{
  "type": "URL",
  "indicator": "https://plugins.flowplayer.videos.ringpublishing.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://plugins.flowplayer.videos.ringpublishing.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4142626607,
      "indicator": "https://plugins.flowplayer.videos.ringpublishing.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "691439014fa9d79406a83e8e",
          "name": "Mirai Botnet \u2022 Michael Crincoli - | Patient Fusion",
          "description": "I researched this doctor because of patient documentation of  unethical practices , injury , blood toxicity and other very strange circumstances experienced by a monitored target. \nMD is based in Arizona, comes to Denver for certain cases. There weren\u2019t any follow ups or return calls after serious side affects that needed aggressive intervention.",
          "modified": "2025-12-12T05:04:18.490000",
          "created": "2025-11-12T07:36:33.673000",
          "tags": [
            "practice fusion",
            "patient fusion",
            "ave suite",
            "denver",
            "help log",
            "physical",
            "medicine",
            "book",
            "friday",
            "united",
            "present aug",
            "present nov",
            "present oct",
            "present sep",
            "present jul",
            "present jun",
            "ip address",
            "url analysis",
            "msie",
            "chrome",
            "formbook cnc",
            "checkin",
            "win64",
            "next associated",
            "smokeloader",
            "twitter",
            "cookie",
            "ipv4",
            "hosting",
            "suite",
            "verdict",
            "present may",
            "domain add",
            "files show",
            "avast avg",
            "post",
            "http traffic",
            "high",
            "south korea",
            "taiwan as3462",
            "python",
            "agent",
            "malware",
            "russia asnone",
            "czechia as51420",
            "italy as47217",
            "belgium as5432",
            "serbia as15958",
            "germany as34011",
            "contacted",
            "file score",
            "detections elf",
            "eseries device",
            "rce attempt",
            "outbound python",
            "user agent",
            "p2p_cnc",
            "network_http_post",
            "network_http",
            "network_cnc_http",
            "dead_host",
            "network_icmp",
            "osquery_detection",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "signing defense",
            "tcp syn",
            "resolverror",
            "yara detections",
            "expl",
            "ddos",
            "icmp traffic",
            "copy",
            "mirai",
            "writes_to_stdout",
            "nolookup_communication",
            "tcp_syn_scan",
            "network_icmp",
            "host",
            "network_irc",
            "crincoli",
            "md",
            "mirai botnet",
            "brian sabey",
            "hall render",
            "michael crincoli",
            "palantir",
            "foundry"
          ],
          "references": [
            "https://www.patientfusion.com/doctor/michael-crincoli-59108",
            "demos.palantirfoundry.com",
            "http://southwestphysiatry.com/",
            "IDS Detections: Linksys E-Series Device RCE Attempt Outbound",
            "IDS Detections: Python Requests Suspicious User Agent",
            "IDS Detections: HTTP traffic on port 443 (POST)",
            "IDS Detections : Mirai Variant Spreading",
            "Yara Detections :  Mirai_Botnet_Malware ,  Mirai_2 ,  is__elf ,  Linux_Mirai",
            "Yara: Descriptive: Mirai_Botnet_Malware /dev/misc/watchdog \u2022 Mirai_2 /dev/watchdog",
            "Yara Descriptive: \u2022  is__elf \u007fELF \u2022  Linux_Mirai /dev/watchdog",
            "http://www.hallrender.com/attorney/brian-sabey/anyxxxtube.net/search-porn/tsara-brashears",
            "http://www.hallrender.com/attorney/brian-sabey-anyxxxtube.net/search-porn/tsara-brashears",
            "click.marketing.hallrender.com \u2022 hallrender.com \u2022 autodiscover.hallrender.com",
            "https://click.marketing.hallrender.com/?qs=9f3b0a760973d5628ba046a192f7fe432889bb96dc51578763a9cf11358dcde635e137184c12a031617f00faa9d172d8",
            "hallrender.com \u2022 wwdancehall.com \u2022 hallplan.vm05.iveins.de\t \u2022 iveins.de \u2022 http://hallplan.vm05.iveins.de",
