{
  "type": "URL",
  "indicator": "http://chainlink-api-v3.cloud/api/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "http://chainlink-api-v3.cloud/api/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4056619280,
      "indicator": "http://chainlink-api-v3.cloud/api/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "689483159128c89f669e87d6",
          "name": "EbeeAugust2025 Pt1",
          "description": "",
          "modified": "2025-09-06T10:00:39.896000",
          "created": "2025-08-07T10:42:29.730000",
          "tags": [],
          "references": [
            "Aug1.pdf"
          ],
          "public": 1,
          "adversary": "Multiple",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 75,
            "CVE": 1,
            "FileHash-MD5": 111,
            "FileHash-SHA1": 139,
            "FileHash-SHA256": 243,
            "domain": 137,
            "hostname": 43,
            "email": 1
          },
          "indicator_count": 750,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 39,
          "modified_text": "266 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "688dae713de770774cb69364",
          "name": "Lazarus Group Enhances Malware with New OtterCookie Payload Delivery Technique.",
          "description": "The Contagious Interview campaign, attributed to the Lazarus Group, has demonstrated significant evolution in its operational techniques, particularly in the delivery mechanisms for its primary payloads: BeaverTail, InvisibleFerret, and OtterCookie. Recent analysis reveals that the group has adopted innovative methodologies to obfuscate their malicious code, making it more challenging for automated detection tools to identify their activities. One notable tactic employed by the Lazarus Group involves fragmenting URLs within the code. This method hides the command and control (C2) infrastructure by using legitimate hosting platforms, specifically http://Vercel.App, to deliver malicious payloads disguised as innocuous favicon content. The mechanism involves a call to a \"doing\" constant, which initiates a request operation to the C2 server.",
          "modified": "2025-09-01T06:00:31.037000",
          "created": "2025-08-02T06:21:37.025000",
          "tags": [
            "anubis ransomware",
            "anubis",
            "ransomware",
            "bitsight",
            "underground",
            "bitsight trace",
            "anubis overview",
            "november",
            "raas",
            "access",
            "path",
            "android",
            "ransom",
            "august",
            "cyber security",
            "strong",
            "linkedin",
            "constant",
            "follow",
            "updates",
            "checklist",
            "victims across",
            "sees surge",
            "twitter",
            "malware",
            "june",
            "hack",
            "lockbit",
            "lazarus",
            "beavertail",
            "invisibleferret",
            "execution",
            "teamviewer"
          ],
          "references": [
            "https://gbhackers.com/lazarus-group-malware-with-ottercookie/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1204.002",
              "name": "Malicious File",
              "display_name": "T1204.002 - Malicious File"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1,
            "FileHash-SHA256": 21,
            "domain": 2,
            "URL": 15
          },
          "indicator_count": 39,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 541,
          "modified_text": "271 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6842284d6a04a6c334dc13ef",
          "name": "InQuest - 05-06-2025",
          "description": "",
          "modified": "2025-07-05T23:04:57.997000",
          "created": "2025-06-05T23:29:17.072000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 247,
            "URL": 881,
            "domain": 522,
            "hostname": 127,
            "FileHash-SHA1": 113,
            "FileHash-MD5": 47
          },
          "indicator_count": 1937,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1620,
          "modified_text": "329 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "683ecc28d5d833c19956cbee",
          "name": "OtterCookie: Analysis of New Lazarus Group Malware",
          "description": "North Korean state-sponsored cyber-attack group Lazarus is continuing to target professionals in the tech, financial and crypto sectors with a new tool called OtterCookie, an analysis shows, including fake job offers.",
          "modified": "2025-07-03T10:00:53.370000",
          "created": "2025-06-03T10:19:20.970000",
          "tags": [
            "ottercookie",
            "invisibleferret",
            "beavertail",
            "mauro eldritch",
            "lazarus",
            "eldritch",
            "solana",
            "ck matrix",
            "lazarus group",
            "javascript",
            "exodus",
            "python",
            "uruguay",
            "team",
            "express",
            "next",
            "anydesk",
            "mamona",
            "dprk",
            "exodus wallet"
          ],
          "references": [
            "https://any.run/cybersecurity-blog/ottercookie-malware-analysis/"
          ],
          "public": 1,
          "adversary": "Lazarus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lazarus",
              "display_name": "Lazarus",
              "target": null
            },
            {
              "id": "Exodus Wallet",
              "display_name": "Exodus Wallet",
              "target": null
            },
            {
              "id": "Beavertail",
              "display_name": "Beavertail",
              "target": null
            },
            {
