{
  "type": "URL",
  "indicator": "https://omikron.world",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://omikron.world",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4158759506,
      "indicator": "https://omikron.world",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 1,
      "pulses": [
        {
          "id": "6935c92c5fc93fd873c6aa6d",
          "name": "[COINBASECARTEL] - Ransomware Victim: Cinvestav - RedPacket Security | CVE-2025-11727 (New)",
          "description": "Related to multiple exploits. Government Cyber Defense implications but shows as very legitimate looking masquerading. I am not positive and don\u2019t want to move to Belfast. Populated NSA [.] gov domains and subdomains (w/o no headers) lightly researched but does not assert a government identity. \n*New CVE-2025-11727",
          "modified": "2026-01-06T18:04:02.620000",
          "created": "2025-12-07T18:36:28.055000",
          "tags": [
            "memcommit",
            "read c",
            "t1082",
            "cryptexportkey",
            "invalid pointer",
            "write",
            "msil",
            "malware",
            "media",
            "autorun",
            "countries",
            "united",
            "america",
            "high defense",
            "evasion",
            "t1055",
            "ck technique",
            "technique id",
            "allocates",
            "potential code",
            "attempts",
            "threatintel",
            "dark web",
            "coinbasecartel",
            "ransomware",
            "osint",
            "tor",
            "data breach",
            "cinvestav",
            "ai generated",
            "ransomware leak",
            "page",
            "november",
            "investigacin y",
            "nacional",
            "mexican",
            "mexico",
            "present nov",
            "verdana",
            "td tr",
            "passive dns",
            "ip address",
            "urls",
            "aaaa",
            "present may",
            "present oct",
            "present jul",
            "virtool",
            "present sep",
            "present jun",
            "win32",
            "default",
            "unicode",
            "png image",
            "rgba",
            "high",
            "dock",
            "execution",
            "xport",
            "unknown",
            "data upload",
            "extraction",
            "will",
            "data",
            "name cloudflare",
            "hostmaster name",
            "org cloudflare",
            "townsend st",
            "city san",
            "us creation",
            "kelihos",
            "ipv4",
            "present dec",
            "files",
            "domain",
            "search",
            "hostname",
            "verdict",
            "location united",
            "asn as16625",
            "akamai",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results nov",
            "present aug",
            "backdoor",
            "msie",
            "chrome",
            "trojan",
            "mtb aug",
            "worm",
            "cryp",
            "junkpoly",
            "twitter",
            "trojandropper",
            "title",
            "germany unknown",
            "ipv4 add",
            "pulse pulses",
            "hosting",
            "reverse dns",
            "cologne",
            "search engine",
            "gse compromised",
            "redacted for",
            "privacy admin",
            "privacy tech",
            "server",
            "organization",
            "street",
            "city",
            "stateprovince",
            "postal code",
            "country",
            "resolver domain",
            "cape sa",
            "virustot",
            "type pdf",
            "name",
            "lookups",
            "email abuse",
            "historical ssl",
            "certificates",
            "first",
            "graph summary",
            "cname",
            "address",
            "ip2location",
            "bogon ip",
            "admin",
            "network",
            "wifi password",
            "ssid",
            "demo",
            "details",
            "failed",
            "include review",
            "exclude sugges",
            "onlv",
            "x try",
            "find s",
            "typ url",
            "url data",
            "severity att",
            "module load",
            "icmp traffic",
