "GootLoader", "target": null }, { "id": "Kronos", "display_name": "Kronos", "target": null }, { "id": "BEACON", "display_name": "BEACON", "target": null }, { "id": "MICROBACKDOOR", "display_name": "MICROBACKDOOR", "target": null }, { "id": "GRIMPLANT", "display_name": "GRIMPLANT", "target": null }, { "id": "GRAPHSTEEL", "display_name": "GRAPHSTEEL", "target": null }, { "id": "Shadowpad", "display_name": "Shadowpad", "target": null }, { "id": "PlugX", "display_name": "PlugX", "target": null }, { "id": "ShadowPad", "display_name": "ShadowPad", "target": null }, { "id": "Threat Analysis", "display_name": "Threat Analysis", "target": null }, { "id": "CredoMap", "display_name": "CredoMap", "target": null }, { "id": "StellarParticle", "display_name": "StellarParticle", "target": null }, { "id": "CozyBear", "display_name": "CozyBear", "target": null }, { "id": "Shadow Chaser", "display_name": "Shadow Chaser", "target": null }, { "id": "Raspberry Robin", "display_name": "Raspberry Robin", "target": null }, { "id": "RansomHub", "display_name": "RansomHub", "target": null }, { "id": "Cyclops", "display_name": "Cyclops", "target": null }, { "id": "FancyBear", "display_name": "FancyBear", "target": null }, { "id": "APT29", "display_name": "APT29", "target": null }, { "id": "AvosLocker", "display_name": "AvosLocker", "target": null }, { "id": "Matanbuchus", "display_name": "Matanbuchus", "target": null }, { "id": "HADES", "display_name": "HADES", "target": null }, { "id": "SocGholish NetSupport", "display_name": "SocGholish NetSupport", "target": null }, { "id": "SocGholish", "display_name": "SocGholish", "target": null }, { "id": "NetSupport", "display_name": "NetSupport", "target": null }, { "id": "Gold Blackburn", "display_name": "Gold Blackburn", "target": null }, { "id": "Conti", "display_name": "Conti", "target": null }, { "id": "Ryuk", "display_name": "Ryuk", "target": null }, { "id": "Trickbot", "display_name": "Trickbot", "target": null }, { "id": "Darkside", "display_name": "Darkside", "target": null }, { "id": "Win32.BitCoinMiner", "display_name": "Win32.BitCoinMiner", "target": null }, { "id": "Win32.Agent", "display_name": "Win32.Agent", "target": null }, { "id": "NbtScan", "display_name": "NbtScan", "target": null }, { "id": "Frp", "display_name": "Frp", "target": null }, { "id": "Pcap", "display_name": "Pcap", "target": null }, { "id": "BeaconLoader", "display_name": "BeaconLoader", "target": null }, { "id": "DoorMe", "display_name": "DoorMe", "target": null }, { "id": "Win API", "display_name": "Win API", "target": null }, { "id": "Generic.933739", "display_name": "Generic.933739", "target": null } ], "attack_ids": [], "industries": [ "Gas", "Government", "Defense", "Media", "Telecommunications", "Logistics", "Industrial", "Manufacturing", "Transport", "Transportation", "Diplomatic", "Foreign Affairs", "Academics", "Banking", "Aviation", "Political", "Energy", "Military", "Financial", "Legal", "Pharmaceutical", "Technology", "Aerospace" ], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "kikinumpav", "id": "385742", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3082, "FileHash-SHA1": 2478, "FileHash-SHA256": 4182, "URL": 3155, "CVE": 190, "SSLCertFingerprint": 41, "domain": 2991, "email": 58, "hostname": 2130, "YARA": 95 }, "indicator_count": 18402, "is_author": false, "is_subscribing": null, "subscriber_count": 14, "modified_text": "8 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698e93e1ab02db8c49e8c3ed", "name": "\u201cBroken Seal\u201d DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)", "description": "Forensic analysis indicates a DocuSign-themed phishing campaign using a deliberately invalid X.509 PKI seal (\u201cBroken Seal\u201d) to trigger fail-open verification logic in automated handlers. The delivery mechanism bypasses Secure Email Gateway (SEG) reputation checks by using encrypted channels and human-gated infrastructure. The payload is a fileless Process Hollowing (RunPE) malware that injects into RWX memory of legitimate processes to evade disk-based EDR.", "modified": "2026-05-17T15:52:35.396000", "created": "2026-02-13T03:00:49.872000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr", "My Independent research finds an intersect between different pdf DV versions being able to connect to Raspberry Pi devices as it was the FCC application document. Risk: Mac ID connectivity to all." ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28000, "FileHash-SHA256": 48374, "FileHash-MD5": 42596, "FileHash-SHA1": 23243, "hostname": 35654, "URL": 75758, "SSLCertFingerprint": 30, "CVE": 7585, "email": 316, "FileHash-IMPHASH": 8, "CIDR": 26205, "JA3": 1, "URI": 5, "IPv4": 574, "Mutex": 1 }, "indicator_count": 288350, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "13 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f4eba31a8adb1aa8e6654d", "name": "2016: Malware Analysis Report", "description": "", "modified": "2026-05-01T18:06:27.269000", "created": "2026-05-01T18:06:27.269000", "tags": [], "references": [ "2016-01-12 - The Magnificent FIN7- Revealing a Cybercriminal Threat Group.pdf", "2016-01-01 - Die erste Ransomware in JavaScript- Ransom32.pdf", "2016-01-12 - Trochilus RAT Evades Antivirus Detection, Used for Cyber-Espionage in South-East Asia.pdf", "2016-01-13 - Russian group behind 2013 Foreign Ministry hack.pdf", "2016-01-09 - Confirmation of a Coordinated Attack on the Ukrainian Power Grid.pdf", "2016-01-18 - Updated Blackmoon banking Trojan stays focused on South Korean banking customers.pdf", "2016-01-22 - PlugX APT Malware.pdf", "2016-01-21 - Android Spywaller- Firewall-Style Antivirus Blocking.pdf", "2016-01-22 - New Attacks Linked to C0d0so0 Group.pdf", "2016-01-22 - The Impact of Dragonfly Malware on Industrial Control Systems.pdf", "2016-01-24 - Scarlet Mimic- Years-Long Espionage Campaign Targets Minority Activists.pdf", "2016-01-25 - Hidden Tear Ransomware Developer Blackmailed by Malware Developers using his Code.pdf", "2016-01-23 - Imminent Monitor 4 RAT Analysis \u2013 A Glance.pdf", "2016-01-28 - BlackEnergy APT Attacks in Ukraine employ spearphishing with Word documents.pdf", "2016-01-28 - CenterPOS- An Evolving POS Threat.pdf", "2016-01-29 - From Linux to Windows \u2013 New Family of Cross-Platform Desktop Backdoors Discovered.pdf", "2016-01-29 - Malicious Office Files Dropping Kasidet And Dridex.pdf", "2016-02-03 - Emissary Trojan Changelog- Did Operation Lotus Blossom Cause It to Evolve-.pdf", "2016-01-22 - Sykipot APT Malware.pdf", "2016-02-05 - Vawtrak and UrlZone Banking Trojans Target Japan.pdf", "2016-02-08 - APT-style bank robberies increase with Metel, GCMAN and Carbanak 2.0 attacks.pdf", "2016-01-29 - VB2015 paper- It's A File Infector... It\u2019s Ransomware... It's Virlock.pdf", "2016-02-02 - Vipasana ransomware new ransom on the block.pdf", "2016-02-09 - DMA Locker Strikes Back.pdf", "2016-02-09 - Chinese Cyberspies Pivot To Russia In Wake Of Obama-Xi Pact.pdf", "2016-02-02 - DMA Locker- New Ransomware, But No Reason To Panic.pdf", "2016-02-12 - A Look Into Fysbis- Sofacy\u2019s Linux Backdoor.pdf", "2016-02-17 - Russian Police Prevented Massive Banking Sector Cyber Attack.pdf", "2016-02-09 - Bedep Lurking in Angler's Shadows.pdf", "2016-02-12 - Security Alert- Mazar BOT \u2013 the Android Malware That Can Erase Your Phone.pdf", "2016-02-09 - Poseidon Group- a Targeted Attack Boutique specializing in global cyber-espionage.pdf", "2016-02-17 - OceanLotus for OS X \u2013 an Application Bundle Pretending to be an Adobe Flash Update.pdf", "2016-02-21 - Source code for powerful Android banking malware is leaked.pdf", "2016-02-22 - Russian bank employees received fake job offers in targeted email attack.pdf", "2016-02-24 - Operation Blockbuster Coalition Ties Destructive Attacks to Lazarus Group.pdf", "2016-02-19 - Citadel 0.0.1.1 (Atmos).pdf", "2016-02-26 - Nymaim Moves Past Its Ransomware Roots - What Is Old Is New Again.pdf", "2016-02-24 - The DGA of Qakbot.T.pdf", "2016-03-01 - Look Into Locky Ransomware.pdf", "2016-03-01 - Taiwan Presidential Election- A Case Study on Thematic Targeting.pdf", "2016-02-29 - New Malware \u2018Rover\u2019 Targets Indian Ambassador to Afghanistan.pdf", "2016-02-29 - The \u201cHawkEye\u201d attack- how cybercrooks target small businesses for big money.pdf", "2016-02-25 - KeyBase Threat Grows Despite Public Takedown- A Picture is Worth a Thousand Words.pdf", "2016-03-07 - RedHat Hacker.asp.pdf", "2016-03-01 - Shrouded Crossbow Creators Behind BIFROSE for UNIX.pdf", "2016-02-18 - New Android Trojan \u201cXbot\u201d Phishes Credit Cards and Bank Accounts, Encrypts Devices for Ransom.pdf", "2016-03-03 - Attack on Zygote- a new twist in the evolution of mobile threats.pdf", "2016-03-11 - Cerber ransomware- new, but mature.pdf", "2016-03-04 - Tracing the Lineage of DarkSeoul.pdf", "2016-03-10 - Death Comes Calling- Thanatos-Alphabot Trojan Hits the Market.pdf", "2016-03-15 - Suckfly- Revealing the secret life of your code signing certificates.pdf", "2016-03-06 - Network detector for Winnti malware.pdf", "2016-03-11 - Gaudox - HTTP Bot (1.1.0.1) - C++-ASM - Ring3 Rootkit - Watchdog - Antis.pdf", "2016-03-11 - PowerSniff Malware Used in Macro-based Attacks.pdf", "2016-03-18 - Xor DDoS.pdf", "2016-03-09 - Korean Energy and Transportation Targets Attacked by OnionDog APT.pdf", "2016-03-14 - Massive Malvertising Campaign in US Leads to Angler Exploit Kit-BEDEP.pdf", "2016-03-14 - Digital Quartermaster Scenario Demonstrated in Attacks Against the Mongolian Government.pdf", "2016-03-18 - Teslacrypt Spam Campaign- \u201cUnpaid Issue\u2026\u201d.pdf", "2016-02-14 - PadCrypt The first ransomware with Live Support Chat and an Uninstaller.pdf", "2016-03-23 - SamSam- The Doctor Will See You, After He Pays The Ransom.pdf", "2016-03-20 - Hidden Tear Project- Forbidden Fruit Is the Sweetest.pdf", "2016-03-23 - Gozi ISFB Sourceccode.pdf", "2016-03-21 - OS X Malware Samples Analyzed.pdf", "2016-03-31 - Stored XSS Vulnerabilites on Foscam.pdf", "2016-03-25 - ProjectM- Link Found Between Pakistani Actor and Operation Transparent Tribe.pdf", "2016-03-24 - Maktub Locker \u2013 Beautiful And Dangerous.pdf", "2016-04-06 - Locky Ransomware Is Becoming More Sophisticated - Cybercriminals Continue Email Campaign Innovation.pdf", "2016-04-07 - FBI Quietly Admits to Multi-Year APT Attack, Sensitive Data Stolen.pdf", "2016-03-30 - Ransomware Deployed by Adversary with Established Foothold.pdf", "2016-03-29 - Taiwan targeted with new cyberespionage back doorTrojan.pdf", "2016-04-14 - Targeted Ransomware Activity.pdf", "2016-04-14 - Meet GozNym- The Banking Malware Offspring of Gozi ISFB and Nymaim.pdf", "2016-04-06 - Bootkit's development overview and trend (X).pdf", "2016-03-23 - New self?protecting USB trojan able to avoid detection.pdf", "2016-04-14 - Bedep has raised its game vs Bot Zombies.pdf", "2016-04-05 - SCADA Security Report 2016.pdf", "2016-04-01 - Petya \u2013 Taking Ransomware To The Low Level.pdf", "2016-04-11 - Manamecrypt \u2013 a ransomware that takes a different route.pdf", "2016-04-08 - CryptoHost Decrypted Locks files in a password protected RAR File.pdf", "2016-04-19 - MULTIGRAIN \u2013 Point of Sale Attackers Make an Unhealthy Addition to the Pantry.pdf", "2016-03-31 - The evolution of Brazilian Malware.pdf", "2016-04-16 - Ever Present Persistence - Established Footholds Seen in the Wild.pdf", "2016-04-21 - PoS Attacks Net Crooks 20 Million Stolen Bank Cards.pdf", "2016-04-26 - Digging deep for PLATINUM.pdf", "2016-04-21 - When entropy meets Shannon.pdf", "2016-04-22 - New Poison Ivy RAT Variant Targets Hong Kong Pro-Democracy Activists.pdf", "2016-03-11 - Gaudox - HTTP Bot (1.1.0.1) - CPlusPlus ASM - Ring3 Rootkit - Watchdog - Antis.pdf", "2016-04-19 - Trojan.GodzillaLoader (alias Godzilla Loader).pdf", "2016-04-22 - Tater- A PowerShell implementation of the Hot Potato Windows Privilege Escalation exploit..pdf", "2016-04-28 - Tick cyberespionage group zeros in on Japan.pdf", "2016-04-19 - Your Package Has Been Successfully Encrypted- TeslaCrypt 4.1A and the Malware Attack Chain.pdf", "2016-05-02 - Prince of Persia- Infy Malware Active In Decade of Targeted Attacks.pdf", "2016-04-27 - Freezer Paper around Free Meat.pdf", "2016-05-03 - The Continuing Evolution of Samas Ransomware.pdf", "2016-04-28 - Research Spotlight- The Resurgence of Qbot.pdf", "2016-05-05 - Sophisticated New Packer Identified in CryptXXX Ransomware Sample.pdf", "2016-05-11 - Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks.pdf", "2016-04-25 - Attackers Behind GozNym Trojan Set Sights on Europe.pdf", "2016-05-03 - A Universal Windows Bootkit.pdf", "2016-05-09 - KRBanker Targets South Korea Through Adware and Exploit Kits.pdf", "2016-05-12 - LatentBot \u2013 modularny i silnie zaciemniony bot.pdf", "2016-05-09 - PSEUDO-DARKLEECH ANGLER EK FROM 185.118.66.154 SENDS BEDEP-CRYPTXXX.pdf", "2016-05-04 - Petya- the two-in-one trojan.pdf", "2016-05-02 - Prince of Persia Hashes.pdf", "2016-05-13 - Cyber Heist Attribution.pdf", "2016-05-06 - 7ev3n ransomware turning \u2018HONE$T\u2019.pdf", "2016-05-10 - Setting Sights On Retail- AbaddonPOS Now Targeting Specific POS Software.pdf", "2016-05-12 - Chinese-language Ransomware \u2018SHUJIN\u2019 Makes An Appearance.pdf", "2016-05-16 - Vietnamese Bank Blocks $1 Million SWIFT Heist.pdf", "2016-05-12 - Hancitor and Ruckguv Reappear, Updated and With Vawtrak On Deck.pdf", "2016-05-15 - What We Can Learn From the Bangladesh Central Bank Cyber Heist.pdf", "2016-05-18 - Operation Groundbait- Espionage in Ukrainian war zones.pdf", "2016-05-09 - PseudoDarkLeech Angler EK from 185.118.66.154 sends Bedep-CryptXXX.pdf", "2016-05-17 - Indian organizations targeted in Suckfly