              "id": "OtterCookie",
              "display_name": "OtterCookie",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            }
          ],
          "industries": [
            "Financial",
            "Cryptocurrency",
            "Crypto"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1,
            "FileHash-SHA256": 4,
            "URL": 15,
            "domain": 3,
            "hostname": 3
          },
          "indicator_count": 26,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 542,
          "modified_text": "331 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "67f968e54901170c0ddabf3c",
          "name": "OtterCookie Malware IOCs & Lazarus Distribution Infrastructure",
          "description": "Contagious Interview is a cyberespionage campaign tracked by the Quetzal Team. We identified adversary infrastructure hosted in Finland, which serves as a malware delivery channel for OtterCookie.\n\nThis intelligence pulse provides indicators of compromise (IOCs) for OtterCookie, along with detailed information about the distribution infrastructure used by the attackers. Additionally, we include the original repository where the loader is distributed, helping to track its propagation and identify potential victims.\n\nThe loader is primarily distributed through LinkedIn, where the adversary creates fake profiles and posts fraudulent temporary job offers. These offers ask targets to download the loader and fix a supposed bug. Once the loader is executed, the infection begins.",
          "modified": "2025-05-11T18:00:12.957000",
          "created": "2025-04-11T19:09:25.934000",
          "tags": [
            "Lazarus"
          ],
          "references": [],
          "public": 1,
          "adversary": "Lazarus Group",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "OtterCookie",
              "display_name": "OtterCookie",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1192",
              "name": "Spearphishing Link",
              "display_name": "T1192 - Spearphishing Link"
            },
            {
              "id": "T1193",
              "name": "Spearphishing Attachment",
              "display_name": "T1193 - Spearphishing Attachment"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            }
          ],
          "industries": [
            "Finance",
            "Crypto"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "QuetzalTeam",
            "id": "273351",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_273351/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1,
            "FileHash-SHA256": 4,
            "domain": 1,
            "URL": 3
          },
          "indicator_count": 9,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 40,
          "modified_text": "384 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://gbhackers.com/lazarus-group-malware-with-ottercookie/",
        "Aug1.pdf",
        "https://any.run/cybersecurity-blog/ottercookie-malware-analysis/",
        "https://labs.inquest.net/iocdb"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Lazarus Group",
            "Multiple",
            "Lazarus"
          ],
          "malware_families": [
            "Exodus wallet",
            "Beavertail",
            "Lazarus",
            "Ottercookie"
          ],
          "industries": [
            "Crypto",
            "Cryptocurrency",
            "Financial",
            "Finance"
          ],
          "unique_indicators": 3049
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/chainlink-api-v3.cloud",
    "whois": "http://whois.domaintools.com/chainlink-api-v3.cloud",
    "domain": "chainlink-api-v3.cloud",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "689483159128c89f669e87d6",
      "name": "EbeeAugust2025 Pt1",
      "description": "",
      "modified": "2025-09-06T10:00:39.896000",
      "created": "2025-08-07T10:42:29.730000",
      "tags": [],
      "references": [
        "Aug1.pdf"
      ],
      "public": 1,
      "adversary": "Multiple",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 75,
        "CVE": 1,
        "FileHash-MD5": 111,
        "FileHash-SHA1": 139,
        "FileHash-SHA256": 243,
        "domain": 137,
        "hostname": 43,
        "email": 1
      },
      "indicator_count": 750,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 39,
      "modified_text": "266 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "688dae713de770774cb69364",
      "name": "Lazarus Group Enhances Malware with New OtterCookie Payload Delivery Technique.",
      "description": "The Contagious Interview campaign, attributed to the Lazarus Group, has demonstrated significant evolution in its operational techniques, particularly in the delivery mechanisms for its primary payloads: BeaverTail, InvisibleFerret, and OtterCookie. Recent analysis reveals that the group has adopted innovative methodologies to obfuscate their malicious code, making it more challenging for automated detection tools to identify their activities. One notable tactic employed by the Lazarus Group involves fragmenting URLs within the code. This method hides the command and control (C2) infrastructure by using legitimate hosting platforms, specifically http://Vercel.App, to deliver malicious payloads disguised as innocuous favicon content. The mechanism involves a call to a \"doing\" constant, which initiates a request operation to the C2 server.",
      "modified": "2025-09-01T06:00:31.037000",
      "created": "2025-08-02T06:21:37.025000",
      "tags": [
        "anubis ransomware",
        "anubis",
        "ransomware",
        "bitsight",
        "underground",
        "bitsight trace",
        "anubis overview",
        "november",
        "raas",
        "access",
        "path",
        "android",
        "ransom",
        "august",