            "prosperhall.edsby.com \u2022 http://urlmail.hallrender.com \u2022 http://urlwww.hallrender.com \u2022 http://webdocs.hallrender.com",
            "http://elite.hallrender.com/TE_3E_PROD/web/ui/dashboard/ActionList_CCC",
            "https://hallrender.com/attorney/brian-sabey/Accept \u2022 https://hallrender.com/wp-content/uploads/vcards/",
            "http://hallrender.com/attorney/bsabey \u2022 http://hallrender.com/attorney/gregg-m-wallander",
            "http://hallrender.com/attorney/gregg-m-wallander/\u2022 http://hallrender.com/resources/ \u2022 http://hallrender.com/resources/blog/ \u2022 http://officemarketing.hallrender.com/ \u2022 http://urlmail.hallrender.com \u2022 http://urlwww.hallrender.com \u2022 http://webdocs.hallrender.com/",
            "The Hall Render Brian Sabey malicious media campaign was so unexpected.",
            "MD refused to disclose medication cocktail he was injecting into patient. Patient suffered long term  harm."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Italy",
            "Netherlands",
            "Russian Federation",
            "Belgium",
            "Germany",
            "Serbia",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Unix.Trojan.Gafgyt-6748839-0",
              "display_name": "Unix.Trojan.Gafgyt-6748839-0",
              "target": null
            },
            {
              "id": "ELF:Hajime-R\\ [Trj]",
              "display_name": "ELF:Hajime-R\\ [Trj]",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Mirai Variant Spreading",
              "display_name": "Mirai Variant Spreading",
              "target": null
            },
            {
              "id": "DDoS:Linux/Gafgyt",
              "display_name": "DDoS:Linux/Gafgyt",
              "target": "/malware/DDoS:Linux/Gafgyt"
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1564.005",
              "name": "Hidden File System",
              "display_name": "T1564.005 - Hidden File System"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 5572,
            "domain": 788,
            "hostname": 1607,
            "email": 6,
            "FileHash-SHA256": 505,
            "FileHash-MD5": 132,
            "FileHash-SHA1": 128,
            "CVE": 2
          },
          "indicator_count": 8740,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "128 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6910cafb096eae0dcb39a800",
          "name": "Lawyers & Lazarus | Apple Spy : Treece Alfrey Musat P.C., Chris P. Ahmann Colorado State \u2022 Tam Legal Special Cousel for egregious",
          "description": "Chronicles of how  quasi government , a State owned criminal defense attorney , protects sexual assaulter Jeffrey Reimer DPT.   victim Palantir harassed, withheld healthcare , diagnoses, justice, monetary award for injured, stole insurance policies, hacked Denver artists, sold music her to artists whom profited, hacked  Denver music studios, hired stalkers, human, controlled phone , car and everything in targets life including , doctors, attorneys, hospitals. It\u2019s always been clear to coming us that Anonymous and Lazarus are the police, judge , lawyer, ransom racist.\nThis group alone has cost the US billions! Responsible for 2014 Sony hack , FMOE.\nDirect Link. by phone , email in person contact , forced settlement hearing,. Adversarial Christopher P. Ahmann , relationship w / Lazarus group, hitmen , cyber crime and other crimes against persons.\n #rip #christopher_ahmann #palantir #lazarus #target_tsara_brashears",
          "modified": "2025-12-09T17:03:48.645000",
          "created": "2025-11-09T17:10:19.498000",
          "tags": [
            "url http",
            "apple",
            "california",
            "apple public",
            "server rsa",
            "organization",
            "stateprovince",
            "ocsp",
            "nids united",
            "files",
            "united",
            "unknown ns",
            "ip address",
            "domain",
            "urls files",
            "passive dns",
            "found title",
            "sf hello",
            "myriad set",
            "pro myriad",
            "set lucida",
            "grande arial",
            "sf mono",
            "ipv4",
            "location united",
            "america flag",
            "america asn",
            "verdict",
            "files ip",
            "address",
            "as42 woodynet",
            "domain add",
            "ipv4 add",
            "reverse dns",
            "trojan",