attacks.pdf", "2016-05-23 - Technical Report about the Malware used in the Cyberespionage against RUAG.pdf", "2016-05-17 - ATM infector.pdf", "2016-06 - Form Grabber 2016 [Crome,FF,Opera,Thunderbird, Outlook IE Safari] Hack the world.pdf", "2016-05-27 - Evidence of Stronger Ties Between North Korea and SWIFT Banking Attacks.pdf", "2016-05-24 - New Wekby Attacks Use DNS Requests As Command and Control Mechanism.pdf", "2016-06-02 - FastPOS- Quick and Easy Credit Card Theft.pdf", "2016-04-27 - Freezer Paper around Free Meat (Repackaging Open Source BeEF for Tracking and More).pdf", "2016-05-19 - Petya and Mischa \u2013 Ransomware Duet (Part 1).pdf", "2016-05-19 - Petya and Mischa for All! The RaaS Boom Expands to Include the Petya-Mischa Combo.pdf", "2016-05-26 - The OilRig Campaign- Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor.pdf", "2016-05-26 - SWIFT attackers\u2019 malware linked to more financial attacks.pdf", "2016-05-20 - Special Report- Cyber thieves exploit banks' faith in SWIFT transfer network.pdf", "2016-06-03 - Cooking Up Autumn (Herbst) Ransomware.pdf", "2016-06-15 - Unsupported TeamViewer Versions Exploited For Backdoors, Keylogging.pdf", "2016-06-08 - Spear Phishing Attacks- Why They are Successful and How to Stop Them.pdf", "2016-06-14 - New Sofacy Attacks Against US Government Agency.pdf", "2016-05-22 - Cron has fallen.pdf", "2016-06-23 - Tracking Elirks Variants in Japan- Similarities to Previous Attacks.pdf", "2016-06-09 - Reverse-engineering DUBNIUM.pdf", "2016-06-07 - The Story of yet another ransom-fail-ware.pdf", "2016-06-22 - After Angler- Shift in Exploit Kit Landscape and New Crypto-Ransomware Activity.pdf", "2016-06-25 - SectorC08- Multi-Layered SFX in Recent Campaigns Target Ukraine.pdf", "2016-06-11 - The Chinese Hackers in the Back Office.pdf", "2016-06-15 - Bears in the Midst- Intrusion into the Democratic National Committee.pdf", "2016-06-17 - ScarCruft APT Group Used Latest Flash Zero Day in Two Dozen Attacks.pdf", "2016-05-22 - Operation Ke3chang Resurfaces With New TidePool Malware.pdf", "2016-06-29 - Apocalypse- Ransomware which targets companies through insecure RDP.pdf", "2016-06-06 - Everyone sees not what they want to see.pdf", "2016-06-28 - Prince of Persia \u2013 Game Over.pdf", "2016-06-17 - Operation Daybreak.pdf", "2016-06-23 - POS and Credit Cards- In the Line of Fire with \u201cPunkeyPOS\u201d.pdf", "2016-06-17 - In The Wild- Mobile Malware Implements New Features.pdf", "2016-06-10 - Petya and Mischa- ransomware duet (part 2).pdf", "2016-06-14 - CVE-2016-4171 \u2013 Adobe Flash Zero-day used in targeted attacks.pdf", "2016-06-24 - Ani-Shell.pdf", "2016-06-25 - Rokku Ransomware shows possible link with Chimera.pdf", "2016-07-01 - KeyBase - A New Keylogger on the Block.pdf", "2016-06-15 - Mofang- A politically motivated information stealing adversary.pdf", "2016-07-01 - How I Cracked a Keylogger and Ended Up in Someone's Inbox.pdf", "2016-06-21 - The Curious Case of an Unknown Trojan Targeting German-Speaking Users.pdf", "2016-07-14 - Technical Notes on Sakula.pdf", "2016-07-08 - Investigating the LuminosityLink Remote Access Trojan Configuration.pdf", "2016-07-13 - Troldesh ransomware influenced by (the) Da Vinci code.pdf", "2016-05-23 - DMA Locker 4.0- Known ransomware preparing for a massive distribution.pdf", "2016-07-11 - When Paying Out Doesn't Pay Off.pdf", "2016-07-20 - CrypMIC Ransomware Wants to Follow CryptXXX\u2019s Footsteps.pdf", "2016-07-22 - Stampado Ransomware campaign decrypted before it Started.pdf", "2016-07-21 - Canadian Man Behind Popular \u2018Orcus RAT\u2019.pdf", "2016-07-21 - Phishing Attacks Employ Old but Effective Password Stealer.pdf", "2016-07-07 - New threat dubbed Zepto Ransomware is spreading out with a new email spam campaign. It is a variant of the recent Locky Ransomware..pdf", "2016-07-25 - Patchwork cyberespionage group expands targets from governments to wide range of industries.pdf", "2016-07-26 - OTX Pulse on R980 ransomware.pdf", "2016-07-12 - Me and Mr. Robot- Tracking the Actor Behind the MAN1 Crypter.pdf", "2016-07-26 - Threat Actors Using Legitimate PayPal Accounts To Distribute Chthonic Banking Trojan.pdf", "2016-07-26 - Attack Delivers \u20189002\u2019 Trojan Through Google Drive.pdf", "2016-07-31 - China 1937CN Team Hackers Attack Airports in Vietnam.pdf", "2016-07-07 - NetTraveler APT Targets Russian, European Interests.pdf", "2016-07-18 - Third time (un)lucky \u2013 improved Petya is out.pdf", "2016-07-28 - Petya and Mischa For All Part II- They\u2019re Here\u2026.pdf", "2016-08-01 - CrowdStrike\u2019s New Methodology for Tracking eCrime.pdf", "2016-08 - Analysis of a packed Pony downloader.pdf", "2016-08-02 - Orcus \u2013 Birth of an unusual plugin builder RAT.pdf", "2016-07-08 - The Dropping Elephant \u2013 aggressive cyber-espionage in the Asian region.pdf", "2016-08-08 - Possibly Italy-Born Android RAT Reported in China, Find Bitdefender Researchers.pdf", "2016-08-08 - Doctor Web detected Linux Trojan written in Go.pdf", "2016-08-04 - What is Multigrain- Learn what makes this PoS malware different.pdf", "2016-08-08 - MONSOON - Analysis Of An APT Campaign.pdf", "2016-08-04 - Iranian Actor -Group5- Targeting Syrian Opposition.pdf", "2016-08-08 - Strider- Cyberespionage group turns eye of Sauron on targets.pdf", "2016-08-10 - CryptXXX - CrypMIC \u2013 intensywnie dystrybuowany ransomware w ramach exploit-kit\u00f3w.pdf", "2016-08-05 - Smoke Loader \u2013 downloader with a smokescreen still alive.pdf", "2016-08-08 - ProjectSauron- top level cyber-espionage platform covertly extracts encrypted government comms.pdf", "2016-08-18 - The Shadow Brokers.pdf", "2016-08-16 - Aveo Malware Family Targets Japanese Speaking Users.pdf", "2016-08-16 - Brazil Can\u2019t Catch a Break- After Panda Comes the Sphinx.pdf", "2016-08-22 - BLATSTING FUNKSPIEL.pdf", "2016-07-06 - New OSX-Keydnap malware is hungry for credentials.pdf", "2016-08-23 - GozNym Banking Trojan Targeting German Banks.pdf", "2016-08-22 - Trojan.Mutabaha.1.pdf", "2016-08-25 - Shakti Trojan - Technical Analysis.pdf", "2016-08-19 - New Hancitor Malware- Pimp my Downloaded.pdf", "2016-08-28 - FEINTCLOUD.pdf", "2016-08-23 - Russian hackers 'Fancy Bear' likely breached Olympic drug-testing agency and DNC, experts say.pdf", "2016-08-15 - Shakti Trojan- Document Thief.pdf", "2016-08-17 - Operation Ghoul- targeted attacks on industrial and engineering organizations.pdf", "2016-08-29 - Fantom ransomware impersonates Windows update.pdf", "2016-08-25 - Unpacking the spyware disguised as antivirus.pdf", "2016-08-29 - German Speakers Targeted by SPAM Leading to Ozone RAT.pdf", "2016-07-03 - Android Triada modular trojan.pdf", "2016-08-04 - Iran Threats Webpage.pdf", "2016-08-10 - Android Marcher- Continuously Evolving Mobile Malware.pdf", "2016-08-30 - OSX-Keydnap spreads via signed Transmission application.pdf", "2016-09-01 - TADAQUEOUS moments.pdf", "2016-08-30 - Pythons and Unicorns and Hancitor\u2026Oh My! Decoding Binaries Through Emulation.pdf", "2016-07-12 - Malware Discovered \u2013 SFG- Furtim Malware Analysis.pdf", "2016-09-02 - Necurs \u2013 hybrid spam botnet.pdf", "2016-08-29 - Nightmare on Tor Street- Ursnif variant Dreambot adds Tor functionality.pdf", "2016-07-30 - Luminosity RAT - Re-purposed.pdf", "2016-08-07 - Strider- Cyberespionage group turns eye of Sauron on targets.pdf", "2016-09-04 - BLATSTING Command-and-Control protocol.pdf", "2016-09-11 - BUZZDIRECTION- BLATSTING reloaded.pdf", "2016-08-11 - Smrss32 (.encrypted) Ransomware Help & Support - _HOW_TO_Decrypt.bmp.pdf", "2016-07-05 - New Backdoor Allows Full Access to Mac Systems, Bitdefender Warns.pdf", "2016-09-08 - Doctor Web discovers Linux Trojan written in Rust.pdf", "2016-09-06 - Buckeye cyberespionage group shifts gaze from US to Hong Kong.pdf", "2016-08-22 - VB Dropper and Shellcode for Hancitor Reveal New Techniques Behind Uptick.pdf", "2016-09-08 - The Philadelphia Ransomware offers a Mercy Button for Compassionate Criminals.pdf", "2016-07-08 - GootKit- Bobbing and Weaving to Avoid Prying Eyes.pdf", "2016-09-20 - Hackers lurking, parliamentarians told _ News _ DW _ 20.09.2016.pdf", "2016-09-13 - H1N1- Technical analysis reveals new capabilities.pdf", "2016-09-17 - A few notes on SECONDDATE's C&C protocol.pdf", "2016-09-13 - The curious case of BLATSTING's RSA implementation.pdf", "2016-09-11 - Free Darktrack RAT Has the Potential of Being the Best RAT on the Market Search.pdf", "2016-09-06 - Blatsting C&C Transcript.pdf", "2016-09-16 - Tofsee \u2013 modular spambot.pdf", "2016-09-07 - The Missing Piece \u2013 Sophisticated OS X Backdoor Discovered.pdf", "2016-09-20 - Inside Petya and Mischa ransomware.pdf", "2016-09-22 - Book of Eli- African targeted attacks.pdf", "2016-09-23 - Dissecting a Hacktivist\u2019s DDoS Tool- Saphyra Revealed.pdf", "2016-09-23 - SECONDDATE in action.pdf", "2016-09-27 - New Voldemort-Nagini Ransomware Virus Infection.pdf", "2016-09-09 - GOVRAT V2.0 - Attacking US military and government.pdf", "2016-09-15 - MILE TEA- Cyber Espionage Campaign Targets Asia Pacific Businesses and Government Agencies.pdf", "2016-09-19 - Untangling