{
  "type": "URL",
  "indicator": "https://new.boss.center",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://new.boss.center",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3468869327,
      "indicator": "https://new.boss.center",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "67ebfc921491771b15be63e3",
          "name": "CnC Spyware | Pegasus Related | Ciberespionage Campaign | Skynet | Samsung | Google | DNS Hijacking",
          "description": "Presume ser una campa\u00f1a de ciberespionaje orquestada por una organizaci\u00f3n gubernamental, dirigida hacia m\u00faltiples objetivos individuales (civiles) que consideran sospechosos. El software utilizado es similar a Pegasus, Skynet, Graphite para dispositivos Android y Mirai, Emotet, Berbew para dispositivos Linux y Windows. Los \"modus operandi\" abarcan m\u00faltiples tipos de ataques en los que participan ISP's y empresas grandes como Google. La propagaci\u00f3n de malware se realiza a trav\u00e9s de SMS con un enlace que dirige a una web con un exploit de d\u00eda cero, o tambi\u00e9n al abrir un PDF malicioso con las mismas caracter\u00edsticas. La ingenier\u00eda social juega un papel fundamental en este tipo de ataques. El tr\u00e1fico parece ser enmascarado en DNS 8.8.8.8 para no ser detectado.",
          "modified": "2025-05-05T16:00:41.799000",
          "created": "2025-04-01T14:47:46.507000",
          "tags": [
            "Government",
            "Pegasus",
            "Graphite",
            "Skynet",
            "Malware",
            "Campaign",
            "Samsung",
            "Android",
            "Unix",
            "Linux",
            "Browser",
            "Windows",
            "Zeroday",
            "Trojan"
          ],
          "references": [],
          "public": 1,
          "adversary": "Government",
          "targeted_countries": [
            "Spain",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Pegasus for Android - S0316",
              "display_name": "Pegasus for Android - S0316",
              "target": null
            },
            {
              "id": "Pegasus for Android - MOB-S0032",
              "display_name": "Pegasus for Android - MOB-S0032",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mirai",
              "display_name": "Backdoor:Win32/Mirai",
              "target": "/malware/Backdoor:Win32/Mirai"
            },
            {
              "id": "DDoS:Linux/Mirai",
              "display_name": "DDoS:Linux/Mirai",
              "target": "/malware/DDoS:Linux/Mirai"
            },
            {
              "id": "Backdoor:Linux/Mirai",
              "display_name": "Backdoor:Linux/Mirai",
              "target": "/malware/Backdoor:Linux/Mirai"
            },
            {
              "id": "TrojanDownloader:Linux/Mirai",
              "display_name": "TrojanDownloader:Linux/Mirai",
              "target": "/malware/TrojanDownloader:Linux/Mirai"
            },
            {
              "id": "Backdoor:Win32/Berbew",
              "display_name": "Backdoor:Win32/Berbew",
              "target": "/malware/Backdoor:Win32/Berbew"
            },
            {
              "id": "Trojan:JS/Berbew",
              "display_name": "Trojan:JS/Berbew",
              "target": "/malware/Trojan:JS/Berbew"
            },
            {
              "id": "TEL:Spyware:AndroidOS/SpyMax",
              "display_name": "TEL:Spyware:AndroidOS/SpyMax",
              "target": null
            },
            {
              "id": "AndroRAT - MOB-S0008",
              "display_name": "AndroRAT - MOB-S0008",
              "target": null
            },
            {
              "id": "Samsung",
              "display_name": "Samsung",
              "target": null
            },
            {
              "id": "GoogleDrive RAT",
              "display_name": "GoogleDrive RAT",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:BrowserModifier:ConsentBypass",
              "display_name": "#Lowfi:HSTR:BrowserModifier:ConsentBypass",
              "target": null
            },
            {
              "id": "Backdoor:Win32/DnsDoor",
              "display_name": "Backdoor:Win32/DnsDoor",
              "target": "/malware/Backdoor:Win32/DnsDoor"
            },
            {
              "id": "DNSpionage",
              "display_name": "DNSpionage",
              "target": null
            },
            {
              "id": "Trojan:JS/DNSChanger",
              "display_name": "Trojan:JS/DNSChanger",
              "target": "/malware/Trojan:JS/DNSChanger"
            },
            {
              "id": "#PowerShell:EncodedCommand",
              "display_name": "#PowerShell:EncodedCommand",
              "target": null
            },
            {
              "id": "ALF:Backdoor:JAVA/Webshell",
