{ "type": "URL", "indicator": "https://phpsymfony.com/css3/index2.shtml", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://phpsymfony.com/css3/index2.shtml", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4053734805, "indicator": "https://phpsymfony.com/css3/index2.shtml", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "67ea888fa30c32d310f46b3c", "name": "Operation HollowQuill: Russian R&D Networks Targeted via Decoy PDFs", "description": "Operation HollowQuill targets Russian research and defense networks, particularly the Baltic State Technical University, using weaponized decoy documents disguised as research invitations. The attack chain involves a malicious RAR file containing a .NET dropper, which deploys a Golang-based shellcode loader and a legitimate OneDrive application. The final payload is a Cobalt Strike beacon. The campaign focuses on academic institutions, military and defense industries, aerospace and missile technology, and government-oriented research entities within the Russian Federation. The threat actor employs sophisticated techniques, including anti-analysis measures, APC injection, and infrastructure rotation across multiple ASNs.", "modified": "2025-03-31T15:51:06.917000", "created": "2025-03-31T12:20:31.438000", "tags": [ "defense industry", "cobalt strike", "shellcode loader", "russian r&d", "decoy pdfs", "academic institutions", "baltic state technical university", "operation hollowquill" ], "references": [ "https://www.seqrite.com/blog/operation-hollowquill-russian-rd-networks-malware-pdf/" ], "public": 1, "adversary": "", "targeted_countries": [ "Russian Federation" ], "malware_families": [ { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null } ], "attack_ids": [ { "id": "T1053.005", "name": "Scheduled Task", "display_name": "T1053.005 - Scheduled Task" }, { "id": "T1132.001", "name": "Standard Encoding", "display_name": "T1132.001 - Standard Encoding" }, { "id": "T1204.002", "name": "Malicious File", "display_name": "T1204.002 - Malicious File" }, { "id": "T1566.001", "name": "Spearphishing Attachment", "display_name": "T1566.001 - Spearphishing Attachment" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1497.003", "name": "Time Based Evasion", "display_name": "T1497.003 - Time Based Evasion" }, { "id": "T1055.004", "name": "Asynchronous Procedure Call", "display_name": "T1055.004 - Asynchronous Procedure Call" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "display_name": "T1547.001 - Registry Run Keys / Startup Folder" } ], "industries": [ "Defense", "Education", "Aerospace", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "URL": 1, "hostname": 1 }, "indicator_count": 5, "is_author": false, "is_subscribing": null, "subscriber_count": 377787, "modified_text": "385 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67f30d1e5f894bef93248ddd", "name": "InQuest - 06-04-2025", "description": "", "modified": "2025-05-06T23:04:02.399000", "created": "2025-04-06T23:24:14.704000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 100, "URL": 435, "domain": 113, "FileHash-SHA256": 614, "FileHash-SHA1": 26, "FileHash-MD5": 22 }, "indicator_count": 1310, "is_author": false, "is_subscribing": null, "subscriber_count": 1601, "modified_text": "348 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67f1bbda9e928a3743d1c379", "name": "InQuest - 05-04-2025", "description": "", "modified": "2025-05-05T23:03:32.288000", "created": "2025-04-05T23:25:13.994000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 569, "FileHash-SHA256": 550, "domain": 150, "hostname": 107, "FileHash-SHA1": 39, "FileHash-MD5": 41 }, "indicator_count": 1456, "is_author": false, "is_subscribing": null, "subscriber_count": 1601, "modified_text": "349 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67f06bc5e8059cb562270235", "name": "InQuest - 04-04-2025", "description": "", "modified": "2025-05-04T23:03:41.880000", "created": "2025-04-04T23:31:17.659000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 659, "FileHash-SHA256": 572, "FileHash-SHA1": 30, "FileHash-MD5": 43, "hostname": 138, "domain": 135 }, "indicator_count": 1577, "is_author": false, "is_subscribing": null, "subscriber_count": 1602, "modified_text": "350 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67ef1968f9c1c05c07ef00c0", "name": "InQuest - 03-04-2025", "description": "", "modified": "2025-05-03T23:03:06.090000", "created": "2025-04-03T23:27:36.140000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 533, "FileHash-MD5": 38, "URL": 728, "hostname": 134, "domain": 157, "FileHash-SHA1": 47 }, "indicator_count": 1637, "is_author": false, "is_subscribing": null, "subscriber_count": 1600, "modified_text": "351 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67edc9471b28e16af7425847", "name": "InQuest - 02-04-2025", "description": "", "modified": "2025-05-02T23:03:33.268000", "created": "2025-04-02T23:33:27.853000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 723, "FileHash-SHA256": 455, "domain": 142, "FileHash-MD5": 37, "hostname": 136, "FileHash-SHA1": 52 }, "indicator_count": 1545, "is_author": false, "is_subscribing": null, "subscriber_count": 1600, "modified_text": "352 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://labs.inquest.net/iocdb", "https://www.seqrite.com/blog/operation-hollowquill-russian-rd-networks-malware-pdf/" ], "related": { "alienvault": { "adversary": [], "malware_families": [ "Cobalt strike - s0154" ], "industries": [ "Education", "Government", "Defense", "Aerospace" ], "unique_indicators": 5 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 2596 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/phpsymfony.com", "whois": "http://whois.domaintools.com/phpsymfony.com", "domain": "phpsymfony.com", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "67ea888fa30c32d310f46b3c", "name": "Operation HollowQuill: Russian R&D Networks Targeted via Decoy PDFs", "description": "Operation HollowQuill targets Russian research and defense networks, particularly the Baltic State Technical University, using weaponized decoy documents disguised as research invitations. The attack chain involves a malicious RAR file containing a .NET dropper, which deploys a Golang-based shellcode loader and a legitimate OneDrive application. The final payload is a Cobalt Strike beacon. The campaign focuses on academic institutions, military and defense industries, aerospace and missile technology, and government-oriented research entities within the Russian Federation. The threat actor employs sophisticated techniques, including anti-analysis measures, APC injection, and infrastructure rotation across multiple ASNs.", "modified": "2025-03-31T15:51:06.917000", "created": "2025-03-31T12:20:31.438000", "tags": [ "defense industry", "cobalt strike", "shellcode loader", "russian r&d", "decoy pdfs", "academic institutions", "baltic state technical university", "operation hollowquill" ], "references": [ "https://www.seqrite.com/blog/operation-hollowquill-russian-rd-networks-malware-pdf/" ], "public": 1, "adversary": "", "targeted_countries": [ "Russian Federation" ], "malware_families": [ { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null } ], "attack_ids": [ { "id": "T1053.005", "name": "Scheduled Task", "display_name": "T1053.005 - Scheduled Task" }, { "id": "T1132.001", "name": "Standard Encoding", "display_name": "T1132.001 - Standard Encoding" }, { "id": "T1204.002", "name": "Malicious File", "display_name": "T1204.002 - Malicious File" }, { "id": "T1566.001", "name": "Spearphishing Attachment", "display_name": "T1566.001 - Spearphishing Attachment" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1497.003", "name": "Time Based Evasion", "display_name": "T1497.003 - Time Based Evasion" }, { "id": "T1055.004", "name": "Asynchronous Procedure Call", "display_name": "T1055.004 - Asynchronous Procedure Call" }, { "id": "T1547.001", "name": "Registry Run Keys / Startup Folder", "display_name": "T1547.001 - Registry Run Keys / Startup Folder" } ], "industries": [ "Defense", "Education", "Aerospace", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "URL": 1, "hostname": 1 }, "indicator_count": 5, "is_author": false, "is_subscribing": null, "subscriber_count": 377787, "modified_text": "385 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67f30d1e5f894bef93248ddd", "name": "InQuest - 06-04-2025", "description": "", "modified": "2025-05-06T23:04:02.399000", "created": "2025-04-06T23:24:14.704000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 100, "URL": 435, "domain": 113, "FileHash-SHA256": 614, "FileHash-SHA1": 26, "FileHash-MD5": 22 }, "indicator_count": 1310, "is_author": false, "is_subscribing": null, "subscriber_count": 1601, "modified_text": "348 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67f1bbda9e928a3743d1c379", "name": "InQuest - 05-04-2025", "description": "", "modified": "2025-05-05T23:03:32.288000", "created": "2025-04-05T23:25:13.994000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 569, "FileHash-SHA256": 550, "domain": 150, "hostname": 107, "FileHash-SHA1": 39, "FileHash-MD5": 41 }, "indicator_count": 1456, "is_author": false, "is_subscribing": null, "subscriber_count": 1601, "modified_text": "349 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67f06bc5e8059cb562270235", "name": "InQuest - 04-04-2025", "description": "", "modified": "2025-05-04T23:03:41.880000", "created": "2025-04-04T23:31:17.659000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 659, "FileHash-SHA256": 572, "FileHash-SHA1": 30, "FileHash-MD5": 43, "hostname": 138, "domain": 135 }, "indicator_count": 1577, "is_author": false, "is_subscribing": null, "subscriber_count": 1602, "modified_text": "350 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67ef1968f9c1c05c07ef00c0", "name": "InQuest - 03-04-2025", "description": "", "modified": "2025-05-03T23:03:06.090000", "created": "2025-04-03T23:27:36.140000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 533, "FileHash-MD5": 38, "URL": 728, "hostname": 134, "domain": 157, "FileHash-SHA1": 47 }, "indicator_count": 1637, "is_author": false, "is_subscribing": null, "subscriber_count": 1600, "modified_text": "351 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67edc9471b28e16af7425847", "name": "InQuest - 02-04-2025", "description": "", "modified": "2025-05-02T23:03:33.268000", "created": "2025-04-02T23:33:27.853000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 723, "FileHash-SHA256": 455, "domain": 142, "FileHash-MD5": 37, "hostname": 136, "FileHash-SHA1": 52 }, "indicator_count": 1545, "is_author": false, "is_subscribing": null, "subscriber_count": 1600, "modified_text": "352 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://phpsymfony.com/css3/index2.shtml", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://phpsymfony.com/css3/index2.shtml", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776711746.5865102 }