the Ripper ATM Malware.pdf", "2016-09-22 - Zeus Delivered by DELoader to Defraud Customers of Canadian Banks.pdf", "2016-09-20 - Hackers lurking, parliamentarians told.pdf", "2016-09-26 - Sofacy\u2019s \u2018Komplex\u2019 OS X Trojan.pdf", "2016-09-21 - Reversing GO binaries like a pro.pdf", "2016-09-16 - iSpy Keylogger.pdf", "2016-09-13 - DualToy- New Windows Trojan Sideloads Risky Apps to Android and iOS Devices.pdf", "2016-09-14 - BkSoD by Ransomware- HDDCryptor Uses Commercial Tools to Encrypt Network Shares and Lock HDDs.pdf", "2016-09-21 - KrebsOnSecurity Hit With Record DDoS.pdf", "2016-09-20 - Meanwhile in Britain, Qadars v3 Hardens Evasion, Targets 18 UK Banks.pdf", "2016-09-05 - Pok\u00e9mon-themed Umbreon Linux Rootkit Hits x86, ARM Systems.pdf", "2016-09-23 - Hancitor (AKA Chanitor) observed using multiple attack approaches.pdf", "2016-09-27 - Komplex Mac backdoor answers old questions.pdf", "2016-09-28 - Highly Evasive Code Injection Awaits User Interaction Before Delivering Malware.pdf", "2016-09-28 - Belling the BEAR.pdf", "2016-09-28 - Introducing Her Royal Highness the Princess Locker Ransomware.pdf", "2016-09-27 - Threat Spotlight- GozNym.pdf", "2016-09-29 - TeamXRat- Brazilian cybercrime meets ransomware.pdf", "2016-09-30 - Hacked Steam accounts spreading Remote Access Trojan.pdf", "2016-10-03 - Remsec driver analysis.pdf", "2016-10-01 - \u2018Shadow Brokers\u2019 Whine That Nobody Is Buying Their Hacked NSA Files.pdf", "2016-10-17 - RotorCrypt (RotoCrypt) Ransomware Support Topic - .tar, .c400, .c300, .GRANIT.pdf", "2016-10-01 - Source Code for IoT Botnet \u2018Mirai\u2019 Released.pdf", "2016-09-28 - Confucius Says\u2026Malware Families Get Further By Abusing Legitimate Websites.pdf", "2016-10-10 - Remsec driver analysis - Part 2.pdf", "2016-10-10 - How France's TV5 was almost destroyed by 'Russian hackers'.pdf", "2016-10-05 - FastPOS Updates in Time for the Retail Sale Season.pdf", "2016-09-29 - Want Tofsee My Pictures- A Botnet Gets Aggressive.pdf", "2016-10-11 - Remsec driver analysis - Part 3.pdf", "2016-10-17 - New-looking Sundown EK drops Smoke Loader, Kronos banker.pdf", "2016-10-09 - SiteIntel- Cyber Caliphate Army.pdf", "2016-10-17 - \u2018DealersChoice\u2019 is Sofacy\u2019s Flash Player Exploit Platform.pdf", "2016-10-27 - Inside the Gootkit C&C server.pdf", "2016-10-04 - OilRig Malware Campaign Updates Toolset and Expands Targets.pdf", "2016-10-03 - Polyglot \u2013 the fake CTB-locker.pdf", "2016-10-20 - TheMoon - A P2P botnet targeting Home Routers.pdf", "2016-10-18 - Digitally Signed Malware Targeting Gaming Companies.pdf", "2016-10-17 - A Tale of Two Targets.pdf", "2016-10-24 - Introducing TrickBot, Dyreza\u2019s successor.pdf", "2016-11-02 - Exposing the EGO MARKET- the cybercrime performed by the Linux-Moose botnet.pdf", "2016-10-24 - Evasive Malware Detects and Defeats Virtual Machine Analysis.pdf", "2016-10-27 - In-Dev Ransomware forces you do to Survey before unlocking Computer.pdf", "2016-11-09 - Tricks of the Trade- A Deeper Look Into TrickBot\u2019s Machinations.pdf", "2016-10-28 - zxshell repository.pdf", "2016-10-31 - Second Shadow Brokers dump released.pdf", "2016-11-09 - Down the H-W0rm Hole with Houdini\u2019s RAT.pdf", "2016-10-26 - Moonlight \u2013 Targeted attacks in the Middle East.pdf", "2016-10-15 - TrickBot- We Missed you, Dyre.pdf", "2016-11-14 - Doctor Web discovers a botnet that attacks Russian banks.pdf", "2016-11-10 - Floki Bot and the stealthy dropper.pdf", "2016-11-08 - Analysis of iOSGuiInject Adware Library.pdf", "2016-11-02 - Linux-Moose- Still breathing.pdf", "2016-10-25 - TrickBot Banker Insights.pdf", "2016-11-01 - Ursnif Malware- Deep Technical Dive.pdf", "2016-10-11 - Odinaff- New Trojan used in high level financial attacks.pdf", "2016-11-14 - Ransoc Desktop Locking Ransomware Ransacks Local Files and Social Media Profiles.pdf", "2016-10-27 - Mirai DDoS Botnet- Source Code & Binary Analysis.pdf", "2016-11-15 - CryptoLuck Ransomware being Malvertised via RIG-E Exploit Kits.pdf", "2016-11-02 - Nymaim Malware- Deep Technical Dive \u2013 Adventures in Evasive Malware.pdf", "2016-11-15 - ScanPOS, new POS malware being distributed by Kronos.pdf", "2016-11-07 - Little Trickbot Growing Up- New Campaign.pdf", "2016-11-08 - Analysis of IOS.GUIINJECT Adware Library.pdf", "2016-11-08 - SPAMTORTE VERSION 2- DISCOVERY OF AN ADVANCED, MULTILAYERED SPAMBOT CAMPAIGN THAT IS BACK WITH A VENGEANCE.pdf", "2016-10-21 - BITTER- a targeted attack against Pakistan.pdf", "2016-11-15 - Kronos Banking Trojan Used to Deliver New Point-of-Sale