              "display_name": "ALF:Backdoor:JAVA/Webshell",
              "target": null
            },
            {
              "id": "#HSTR:HackTool:Win32/RemoteShell",
              "display_name": "#HSTR:HackTool:Win32/RemoteShell",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1596.001",
              "name": "DNS/Passive DNS",
              "display_name": "T1596.001 - DNS/Passive DNS"
            },
            {
              "id": "T1596.004",
              "name": "CDNs",
              "display_name": "T1596.004 - CDNs"
            },
            {
              "id": "T1590.002",
              "name": "DNS",
              "display_name": "T1590.002 - DNS"
            },
            {
              "id": "T1059.001",
              "name": "PowerShell",
              "display_name": "T1059.001 - PowerShell"
            },
            {
              "id": "T1184",
              "name": "SSH Hijacking",
              "display_name": "T1184 - SSH Hijacking"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1069.001",
              "name": "Local Groups",
              "display_name": "T1069.001 - Local Groups"
            },
            {
              "id": "T1568.001",
              "name": "Fast Flux DNS",
              "display_name": "T1568.001 - Fast Flux DNS"
            },
            {
              "id": "T1048.003",
              "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
              "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1404",
              "name": "Exploit OS Vulnerability",
              "display_name": "T1404 - Exploit OS Vulnerability"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1203",
              "name": "Exploitation for Client Execution",
              "display_name": "T1203 - Exploitation for Client Execution"
            },
            {
              "id": "T1211",
              "name": "Exploitation for Defense Evasion",
              "display_name": "T1211 - Exploitation for Defense Evasion"
            },
            {
              "id": "T1562.004",
              "name": "Disable or Modify System Firewall",
              "display_name": "T1562.004 - Disable or Modify System Firewall"
            },
            {
              "id": "T1003.004",
              "name": "LSA Secrets",
              "display_name": "T1003.004 - LSA Secrets"
            },
            {
              "id": "T1038",
              "name": "DLL Search Order Hijacking",
              "display_name": "T1038 - DLL Search Order Hijacking"
            },
            {
              "id": "T1055.003",
              "name": "Thread Execution Hijacking",
              "display_name": "T1055.003 - Thread Execution Hijacking"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1021.006",
              "name": "Windows Remote Management",
              "display_name": "T1021.006 - Windows Remote Management"
            },
            {
              "id": "T1076",
              "name": "Remote Desktop Protocol",
              "display_name": "T1076 - Remote Desktop Protocol"
            }
          ],
          "industries": [
            "Government",
            "Civil",
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 42,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "depdgaus",
            "id": "315837",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3592,
            "domain": 712,
            "hostname": 1246,
            "FileHash-SHA256": 900
          },
          "indicator_count": 6450,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 10,
          "modified_text": "392 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "629f32000e99da994ecb5f62",
          "name": "80880.bodis - passive DNS = CNAME bug cookie priv escalation 450 records = n. sh",
          "description": "ioc's from all passive dns records potentially using CNAME record cookie priv escalation bug to abuse and break analytics with user agent.\nmass of 404 connection errors invoked to hijack/redir traffic to top level immitation sites running on massive nubotnet",
          "modified": "2022-07-07T00:01:42.558000",
          "created": "2022-06-07T11:09:52.102000",
          "tags": [
            "n. sh",
            "CNAME cookie priv escalation",
            "CVE-2021-22941",
            "ww1",
            "neural",
            "nubotnet"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 370,
            "hostname": 1775,
            "URL": 2331,
            "domain": 453
          },
          "indicator_count": 4929,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 395,
          "modified_text": "1425 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Government"
          ],
          "malware_families": [
            "Googledrive rat",
            "Trojan:js/dnschanger",