            "dns query",
            "t1055 jseval",
            "windows nt",
            "port",
            "entries",
            "destination",
            "medium",
            "show",
            "pecompact",
            "june",
            "service",
            "next",
            "xserver",
            "encrypt",
            "t1129",
            "windows module",
            "dlls",
            "convention",
            "windows native"
          ],
          "references": [
            "Search Engines \u2022 Browser Extensions | Google.com.? | Duck DNS",
            "Related : Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection",
            "hallplan.vm05.iveins.de",
            "https://otx.alienvault.com/pulse/65b85faa9b8e3e1206d7f25c",
            "Masquerading as?  : bitcoin-king.nsa.mx  \u2022 cpcontacts.nsa.mx  \u2022 vulkanslot-bet777.nsa.mx",
            "Name : iveins.de  Service : connect",
            "https://www.redpacketsecurity.com/coinbasecartel-ransomware-victim-cinvestav \u2022 evilginx.redpacketsecurity.com",
            "phish-demo-poc.phish-demo-poc.redpacketsecurity.com \u2022 phish-demo-poc.redpacketsecurity.com",
            "https://otx.alienvault.com/indicator/cve/CVE-2025-11727"
          ],
          "public": 1,
          "adversary": "COINBASECARTEL",
          "targeted_countries": [
            "United States of America",
            "Sweden",
            "Bangladesh",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/Tiggre!rfn",
              "display_name": "Trojan:Win32/Tiggre!rfn",
              "target": "/malware/Trojan:Win32/Tiggre!rfn"
            },
            {
              "id": "MSIL:Agent-DQ\\ [Trj]",
              "display_name": "MSIL:Agent-DQ\\ [Trj]",
              "target": null
            },
            {
              "id": "VirTool:MSIL/Covent.A",
              "display_name": "VirTool:MSIL/Covent.A",
              "target": "/malware/VirTool:MSIL/Covent.A"
            },
            {
              "id": "Trojan:Win32/Pynamer!rfn",
              "display_name": "Trojan:Win32/Pynamer!rfn",
              "target": "/malware/Trojan:Win32/Pynamer!rfn"
            },
            {
              "id": "Win64:TrojanX",
              "display_name": "Win64:TrojanX",
              "target": null
            },
            {
              "id": "VirTool:MSIL/Covent",
              "display_name": "VirTool:MSIL/Covent",
              "target": "/malware/VirTool:MSIL/Covent"
            },
            {
              "id": "#Lowfi:HSTR:MSIL/Obfuscator.Deepsea",
              "display_name": "#Lowfi:HSTR:MSIL/Obfuscator.Deepsea",
              "target": null
            },
            {
              "id": "Win32:Malware",
              "display_name": "Win32:Malware",
              "target": null
            },
            {
              "id": "Kelihos",
              "display_name": "Kelihos",
              "target": null
            },
            {
              "id": "CVE-2025-11727",
              "display_name": "CVE-2025-11727",
              "target": null
            },
            {
              "id": "Exploit:JS/CVE-2014-0322",
              "display_name": "Exploit:JS/CVE-2014-0322",
              "target": "/malware/Exploit:JS/CVE-2014-0322"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1091",
              "name": "Replication Through Removable Media",
              "display_name": "T1091 - Replication Through Removable Media"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1098",
              "name": "Account Manipulation",
              "display_name": "T1098 - Account Manipulation"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1190",
              "name": "Exploit Public-Facing Application",
              "display_name": "T1190 - Exploit Public-Facing Application"
            }
          ],
          "industries": [
            "Education"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 144,
            "FileHash-SHA1": 117,
            "FileHash-SHA256": 1746,
            "URL": 5018,
            "hostname": 1827,
            "domain": 1072,
            "CVE": 3,
            "email": 2,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 9938,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "102 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Search Engines \u2022 Browser Extensions | Google.com.? | Duck DNS",
        "https://otx.alienvault.com/indicator/cve/CVE-2025-11727",