            "name servers",
            "emails",
            "for privacy",
            "ltd dba",
            "com laude",
            "servers",
            "expiration date",
            "urls",
            "meta",
            "a domains",
            "country code",
            "store home",
            "title",
            "accept",
            "espaol",
            "english",
            "evil corp",
            "see all",
            "cyber hack",
            "republic",
            "canada",
            "season",
            "joe tidy",
            "sarah rainsford",
            "podcast",
            "bank",
            "ukraine",
            "dead",
            "indonesia",
            "police",
            "premium",
            "napoleon",
            "revolution",
            "michelangelo",
            "mozart",
            "global",
            "solid",
            "lazarus",
            "jabber zeus",
            "harrods",
            "ta markmonitor",
            "markmonitor",
            "search",
            "present aug",
            "unknown aaaa",
            "unknown soa",
            "win32",
            "invalid url",
            "trojanspy",
            "mtb apr",
            "backdoor",
            "next associated",
            "win64",
            "trojandropper",
            "twitter",
            "virtool",
            "ransom",
            "worm",
            "dynamicloader",
            "tlsv1",
            "high",
            "globalc",
            "medium",
            "windows",
            "cmd c",
            "delete c",
            "stream",
            "write",
            "next",
            "process32nextw",
            "http host",
            "dns query",
            "likely gandcrab",
            "et trojan",
            "windows nt",
            "wow64",
            "malware",
            "ms windows",
            "as16509",
            "as54113",
            "yara rule",
            "pe32 executable",
            "as15169",
            "powershell",
            "unknown",
            "response ip",
            "address google",
            "safe browsing",
            "hostname add",
            "port",
            "destination",
            "pe32",
            "intel",
            "error",
            "show",
            "delphi",
            "dcom",
            "form",
            "canvas",
            "united kingdom",
            "content type",
            "security",
            "moved",
            "great britain",
            "unknown a",
            "body doctype",
            "html public",
            "ietfdtd html",
            "showing",
            "packing t1045",
            "bytes",
            "read",
            "default",
            "christoper p ahmann",
            "target",
            "victims",
            "tsara brashears",
            "url https",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "present nov",
            "present oct",
            "date",
            "tcpmemhit",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "sha256",
            "sha1",
            "mitre att",
            "pattern match",
            "show technique",
            "ck matrix",
            "null",
            "refresh",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "palantir",
            "foundry",
            "hitmen",
            "quasi",
            "government contracts",
            "jeffrey reimer",
            "hallrender",
            "workers compensation",
            "record value",
            "certificate"
          ],
          "references": [
            "apple-dns.net , http://www.pestcontrol-appleton.com/ multiple Apple IoC",
            "https://podcasts.apple.com/us/podcast/the-lazarus-heist/id1561990291",
            "https://tamlegal.com/attorneys/christopher-p-ahmann/",
            "bpc-old.palantirfoundry.com",
            "OTX auto populated  targeted groups.",
            "You have no idea where artists get their music or how the 5 main songwriters harvest songs from independent artists",
            "Target had endured hired hitman , physical attacks, vehicle attacks, gunpoint",
            "Assaulter Jeffrey Scott Reimer DPT isn\u2019t worth his monthly salary let alone all of this support",
            "Using Palantir Foundry tools have created a new false background for Brashears. Should be illegal.",
            "They blatantly steal from citizens , blame foreign entities.",
            "This is truly \u2019waste, fraud and abuse\u2019 usually a phrase used by insurance agents."
