{
  "type": "URL",
  "indicator": "https://grabify.link/SEFKGU",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://grabify.link/SEFKGU",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4167260639,
      "indicator": "https://grabify.link/SEFKGU",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6a0b436b99318655032774a0",
          "name": "EtherRAT Campaign Targeted Enterprise Admins via SEO Poisoning",
          "description": "",
          "modified": "2026-05-18T16:50:51.805000",
          "created": "2026-05-18T16:50:51.805000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "cryptocti",
            "id": "110256",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 16,
            "URL": 64,
            "IPv4": 5,
            "domain": 46
          },
          "indicator_count": 131,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 501,
          "modified_text": "12 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69fdcf72325b49520348bb0a",
          "name": "EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades",
          "description": "In March 2026, a highly sophisticated cyber threat campaign was discovered by the Atos Threat Research Center, which specifically targets high-privilege IT personnel like enterprise administrators and security analysts. The attackers employ a dual-layered GitHub repository distribution method, leveraging Search Engine Optimization (SEO) poisoning to manipulate search results for administrative utilities, directing victims to malicious MSI installers masquerading as legitimate tools. This approach maximizes the campaign's resilience, allowing the attackers to evade takedown efforts by keeping the malicious code on secondary repositories while the primary facade remains benign and SEO-optimized.",
          "modified": "2026-05-08T11:56:34.128000",
          "created": "2026-05-08T11:56:34.128000",
          "tags": [
            "c2 address",
            "c2 ip",
            "javascript file",
            "windows process",
            "task manager",
            "ethereum smart",
            "ethereum api",
            "ip address",
            "url path",
            "run registry",
            "lazarus",
            "apt34",
            "remote access",
            "msi",
            "node.js",
            "tsundere",
            "utility spoofing",
            "threat"
          ],
          "references": [
            "https://atos.net/en/lp/cybershield/etherrat-distribution-spoofing-administrative-tools-via-github-facades"
          ],
          "public": 1,
          "adversary": "Lazarus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "EtherRAT",
              "display_name": "EtherRAT",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1204.002",
              "name": "Malicious File",
              "display_name": "T1204.002 - Malicious File"
            },
            {
              "id": "T1218.007",
              "name": "Msiexec",
              "display_name": "T1218.007 - Msiexec"
            },
            {
              "id": "T1059.003",
              "name": "Windows Command Shell",
              "display_name": "T1059.003 - Windows Command Shell"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1564.003",
              "name": "Hidden Window",
              "display_name": "T1564.003 - Hidden Window"
            },
            {
              "id": "T1036.005",
              "name": "Match Legitimate Name or Location",
              "display_name": "T1036.005 - Match Legitimate Name or Location"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1027.002",
              "name": "Software Packing",
              "display_name": "T1027.002 - Software Packing"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1016",
              "name": "System Network Configuration Discovery",
              "display_name": "T1016 - System Network Configuration Discovery"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1049",
              "name": "System Network Connections Discovery",
              "display_name": "T1049 - System Network Connections Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1033",
              "name": "System Owner/User Discovery",
              "display_name": "T1033 - System Owner/User Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            }
          ],
          "industries": [
            "Finance"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 5,
            "URL": 64,
            "hostname": 17,
            "domain": 46
          },
          "indicator_count": 132,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 540,
          "modified_text": "22 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "698bc3a0a344b3915d0a8490",
          "name": "EtherRAT dissected: How a React2Shell implant delivers 5 payloads through blockchain C2 | Sysdig",
          "description": "Find out more about Sysdig, its cloud-native security research platform, and how to keep your cloud and container networks safe from cyber attacks and other threats in real time. and here are the key points.",
          "modified": "2026-03-12T23:51:50.163000",
          "created": "2026-02-10T23:47:40.227000",
          "tags": [
            "etherrat",
            "sysdig trt",
            "react2shell",
            "december",
            "ethereum",
            "c2 url",
            "appdata",
            "apache",
            "grabify",
            "dprk",
            "systemd",
            "april",
            "bitcoin",
            "exodus",
            "atomic",
            "phantom",
            "august",
            "blackhole",
            "worm"
          ],
          "references": [
            "https://www.sysdig.com/blog/etherrat-dissected-how-a-react2shell-implant-delivers-5-payloads-through-blockchain-c2"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "SGKPMGUS",
            "id": "212969",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "URL": 11,
            "domain": 2
          },
          "indicator_count": 14,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 31,
          "modified_text": "79 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "694bde495c4f1023c4a3c1ab",