Malware.pdf", "2016-10-27 - BLACKGEAR Espionage Campaign Evolves, Adds Japan To Target List.pdf", "2016-10-25 - Houdini\u2019s Magic Reappearance.pdf", "2016-11-23 - InPage zero-day exploit used to attack financial institutions in Asia.pdf", "2016-11-30 - Bladabindi Remains A Constant Threat By Using Dynamic DNS Services.pdf", "2016-11-17 - It\u2019s Parliamentary - KeyBoy and the targeting of the Tibetan Community.pdf", "2016-11-22 - Cobalt hackers executed massive, synchronized ATM heists across Europe, Russia.pdf", "2016-10-03 - On the StrongPity Waterhole Attacks Targeting Italian and Belgian Encryption Users.pdf", "2016-11-21 - PrincessLocker \u2013 ransomware with not so royal encryption.pdf", "2016-11-21 - Android malware analysis with Radare- Dissecting the Triada Trojan.pdf", "2016-11-17 - Princess Locker decryptor.pdf", "2016-11-28 - NetWire RAT Steals Payment Card Data.pdf", "2016-12-08 - Thyssenkrupp victim of cyber attack.pdf", "2016-12-06 - Deep Analysis of the Online Banking Botnet TrickBot.pdf", "2016-12-07 - The TrickBot Evolution.pdf", "2016-12-07 - August in November- New Information Stealer Hits the Scene.pdf", "2016-12-06 - August in November- New Information Stealer Hits the Scene.pdf", "2016-11-28 - A New All-in-One Botnet- Proteus.pdf", "2016-12-09 - Now Mirai Has DGA Feature Built in.pdf", "2016-12-01 - CNACOM - Open Source Exploitation via Strategic Web Compromise.pdf", "2016-12-07 - Floki Bot Strikes, Talos and Flashpoint Respond.pdf", "2016-12-14 - MiKey - A Linux keylogger.pdf", "2016-12-19 - Dismantling a Nuclear Bot.pdf", "2016-12-09 - -Proof of Concept- CryptoWire Ransomware Spawns Lomix and UltraLocker Families.pdf", "2016-12-26 - Rocket Kitten.pdf", "2016-12-14 - Kaspersky Security Bulletin 2016. Review of the year. Overall statistics for 2016.pdf", "2016-12-14 - Twin zero-day attacks- PROMETHIUM and NEODYMIUM target individuals in Europe.pdf", "2016-12-27 - Pegasus internals- Technical Teardown of the Pegasus malware and Trident exploit chain.pdf", "2016-12-16 - Bayrob- Three suspects extradited to face charges in US.pdf", "2016-12-20 - Alice- A Lightweight, Compact, No-Nonsense ATM Malware.pdf", "2016-12-29 - Some notes on IoCs.pdf", "2016-12-15 - Let It Ride- The Sofacy Group\u2019s DealersChoice Attacks Continue.pdf", "2016-12-22 - Tofsee Spambot features .ch DGA - Reversal and Countermesaures.pdf", "2016-12-23 - Emsisoft Decryptor for GlobeImposter.pdf", "2016-11-30 - Shamoon 2- Return of the Disttrack Wiper.pdf", "2016-11-23 - Analysis- Ursnif - spying on your data since 2007.pdf", "2016-12-09 - New Exo Android Trojan Sold on Hacking Forums, Dark Web.pdf", "APT C 03.pdf", "2016-12-28 - Switcher- Android joins the \u2018attack-the-router\u2019 club.pdf", "2016-12-27 - ANALYSIS OF AUGUST STEALER MALWARE.pdf", "2016-11-30 - Shamoon- Back from the dead and destructive as ever.pdf", "Asruex.pdf", "2016-11-22 - Tropic Trooper Targets Taiwanese Government and Fossil Fuel Provider With Poison Ivy.pdf", "Aveo.pdf", "attack delivers 9002 trojan through google drive.pdf", "APT-C-09 (2).pdf", "Black Energy APT.pdf", "Cisco HayStack.pdf", "Dust Storm Infographic.pdf", "Apt 2015 (2).pdf", "Dissecting the malware in inocnation campaign.pdf", "Dynasty.pdf", "NetTraveler.pdf", "Houdini.s.Magic.Reappearance.pdf", "Operation Blockbuster Ex Summary.pdf", "Operation Dust Storm.pdf", "2016-01-22 - CVE-2015-4400 - Backdoorbot, Network Configuration Leak on a Connected Doorbell.pdf", "2016-01-26 - URLZone Zones in on Japan.pdf", "2016-01-21 - NetTraveler Spear-Phishing Email Targets Diplomat of Uzbekistan.pdf", "2016-04-13 - Ghosts in the Endpoint.pdf", "2016-05-25 - CVE-2015-2545- overview of current threats.pdf", "2016-05-29 - Keep Calm and (Don\u2019t) Enable Macros- A New Threat Actor Targets UAE Dissidents.pdf", "2016-12-01 - Alert (TA16-336A)- Avalanche (crimeware-as-a-service infrastructure).pdf", "2016-12-13 - The rise of TeleBots- Analyzing disruptive KillDisk attacks.pdf", "2016-12-09 - Windows 10- protection, detection, and response against recent Depriz malware attacks.pdf", "2016-12-15 - Goldeneye Ransomware \u2013 the Petya-Mischa combo rebranded.pdf", "2016-12-20 - New Linux-Rakos threat- devices and servers under SSH scan (again).pdf", "2016-12-29 - GRIZZLY STEPPE \u2013 Russian Malicious Cyber Activity.pdf", "A tale of two targets.pdf", "APT-C-15.pdf", "Attack on Ukraine Power Grid.pdf", "Bears in the Midst Intrusion into the Democratic National Committee \u00bb.