        "phish-demo-poc.phish-demo-poc.redpacketsecurity.com \u2022 phish-demo-poc.redpacketsecurity.com",
        "https://otx.alienvault.com/pulse/65b85faa9b8e3e1206d7f25c",
        "Name : iveins.de  Service : connect",
        "hallplan.vm05.iveins.de",
        "https://www.redpacketsecurity.com/coinbasecartel-ransomware-victim-cinvestav \u2022 evilginx.redpacketsecurity.com",
        "Masquerading as?  : bitcoin-king.nsa.mx  \u2022 cpcontacts.nsa.mx  \u2022 vulkanslot-bet777.nsa.mx",
        "Related : Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "COINBASECARTEL"
          ],
          "malware_families": [
            "Cve-2025-11727",
            "Virtool:msil/covent",
            "Exploit:js/cve-2014-0322",
            "Trojan:win32/tiggre!rfn",
            "Win64:trojanx",
            "Virtool:msil/covent.a",
            "#lowfi:hstr:msil/obfuscator.deepsea",
            "Kelihos",
            "Msil:agent-dq\\ [trj]",
            "Tofsee",
            "Win32:malware",
            "Trojan:win32/pynamer!rfn"
          ],
          "industries": [
            "Education"
          ],
          "unique_indicators": 10186
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/omikron.world",
    "whois": "http://whois.domaintools.com/omikron.world",
    "domain": "omikron.world",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 1,
  "pulses": [
    {
      "id": "6935c92c5fc93fd873c6aa6d",
      "name": "[COINBASECARTEL] - Ransomware Victim: Cinvestav - RedPacket Security | CVE-2025-11727 (New)",
      "description": "Related to multiple exploits. Government Cyber Defense implications but shows as very legitimate looking masquerading. I am not positive and don\u2019t want to move to Belfast. Populated NSA [.] gov domains and subdomains (w/o no headers) lightly researched but does not assert a government identity. \n*New CVE-2025-11727",
      "modified": "2026-01-06T18:04:02.620000",
      "created": "2025-12-07T18:36:28.055000",
      "tags": [
        "memcommit",
        "read c",
        "t1082",
        "cryptexportkey",
        "invalid pointer",
        "write",
        "msil",
        "malware",
        "media",
        "autorun",
        "countries",
        "united",
        "america",
        "high defense",
        "evasion",
        "t1055",
        "ck technique",
        "technique id",
        "allocates",
        "potential code",
        "attempts",
        "threatintel",
        "dark web",
        "coinbasecartel",
        "ransomware",
        "osint",
        "tor",
        "data breach",
        "cinvestav",
        "ai generated",
        "ransomware leak",
        "page",
        "november",
        "investigacin y",
        "nacional",
        "mexican",
        "mexico",
        "present nov",
        "verdana",
        "td tr",
        "passive dns",
        "ip address",
        "urls",
        "aaaa",
        "present may",
        "present oct",
        "present jul",
        "virtool",
        "present sep",
        "present jun",
        "win32",
        "default",
        "unicode",
        "png image",
        "rgba",
        "high",
        "dock",
        "execution",
        "xport",
        "unknown",
        "data upload",
        "extraction",
        "will",
        "data",
        "name cloudflare",
        "hostmaster name",
        "org cloudflare",
        "townsend st",
        "city san",
        "us creation",
        "kelihos",
        "ipv4",
        "present dec",
        "files",
        "domain",
        "search",
        "hostname",
        "verdict",
        "location united",
        "asn as16625",
        "akamai",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results nov",
        "present aug",
        "backdoor",
        "msie",
        "chrome",
        "trojan",
        "mtb aug",
        "worm",
        "cryp",
        "junkpoly",
        "twitter",
        "trojandropper",
        "title",
        "germany unknown",
        "ipv4 add",
        "pulse pulses",
        "hosting",
        "reverse dns",
        "cologne",
        "search engine",
        "gse compromised",
        "redacted for",
        "privacy admin",
        "privacy tech",
        "server",
        "organization",
        "street",
        "city",
        "stateprovince",
        "postal code",
        "country",
        "resolver domain",
        "cape sa",
        "virustot",
        "type pdf",
        "name",
        "lookups",
        "email abuse",
        "historical ssl",
        "certificates",
        "first",