          ],
          "public": 1,
          "adversary": "Lazarus",
          "targeted_countries": [
            "Bangladesh",
            "Japan",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "ALF:SpikeAexR.PEVPSZL",
              "display_name": "ALF:SpikeAexR.PEVPSZL",
              "target": null
            },
            {
              "id": "Ransom:MSIL/GandCrab",
              "display_name": "Ransom:MSIL/GandCrab",
              "target": "/malware/Ransom:MSIL/GandCrab"
            },
            {
              "id": "Zeus",
              "display_name": "Zeus",
              "target": null
            },
            {
              "id": "Ransom:Win32/Gandcrab.H!MTB",
              "display_name": "Ransom:Win32/Gandcrab.H!MTB",
              "target": "/malware/Ransom:Win32/Gandcrab.H!MTB"
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1094",
              "name": "Custom Command and Control Protocol",
              "display_name": "T1094 - Custom Command and Control Protocol"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [
            "Banks",
            "Crypto",
            "Entertainment",
            "Bank"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4572,
            "FileHash-MD5": 196,
            "domain": 1523,
            "hostname": 1393,
            "FileHash-SHA256": 2400,
            "FileHash-SHA1": 175,
            "email": 18,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 10285,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "130 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69138a8144a8bf8040a92711",
          "name": "Lawyers & Lazarus | Apple Spy : Treece Alfrey Musat P.C., Chris P. Ahmann Colorado State \u2022 Tam Legal Special Counsel for egregious criminal acts \u2022 Christopher P. Ahmann attorney at Large",
          "description": "",
          "modified": "2025-12-09T17:03:48.645000",
          "created": "2025-11-11T19:12:01.843000",
          "tags": [
            "url http",
            "apple",
            "california",
            "apple public",
            "server rsa",
            "organization",
            "stateprovince",
            "ocsp",
            "nids united",
            "files",
            "united",
            "unknown ns",
            "ip address",
            "domain",
            "urls files",
            "passive dns",
            "found title",
            "sf hello",
            "myriad set",
            "pro myriad",
            "set lucida",
            "grande arial",
            "sf mono",
            "ipv4",
            "location united",
            "america flag",
            "america asn",
            "verdict",
            "files ip",
            "address",
            "as42 woodynet",
            "domain add",
            "ipv4 add",
            "reverse dns",
            "trojan",
            "name servers",
            "emails",
            "for privacy",
            "ltd dba",
            "com laude",
            "servers",
            "expiration date",
            "urls",
            "meta",
            "a domains",
            "country code",
            "store home",
            "title",
            "accept",
            "espaol",
            "english",
            "evil corp",
            "see all",
            "cyber hack",
            "republic",
            "canada",
            "season",
            "joe tidy",
            "sarah rainsford",
            "podcast",
            "bank",
            "ukraine",
            "dead",
            "indonesia",
            "police",
            "premium",
            "napoleon",
            "revolution",
            "michelangelo",
            "mozart",
            "global",
            "solid",
            "lazarus",
            "jabber zeus",
            "harrods",
            "ta markmonitor",
            "markmonitor",
            "search",
            "present aug",
            "unknown aaaa",
            "unknown soa",
            "win32",
            "invalid url",
            "trojanspy",
            "mtb apr",
            "backdoor",
            "next associated",
            "win64",
            "trojandropper",
            "twitter",
            "virtool",
            "ransom",
            "worm",
            "dynamicloader",
            "tlsv1",
            "high",
            "globalc",
            "medium",
            "windows",
            "cmd c",
            "delete c",
            "stream",
            "write",
            "next",
            "process32nextw",
            "http host",
            "dns query",
            "likely gandcrab",
            "et trojan",
            "windows nt",
            "wow64",
            "malware",
            "ms windows",
            "as16509",
            "as54113",
            "yara rule",
            "pe32 executable",
            "as15169",
            "powershell",
            "unknown",
            "response ip",
            "address google",
            "safe browsing",
            "hostname add",
            "port",
            "destination",
            "pe32",
            "intel",
            "error",
            "show",
            "delphi",
            "dcom",
            "form",
            "canvas",
            "united kingdom",
            "content type",
            "security",
            "moved",
            "great britain",
            "unknown a",
            "body doctype",
            "html public",
            "ietfdtd html",
            "showing",
            "packing t1045",
            "bytes",
            "read",
            "default",
            "christoper p ahmann",
            "target",
            "victims",
            "tsara brashears",
            "url https",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "p1377925676",
            "gaz1",
            "sid1696503456",
            "present nov",
            "present oct",
            "date",
            "tcpmemhit",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "sha256",
            "sha1",
            "mitre att",
            "pattern match",
            "show technique",
            "ck matrix",
            "null",
            "refresh",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "palantir",
            "foundry",
            "hitmen",
            "quasi",
            "government contracts",
            "jeffrey reimer",
            "hallrender",
            "workers compensation",
            "record value",
            "certificate"
          ],
          "references": [
            "apple-dns.net , http://www.pestcontrol-appleton.com/ multiple Apple IoC",
            "https://podcasts.apple.com/us/podcast/the-lazarus-heist/id1561990291",
            "https://tamlegal.com/attorneys/christopher-p-ahmann/",
            "bpc-old.palantirfoundry.com",
            "OTX auto populated  targeted groups.",
            "You have no idea where artists get their music or how the 5 main songwriters harvest songs from independent artists",
            "Target had endured hired hitman , physical attacks, vehicle attacks, gunpoint",
            "Assaulter Jeffrey Scott Reimer DPT isn\u2019t worth his monthly salary let alone all of this support",
            "Using Palantir Foundry tools have created a new false background for Brashears. Should be illegal.",
            "They blatantly steal from citizens , blame foreign entities.",
            "This is truly \u2019waste, fraud and abuse\u2019 usually a phrase used by insurance agents."