            "Pegasus for android - s0316",
            "#powershell:encodedcommand",
            "Backdoor:win32/dnsdoor",
            "Trojandownloader:linux/mirai",
            "#lowfi:hstr:browsermodifier:consentbypass",
            "Samsung",
            "Pegasus for android - mob-s0032",
            "Androrat - mob-s0008",
            "Alf:backdoor:java/webshell",
            "Backdoor:linux/mirai",
            "Dnspionage",
            "#hstr:hacktool:win32/remoteshell",
            "Backdoor:win32/mirai",
            "Backdoor:win32/berbew",
            "Tel:spyware:androidos/spymax",
            "Trojan:js/berbew",
            "Ddos:linux/mirai"
          ],
          "industries": [
            "Healthcare",
            "Government",
            "Civil"
          ],
          "unique_indicators": 9221
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/boss.center",
    "whois": "http://whois.domaintools.com/boss.center",
    "domain": "boss.center",
    "hostname": "new.boss.center"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "67ebfc921491771b15be63e3",
      "name": "CnC Spyware | Pegasus Related | Ciberespionage Campaign | Skynet | Samsung | Google | DNS Hijacking",
      "description": "Presume ser una campa\u00f1a de ciberespionaje orquestada por una organizaci\u00f3n gubernamental, dirigida hacia m\u00faltiples objetivos individuales (civiles) que consideran sospechosos. El software utilizado es similar a Pegasus, Skynet, Graphite para dispositivos Android y Mirai, Emotet, Berbew para dispositivos Linux y Windows. Los \"modus operandi\" abarcan m\u00faltiples tipos de ataques en los que participan ISP's y empresas grandes como Google. La propagaci\u00f3n de malware se realiza a trav\u00e9s de SMS con un enlace que dirige a una web con un exploit de d\u00eda cero, o tambi\u00e9n al abrir un PDF malicioso con las mismas caracter\u00edsticas. La ingenier\u00eda social juega un papel fundamental en este tipo de ataques. El tr\u00e1fico parece ser enmascarado en DNS 8.8.8.8 para no ser detectado.",
      "modified": "2025-05-05T16:00:41.799000",
      "created": "2025-04-01T14:47:46.507000",
      "tags": [
        "Government",
        "Pegasus",
        "Graphite",
        "Skynet",
        "Malware",
        "Campaign",
        "Samsung",
        "Android",
        "Unix",
        "Linux",
        "Browser",
        "Windows",
        "Zeroday",
        "Trojan"
      ],
      "references": [],
      "public": 1,
      "adversary": "Government",
      "targeted_countries": [
        "Spain",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Pegasus for Android - S0316",
          "display_name": "Pegasus for Android - S0316",
          "target": null
        },
        {
          "id": "Pegasus for Android - MOB-S0032",
          "display_name": "Pegasus for Android - MOB-S0032",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mirai",
          "display_name": "Backdoor:Win32/Mirai",
          "target": "/malware/Backdoor:Win32/Mirai"
        },
        {
          "id": "DDoS:Linux/Mirai",
          "display_name": "DDoS:Linux/Mirai",
          "target": "/malware/DDoS:Linux/Mirai"
        },
        {
          "id": "Backdoor:Linux/Mirai",
          "display_name": "Backdoor:Linux/Mirai",
          "target": "/malware/Backdoor:Linux/Mirai"
        },
        {
          "id": "TrojanDownloader:Linux/Mirai",
          "display_name": "TrojanDownloader:Linux/Mirai",
          "target": "/malware/TrojanDownloader:Linux/Mirai"
        },
        {
          "id": "Backdoor:Win32/Berbew",
          "display_name": "Backdoor:Win32/Berbew",
          "target": "/malware/Backdoor:Win32/Berbew"
        },
        {
          "id": "Trojan:JS/Berbew",
          "display_name": "Trojan:JS/Berbew",
          "target": "/malware/Trojan:JS/Berbew"
        },
        {
          "id": "TEL:Spyware:AndroidOS/SpyMax",
          "display_name": "TEL:Spyware:AndroidOS/SpyMax",
          "target": null
        },
        {
          "id": "AndroRAT - MOB-S0008",
          "display_name": "AndroRAT - MOB-S0008",
          "target": null
        },
        {
          "id": "Samsung",
          "display_name": "Samsung",
          "target": null
        },
        {
          "id": "GoogleDrive RAT",
          "display_name": "GoogleDrive RAT",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:BrowserModifier:ConsentBypass",
          "display_name": "#Lowfi:HSTR:BrowserModifier:ConsentBypass",
          "target": null
        },
        {
          "id": "Backdoor:Win32/DnsDoor",
          "display_name": "Backdoor:Win32/DnsDoor",
          "target": "/malware/Backdoor:Win32/DnsDoor"
        },
        {
          "id": "DNSpionage",
          "display_name": "DNSpionage",
          "target": null