          "name": "EbeeDec2025 Pt5",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2026-01-23T12:00:04.403000",
          "created": "2025-12-24T12:36:25.036000",
          "tags": [
            "filehashsha256",
            "filehashmd5",
            "filehashsha1",
            "yara",
            "name"
          ],
          "references": [
            "Book2.csv"
          ],
          "public": 1,
          "adversary": "WARP PANDA, UNG0801, Warlock, DPRK Operation, Webrat, Docusign-themed phishing",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 149,
            "FileHash-SHA1": 159,
            "FileHash-SHA256": 165,
            "CVE": 5,
            "URL": 86,
            "domain": 146,
            "email": 10,
            "hostname": 40
          },
          "indicator_count": 760,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 39,
          "modified_text": "127 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "694a3d1fc67140021a3a460c",
          "name": "EtherRAT dissected: How a React2Shell implant delivers 5 payloads through blockchain C2",
          "description": "The EtherRAT malware, linked potentially to North Korean threat actors, leverages the React2Shell vulnerability (CVE-2025-55182) to execute multi-faceted attacks. Deployed through a compromised Next.js application on December 5, 2025, EtherRAT operates as a fileless implant using Node.js, thus ensuring that its payloads do not interact with the disk, characteristic of fileless malware. The implant integrates command and control (C2) communications within blockchain transactions, making its activity appear legitimate while providing investigators with an immutable record on Ethereum.",
          "modified": "2026-01-22T06:03:27.219000",
          "created": "2025-12-23T06:56:31.254000",
          "tags": [
            "etherrat",
            "sysdig trt",
            "react2shell",
            "december",
            "ethereum",
            "c2 url",
            "appdata",
            "apache",
            "grabify",
            "dprk",
            "systemd",
            "april",
            "bitcoin",
            "exodus",
            "atomic",
            "phantom",
            "august",
            "blackhole",
            "worm",
            "type value",
            "smart contract",
            "deployer wallet",
            "funding wallet",
            "c2 servers",
            "ip address",
            "port purpose",
            "primary c2",
            "worm payload",
            "urls http"
          ],
          "references": [
            "https://www.sysdig.com/blog/etherrat-dissected-how-a-react2shell-implant-delivers-5-payloads-through-blockchain-c2"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            }
          ],
          "industries": [
            "Finance",
            "e-commerce"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "URL": 11,
            "domain": 2
          },
          "indicator_count": 14,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 539,
          "modified_text": "129 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Book2.csv",
        "https://atos.net/en/lp/cybershield/etherrat-distribution-spoofing-administrative-tools-via-github-facades",
        "https://www.sysdig.com/blog/etherrat-dissected-how-a-react2shell-implant-delivers-5-payloads-through-blockchain-c2"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "WARP PANDA, UNG0801, Warlock, DPRK Operation, Webrat, Docusign-themed phishing",
            "Lazarus"
          ],
          "malware_families": [
            "Etherrat"
          ],
          "industries": [
            "E-commerce",
            "Finance"
          ],
          "unique_indicators": 1041
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/grabify.link",
    "whois": "http://whois.domaintools.com/grabify.link",
    "domain": "grabify.link",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6a0b436b99318655032774a0",
      "name": "EtherRAT Campaign Targeted Enterprise Admins via SEO Poisoning",
      "description": "",
      "modified": "2026-05-18T16:50:51.805000",
      "created": "2026-05-18T16:50:51.805000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "cryptocti",
        "id": "110256",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 16,
        "URL": 64,
        "IPv4": 5,
        "domain": 46
      },
      "indicator_count": 131,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 501,
      "modified_text": "12 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69fdcf72325b49520348bb0a",
      "name": "EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades",
      "description": "In March 2026, a highly sophisticated cyber threat campaign was discovered by the Atos Threat Research Center, which specifically targets high-privilege IT personnel like enterprise administrators and security analysts. The attackers employ a dual-layered GitHub repository distribution method, leveraging Search Engine Optimization (SEO) poisoning to manipulate search results for administrative utilities, directing victims to malicious MSI installers masquerading as legitimate tools. This approach maximizes the campaign's resilience, allowing the attackers to evade takedown efforts by keeping the malicious code on secondary repositories while the primary facade remains benign and SEO-optimized.",
      "modified": "2026-05-08T11:56:34.128000",
      "created": "2026-05-08T11:56:34.128000",
      "tags": [
        "c2 address",
        "c2 ip",
        "javascript file",
        "windows process",
        "task manager",
        "ethereum smart",
        "ethereum api",
        "ip address",
        "url path",
        "run registry",
        "lazarus",
        "apt34",
        "remote access",
        "msi",
        "node.js",
        "tsundere",
        "utility spoofing",
        "threat"
      ],
      "references": [
        "https://atos.net/en/lp/cybershield/etherrat-distribution-spoofing-administrative-tools-via-github-facades"
      ],
      "public": 1,
      "adversary": "Lazarus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "EtherRAT",
          "display_name": "EtherRAT",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1204.002",