          ],
          "public": 1,
          "adversary": "Lazarus",
          "targeted_countries": [
            "Bangladesh",
            "Japan",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "ALF:SpikeAexR.PEVPSZL",
              "display_name": "ALF:SpikeAexR.PEVPSZL",
              "target": null
            },
            {
              "id": "Ransom:MSIL/GandCrab",
              "display_name": "Ransom:MSIL/GandCrab",
              "target": "/malware/Ransom:MSIL/GandCrab"
            },
            {
              "id": "Zeus",
              "display_name": "Zeus",
              "target": null
            },
            {
              "id": "Ransom:Win32/Gandcrab.H!MTB",
              "display_name": "Ransom:Win32/Gandcrab.H!MTB",
              "target": "/malware/Ransom:Win32/Gandcrab.H!MTB"
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1094",
              "name": "Custom Command and Control Protocol",
              "display_name": "T1094 - Custom Command and Control Protocol"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [
            "Banks",
            "Crypto",
            "Entertainment",
            "Bank"
          ],
          "TLP": "white",
          "cloned_from": "6910cafb096eae0dcb39a800",
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4572,
            "FileHash-MD5": 196,
            "domain": 1523,
            "hostname": 1393,
            "FileHash-SHA256": 2400,
            "FileHash-SHA1": 175,
            "email": 18,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 10285,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "130 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68fbc84609098d17c316f23c",
          "name": "NSO - Multiple crimes",
          "description": "Multiple crimes including illegal gambling, loan sharking, cybercrimes , content reputation , instructions. Starfield seen again. Team 8 has seen Starfield in more than 300 pulses. Now it\u2019s gone. Check your devices for innocent looking searches you\u2019ve never searched. Browser extensions found on 3 targeted devices with an adversary with full CnC armed with a deletion and disk wipe service. Local - Denver. \n\nAlso, very concerning is specific Airline to be attacked revealed. It cant be researched without bringing down a flight or messing up air command & control. DJT has already made travel a risky feat by being influenced to fire the (NOAA) & (DOT). Its manipulation. PP Mafia bros. \n\nDoes anyone have any power? Contact someone. We did have a mystery plane incident in Denver after I first reported. Just space junk , ya know the usual. I am serious about preventing crime. I need some help!",
          "modified": "2025-11-23T17:00:58.297000",
          "created": "2025-10-24T18:41:10.936000",
          "tags": [
            "type indicator",
            "added active",
            "related pulses",
            "script urls",
            "united",
            "unknown ns",
            "a domains",
            "ip address",
            "meta",
            "asn as13335",
            "msie",
            "chrome",
            "ransom",
            "trojan",
            "passive dns",
            "backdoor",
            "http request",
            "twitter",
            "win32/crix.c check-in",
            "gmt content",
            "ipv4",
            "urls",
            "files",
            "data upload",
            "extraction",
            "domain add",
            "e emeseieee",
            "dynamicloader",
            "e eue",
            "eweienedeoewese",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "edeeefeaeuelete",
            "unknown",
            "write",
            "bits",
            "malware",
            "xserver",
            "encrypt",
            "unknown aaaa",
            "moved",
            "cloudfront x",
            "hio52 p1",
            "name servers",
            "accept encoding",
            "emails",
            "servers",
            "extr",
            "u a640",
            "a69f u",
            "fe2e fe2f",
            "u a720",
            "a7ff",
            "u feff",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "pattern match",
            "mitre att",
            "null",
            "body",
            "pizza",
            "friday",
            "hybrid",
            "general",
            "local",
            "path",
            "starfield",
            "iframe",
            "click",
            "strings",
            "core",
            "bet",
            "gambling",
            "record value",
            "date",
            "present sep",
            "present apr",
            "colombia",
            "present jun",
            "present nov",
            "cookie",
            "present oct",
            "entries",
            "next associated",
            "error",
            "attack",
            "government",
            "scotland",
            "news",
            "covid19",
            "subscribe",
            "october",
            "crown copyright",
            "nhs scotland",
            "parliament",
            "coronavirus",
            "redacted for",
            "domain status",