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1065", "name": "Uncommonly Used Port", "display_name": "T1065 - Uncommonly Used Port" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1085", "name": "Rundll32", "display_name": "T1085 - Rundll32" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1124", "name": "System Time Discovery", "display_name": "T1124 - System Time Discovery" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1193", "name": "Spearphishing Attachment", "display_name": "T1193 - Spearphishing Attachment" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "kikinumpav", "id": "385742", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 561, "FileHash-MD5": 1150, "FileHash-SHA256": 1957, "URL": 1407, "domain": 1246, "hostname": 1684, "FileHash-SHA1": 433, "CVE": 54, "email": 60, "BitcoinAddress": 4, "YARA": 1 }, "indicator_count": 8557, "is_author": false, "is_subscribing": null, "subscriber_count": 12, "modified_text": "29 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698d30c03b57c38dff915023", "name": "Double Umbrella AS15169/AS21928: This evaluates a critical structural convergence between Google (AS15169) and T-Mobile USA (AS21928) within the global Tier-1 routing backbone", "description": "Research credit: msudosos, The research identifies a high-fidelity pattern where traffic from dual origins commingles within a restricted lateral transit hub, allowing for horizontal movement across backbone providers that typically maintain distinct trust boundaries. Specifically, the Content Origin (Umbrella A) originated by Google (AS15169) reaches the core backbone through a high-trust sequence involving Arelion (AS1299), NTT (AS2914), and GTT (AS3257). Simultaneously, the Mobile Origin (Umbrella B) originated by T-Mobile USA (AS21928) enters the backbone via Cogent (AS174) and Lumen (AS3356). The findings designate Lumen (AS3356) as the central lateral hub where traffic pivots horizontally between the \u201cCore Five\u201d partners-including Zayo (AS6461) and Hurricane Electric (AS6939) \u2014before leaking to international sub-transit peers like Sparkle (AS6762) and Telxius (AS12956), finally exiting at global edge points such as PCCW (AS3491) and Tata (AS6453).", "modified": "2026-03-29T06:02:00.914000", "created": "2026-02-12T01:45:36.128000", "tags": [ "The dynamics of the mudoSOSIntersectalign with sophisticated adv" ], "references": [ "as15169" ], "public": 1, "adversary": "Adversary Profile: Salt Typhoon Alignment The architectural gap identified by mudoSO mirrors the act", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 3, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URI": 1, "domain": 2661, "URL": 6810, "hostname": 2147, "email": 56, "FileHash-SHA256": 2781, "CVE": 172, "FileHash-MD5": 365, "FileHash-SHA1": 344, "IPv4": 1, "CIDR": 20940 }, "indicator_count": 36278, "is_author": false, "is_subscribing": null, "subscriber_count": 73, "modified_text": "63 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bf64e1d5e06aa6207f78de", "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "description": "", "modified": "2026-03-27T00:30:39.055000", "created": "2026-03-22T03:41:21.863000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr" ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": "698e93e1ab02db8c49e8c3ed", "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 27572, "FileHash-SHA256": 46076, "FileHash-MD5": 42177, "FileHash-SHA1": 22874, "hostname": 33438, "URL": 74810, "SSLCertFingerprint": 21, "CVE": 7579, "email": 297, "FileHash-IMPHASH": 8, "CIDR": 26203, "JA3": 1 }, "indicator_count": 281056, "is_author": false, "is_subscribing": null, "subscriber_count": 149, "modified_text": "65 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bf64eccb5d39a90a3c391e", "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "description": "", "modified": "2026-03-27T00:30:39.055000", "created": "2026-03-22T03:41:32.565000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr" ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": "698e93e1ab02db8c49e8c3ed", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 27572, "FileHash-SHA256": 46076, "FileHash-MD5": 42177, "FileHash-SHA1": 22874, "hostname": 33438, "URL": 74810, "SSLCertFingerprint": 21, "CVE": 7579, "email": 297, "FileHash-IMPHASH": 8, "CIDR": 26203, "JA3": 1 }, "indicator_count": 281056, "is_author": false, "is_subscribing": null, "subscriber_count": 152, "modified_text": "65 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "hitcon.org", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "hitcon.org", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780237865.6233342 }