        "cyber security",
        "strong",
        "linkedin",
        "constant",
        "follow",
        "updates",
        "checklist",
        "victims across",
        "sees surge",
        "twitter",
        "malware",
        "june",
        "hack",
        "lockbit",
        "lazarus",
        "beavertail",
        "invisibleferret",
        "execution",
        "teamviewer"
      ],
      "references": [
        "https://gbhackers.com/lazarus-group-malware-with-ottercookie/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1204.002",
          "name": "Malicious File",
          "display_name": "T1204.002 - Malicious File"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1,
        "FileHash-SHA256": 21,
        "domain": 2,
        "URL": 15
      },
      "indicator_count": 39,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 541,
      "modified_text": "271 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6842284d6a04a6c334dc13ef",
      "name": "InQuest - 05-06-2025",
      "description": "",
      "modified": "2025-07-05T23:04:57.997000",
      "created": "2025-06-05T23:29:17.072000",
      "tags": [],
      "references": [
        "https://labs.inquest.net/iocdb"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 247,
        "URL": 881,
        "domain": 522,
        "hostname": 127,
        "FileHash-SHA1": 113,
        "FileHash-MD5": 47
      },
      "indicator_count": 1937,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1620,
      "modified_text": "329 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "683ecc28d5d833c19956cbee",
      "name": "OtterCookie: Analysis of New Lazarus Group Malware",
      "description": "North Korean state-sponsored cyber-attack group Lazarus is continuing to target professionals in the tech, financial and crypto sectors with a new tool called OtterCookie, an analysis shows, including fake job offers.",
      "modified": "2025-07-03T10:00:53.370000",
      "created": "2025-06-03T10:19:20.970000",
      "tags": [
        "ottercookie",
        "invisibleferret",
        "beavertail",
        "mauro eldritch",
        "lazarus",
        "eldritch",
        "solana",
        "ck matrix",
        "lazarus group",
        "javascript",
        "exodus",
        "python",
        "uruguay",
        "team",
        "express",
        "next",
        "anydesk",
        "mamona",
        "dprk",
        "exodus wallet"
      ],
      "references": [
        "https://any.run/cybersecurity-blog/ottercookie-malware-analysis/"
      ],
      "public": 1,
      "adversary": "Lazarus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Lazarus",
          "display_name": "Lazarus",
          "target": null
        },
        {
          "id": "Exodus Wallet",
          "display_name": "Exodus Wallet",
          "target": null
        },
        {
          "id": "Beavertail",
          "display_name": "Beavertail",
          "target": null
        },
        {
          "id": "OtterCookie",
          "display_name": "OtterCookie",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        }
      ],
      "industries": [
        "Financial",
        "Cryptocurrency",
        "Crypto"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1,
        "FileHash-SHA256": 4,
        "URL": 15,
        "domain": 3,
        "hostname": 3
      },
      "indicator_count": 26,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 542,
      "modified_text": "331 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "67f968e54901170c0ddabf3c",
      "name": "OtterCookie Malware IOCs & Lazarus Distribution Infrastructure",
      "description": "Contagious Interview is a cyberespionage campaign tracked by the Quetzal Team. We identified adversary infrastructure hosted in Finland, which serves as a malware delivery channel for OtterCookie.\n\nThis intelligence pulse provides indicators of compromise (IOCs) for OtterCookie, along with detailed information about the distribution infrastructure used by the attackers. Additionally, we include the original repository where the loader is distributed, helping to track its propagation and identify potential victims.\n\nThe loader is primarily distributed through LinkedIn, where the adversary creates fake profiles and posts fraudulent temporary job offers. These offers ask targets to download the loader and fix a supposed bug. Once the loader is executed, the infection begins.",
      "modified": "2025-05-11T18:00:12.957000",
      "created": "2025-04-11T19:09:25.934000",
      "tags": [
        "Lazarus"
      ],
      "references": [],
      "public": 1,
      "adversary": "Lazarus Group",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "OtterCookie",
          "display_name": "OtterCookie",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1192",
          "name": "Spearphishing Link",
          "display_name": "T1192 - Spearphishing Link"
        },
        {
          "id": "T1193",
          "name": "Spearphishing Attachment",
          "display_name": "T1193 - Spearphishing Attachment"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        }
      ],
      "industries": [
        "Finance",
        "Crypto"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "QuetzalTeam",
        "id": "273351",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_273351/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1,
        "FileHash-SHA256": 4,
        "domain": 1,
        "URL": 3
      },
      "indicator_count": 9,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 40,
      "modified_text": "384 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "http://chainlink-api-v3.cloud/api/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "http://chainlink-api-v3.cloud/api/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780200536.5999682
}