        "graph summary",
        "cname",
        "address",
        "ip2location",
        "bogon ip",
        "admin",
        "network",
        "wifi password",
        "ssid",
        "demo",
        "details",
        "failed",
        "include review",
        "exclude sugges",
        "onlv",
        "x try",
        "find s",
        "typ url",
        "url data",
        "severity att",
        "module load",
        "icmp traffic",
        "dns query",
        "t1055 jseval",
        "windows nt",
        "port",
        "entries",
        "destination",
        "medium",
        "show",
        "pecompact",
        "june",
        "service",
        "next",
        "xserver",
        "encrypt",
        "t1129",
        "windows module",
        "dlls",
        "convention",
        "windows native"
      ],
      "references": [
        "Search Engines \u2022 Browser Extensions | Google.com.? | Duck DNS",
        "Related : Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection",
        "hallplan.vm05.iveins.de",
        "https://otx.alienvault.com/pulse/65b85faa9b8e3e1206d7f25c",
        "Masquerading as?  : bitcoin-king.nsa.mx  \u2022 cpcontacts.nsa.mx  \u2022 vulkanslot-bet777.nsa.mx",
        "Name : iveins.de  Service : connect",
        "https://www.redpacketsecurity.com/coinbasecartel-ransomware-victim-cinvestav \u2022 evilginx.redpacketsecurity.com",
        "phish-demo-poc.phish-demo-poc.redpacketsecurity.com \u2022 phish-demo-poc.redpacketsecurity.com",
        "https://otx.alienvault.com/indicator/cve/CVE-2025-11727"
      ],
      "public": 1,
      "adversary": "COINBASECARTEL",
      "targeted_countries": [
        "United States of America",
        "Sweden",
        "Bangladesh",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/Tiggre!rfn",
          "display_name": "Trojan:Win32/Tiggre!rfn",
          "target": "/malware/Trojan:Win32/Tiggre!rfn"
        },
        {
          "id": "MSIL:Agent-DQ\\ [Trj]",
          "display_name": "MSIL:Agent-DQ\\ [Trj]",
          "target": null
        },
        {
          "id": "VirTool:MSIL/Covent.A",
          "display_name": "VirTool:MSIL/Covent.A",
          "target": "/malware/VirTool:MSIL/Covent.A"
        },
        {
          "id": "Trojan:Win32/Pynamer!rfn",
          "display_name": "Trojan:Win32/Pynamer!rfn",
          "target": "/malware/Trojan:Win32/Pynamer!rfn"
        },
        {
          "id": "Win64:TrojanX",
          "display_name": "Win64:TrojanX",
          "target": null
        },
        {
          "id": "VirTool:MSIL/Covent",
          "display_name": "VirTool:MSIL/Covent",
          "target": "/malware/VirTool:MSIL/Covent"
        },
        {
          "id": "#Lowfi:HSTR:MSIL/Obfuscator.Deepsea",
          "display_name": "#Lowfi:HSTR:MSIL/Obfuscator.Deepsea",
          "target": null
        },
        {
          "id": "Win32:Malware",
          "display_name": "Win32:Malware",
          "target": null
        },
        {
          "id": "Kelihos",
          "display_name": "Kelihos",
          "target": null
        },
        {
          "id": "CVE-2025-11727",
          "display_name": "CVE-2025-11727",
          "target": null
        },
        {
          "id": "Exploit:JS/CVE-2014-0322",
          "display_name": "Exploit:JS/CVE-2014-0322",
          "target": "/malware/Exploit:JS/CVE-2014-0322"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1091",
          "name": "Replication Through Removable Media",
          "display_name": "T1091 - Replication Through Removable Media"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1098",
          "name": "Account Manipulation",
          "display_name": "T1098 - Account Manipulation"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1190",
          "name": "Exploit Public-Facing Application",
          "display_name": "T1190 - Exploit Public-Facing Application"
        }
      ],
      "industries": [
        "Education"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 144,
        "FileHash-SHA1": 117,
        "FileHash-SHA256": 1746,
        "URL": 5018,
        "hostname": 1827,
        "domain": 1072,
        "CVE": 3,
        "email": 2,
        "SSLCertFingerprint": 9
      },
      "indicator_count": 9938,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "102 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://omikron.world",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://omikron.world",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776611437.00518
}