          "name": "Malicious File",
          "display_name": "T1204.002 - Malicious File"
        },
        {
          "id": "T1218.007",
          "name": "Msiexec",
          "display_name": "T1218.007 - Msiexec"
        },
        {
          "id": "T1059.003",
          "name": "Windows Command Shell",
          "display_name": "T1059.003 - Windows Command Shell"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1564.003",
          "name": "Hidden Window",
          "display_name": "T1564.003 - Hidden Window"
        },
        {
          "id": "T1036.005",
          "name": "Match Legitimate Name or Location",
          "display_name": "T1036.005 - Match Legitimate Name or Location"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1027.002",
          "name": "Software Packing",
          "display_name": "T1027.002 - Software Packing"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1016",
          "name": "System Network Configuration Discovery",
          "display_name": "T1016 - System Network Configuration Discovery"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1049",
          "name": "System Network Connections Discovery",
          "display_name": "T1049 - System Network Connections Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1033",
          "name": "System Owner/User Discovery",
          "display_name": "T1033 - System Owner/User Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        }
      ],
      "industries": [
        "Finance"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 5,
        "URL": 64,
        "hostname": 17,
        "domain": 46
      },
      "indicator_count": 132,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 540,
      "modified_text": "22 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "698bc3a0a344b3915d0a8490",
      "name": "EtherRAT dissected: How a React2Shell implant delivers 5 payloads through blockchain C2 | Sysdig",
      "description": "Find out more about Sysdig, its cloud-native security research platform, and how to keep your cloud and container networks safe from cyber attacks and other threats in real time. and here are the key points.",
      "modified": "2026-03-12T23:51:50.163000",
      "created": "2026-02-10T23:47:40.227000",
      "tags": [
        "etherrat",
        "sysdig trt",
        "react2shell",
        "december",
        "ethereum",
        "c2 url",
        "appdata",
        "apache",
        "grabify",
        "dprk",
        "systemd",
        "april",
        "bitcoin",
        "exodus",
        "atomic",
        "phantom",
        "august",
        "blackhole",
        "worm"
      ],
      "references": [
        "https://www.sysdig.com/blog/etherrat-dissected-how-a-react2shell-implant-delivers-5-payloads-through-blockchain-c2"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "SGKPMGUS",
        "id": "212969",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "URL": 11,
        "domain": 2
      },
      "indicator_count": 14,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 31,
      "modified_text": "79 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "694bde495c4f1023c4a3c1ab",
      "name": "EbeeDec2025 Pt5",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2026-01-23T12:00:04.403000",
      "created": "2025-12-24T12:36:25.036000",
      "tags": [
        "filehashsha256",
        "filehashmd5",
        "filehashsha1",
        "yara",
        "name"
      ],
      "references": [
        "Book2.csv"
      ],
      "public": 1,
      "adversary": "WARP PANDA, UNG0801, Warlock, DPRK Operation, Webrat, Docusign-themed phishing",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 149,
        "FileHash-SHA1": 159,
        "FileHash-SHA256": 165,
        "CVE": 5,
        "URL": 86,
        "domain": 146,
        "email": 10,
        "hostname": 40
      },
      "indicator_count": 760,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 39,
      "modified_text": "127 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "694a3d1fc67140021a3a460c",
      "name": "EtherRAT dissected: How a React2Shell implant delivers 5 payloads through blockchain C2",
      "description": "The EtherRAT malware, linked potentially to North Korean threat actors, leverages the React2Shell vulnerability (CVE-2025-55182) to execute multi-faceted attacks. Deployed through a compromised Next.js application on December 5, 2025, EtherRAT operates as a fileless implant using Node.js, thus ensuring that its payloads do not interact with the disk, characteristic of fileless malware. The implant integrates command and control (C2) communications within blockchain transactions, making its activity appear legitimate while providing investigators with an immutable record on Ethereum.",
      "modified": "2026-01-22T06:03:27.219000",
      "created": "2025-12-23T06:56:31.254000",
      "tags": [
        "etherrat",
        "sysdig trt",
        "react2shell",
        "december",
        "ethereum",
        "c2 url",
        "appdata",
        "apache",
        "grabify",
        "dprk",
        "systemd",
        "april",
        "bitcoin",
        "exodus",
        "atomic",
        "phantom",
        "august",
        "blackhole",
        "worm",
        "type value",
        "smart contract",
        "deployer wallet",
        "funding wallet",
        "c2 servers",
        "ip address",
        "port purpose",
        "primary c2",
        "worm payload",
        "urls http"
      ],
      "references": [
        "https://www.sysdig.com/blog/etherrat-dissected-how-a-react2shell-implant-delivers-5-payloads-through-blockchain-c2"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        }
      ],
      "industries": [
        "Finance",
        "e-commerce"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "URL": 11,
        "domain": 2
      },
      "indicator_count": 14,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 539,
      "modified_text": "129 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://grabify.link/SEFKGU",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://grabify.link/SEFKGU",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780211650.2719307
}