        },
        {
          "id": "Trojan:JS/DNSChanger",
          "display_name": "Trojan:JS/DNSChanger",
          "target": "/malware/Trojan:JS/DNSChanger"
        },
        {
          "id": "#PowerShell:EncodedCommand",
          "display_name": "#PowerShell:EncodedCommand",
          "target": null
        },
        {
          "id": "ALF:Backdoor:JAVA/Webshell",
          "display_name": "ALF:Backdoor:JAVA/Webshell",
          "target": null
        },
        {
          "id": "#HSTR:HackTool:Win32/RemoteShell",
          "display_name": "#HSTR:HackTool:Win32/RemoteShell",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1596.001",
          "name": "DNS/Passive DNS",
          "display_name": "T1596.001 - DNS/Passive DNS"
        },
        {
          "id": "T1596.004",
          "name": "CDNs",
          "display_name": "T1596.004 - CDNs"
        },
        {
          "id": "T1590.002",
          "name": "DNS",
          "display_name": "T1590.002 - DNS"
        },
        {
          "id": "T1059.001",
          "name": "PowerShell",
          "display_name": "T1059.001 - PowerShell"
        },
        {
          "id": "T1184",
          "name": "SSH Hijacking",
          "display_name": "T1184 - SSH Hijacking"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1069.001",
          "name": "Local Groups",
          "display_name": "T1069.001 - Local Groups"
        },
        {
          "id": "T1568.001",
          "name": "Fast Flux DNS",
          "display_name": "T1568.001 - Fast Flux DNS"
        },
        {
          "id": "T1048.003",
          "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
          "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1404",
          "name": "Exploit OS Vulnerability",
          "display_name": "T1404 - Exploit OS Vulnerability"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1203",
          "name": "Exploitation for Client Execution",
          "display_name": "T1203 - Exploitation for Client Execution"
        },
        {
          "id": "T1211",
          "name": "Exploitation for Defense Evasion",
          "display_name": "T1211 - Exploitation for Defense Evasion"
        },
        {
          "id": "T1562.004",
          "name": "Disable or Modify System Firewall",
          "display_name": "T1562.004 - Disable or Modify System Firewall"
        },
        {
          "id": "T1003.004",
          "name": "LSA Secrets",
          "display_name": "T1003.004 - LSA Secrets"
        },
        {
          "id": "T1038",
          "name": "DLL Search Order Hijacking",
          "display_name": "T1038 - DLL Search Order Hijacking"
        },
        {
          "id": "T1055.003",
          "name": "Thread Execution Hijacking",
          "display_name": "T1055.003 - Thread Execution Hijacking"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1021.006",
          "name": "Windows Remote Management",
          "display_name": "T1021.006 - Windows Remote Management"
        },
        {
          "id": "T1076",
          "name": "Remote Desktop Protocol",
          "display_name": "T1076 - Remote Desktop Protocol"
        }
      ],
      "industries": [
        "Government",
        "Civil",
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 42,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "depdgaus",
        "id": "315837",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3592,
        "domain": 712,
        "hostname": 1246,
        "FileHash-SHA256": 900
      },
      "indicator_count": 6450,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 10,
      "modified_text": "392 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "629f32000e99da994ecb5f62",
      "name": "80880.bodis - passive DNS = CNAME bug cookie priv escalation 450 records = n. sh",
      "description": "ioc's from all passive dns records potentially using CNAME record cookie priv escalation bug to abuse and break analytics with user agent.\nmass of 404 connection errors invoked to hijack/redir traffic to top level immitation sites running on massive nubotnet",
      "modified": "2022-07-07T00:01:42.558000",
      "created": "2022-06-07T11:09:52.102000",
      "tags": [
        "n. sh",
        "CNAME cookie priv escalation",
        "CVE-2021-22941",
        "ww1",
        "neural",
        "nubotnet"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 370,
        "hostname": 1775,
        "URL": 2331,
        "domain": 453
      },
      "indicator_count": 4929,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 395,
      "modified_text": "1425 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://new.boss.center",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://new.boss.center",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780348115.5022223
}