            "server",
            "privacy tech",
            "privacy admin",
            "email",
            "country",
            "postal code",
            "stateprovince",
            "code",
            "host name",
            "rdap database",
            "handle",
            "iana registrar",
            "entity roles",
            "links",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cnr12",
            "validity",
            "subject public",
            "key info",
            "medium",
            "write c",
            "search",
            "pe file",
            "high",
            "checks",
            "http",
            "delete",
            "copy",
            "guard",
            "mozilla",
            "next",
            "godaddy",
            "creation date",
            "hostname",
            "pulse submit",
            "url analysis",
            "domain",
            "files ip",
            "trojandropper",
            "mtb oct",
            "mtb may",
            "refloadapihash",
            "foundry",
            "fastly",
            "value a",
            "com laude",
            "ltd dba",
            "nomiq",
            "limited dba",
            "pulse",
            "location united",
            "asn asnone",
            "nameservers"
          ],
          "references": [
            "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
            "fazendabetb.live \u2022 bowiesports.com Check first???",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
            "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
            "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
            "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
            "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
            "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
            "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
            "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
            "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
            "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
            "The Scottish Government www.gov.scot The NHS Scotland support",
            "http://129.2.4.2/32 Lencr",
            "qlw020.managed-sprint.dynalabs.io (Check)",
            "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
            "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
            "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
            "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
            "ExternalHosts: US",
            "Starfield again - HoneyPot / Dod- DoW",
            "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
            "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
            "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
          ],
          "public": 1,
          "adversary": "NSO",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Bulgaria",
            "Singapore",
            "Denmark",
            "Australia",
            "Jersey",
            "Japan",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Upatre",
              "display_name": "Upatre",
              "target": null
            },
            {
              "id": "Autoit",
              "display_name": "Autoit",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti",
              "display_name": "Ransom:Win32/Crowti",
              "target": "/malware/Ransom:Win32/Crowti"
            },
            {
              "id": "Backdoor:Win32/Tofsee.",
              "display_name": "Backdoor:Win32/Tofsee.",
              "target": "/malware/Backdoor:Win32/Tofsee."
            },
            {
              "id": "#Lowfi:SIGATTR:DownloadAndExecute",
              "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
              "target": null
            },
            {
              "id": "Win.Dropper.Vbclone",
              "display_name": "Win.Dropper.Vbclone",
              "target": null
            },
            {
              "id": "Win.Packer",
              "display_name": "Win.Packer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6261,
            "domain": 1806,
            "hostname": 2427,
            "FileHash-MD5": 384,
            "FileHash-SHA1": 381,
            "email": 13,
            "FileHash-SHA256": 1418,
            "SSLCertFingerprint": 14
          },
          "indicator_count": 12704,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "146 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68fc18514965ccd3b55c216d",
          "name": "Dorv \u2022 Obfuscator - Affecting DropBox",
          "description": "",
          "modified": "2025-11-23T17:00:58.297000",
          "created": "2025-10-25T00:22:41.686000",
          "tags": [
            "type indicator",
            "added active",
            "related pulses",
            "script urls",
            "united",
            "unknown ns",
            "a domains",
            "ip address",
            "meta",
            "asn as13335",
            "msie",
            "chrome",
            "ransom",
            "trojan",
            "passive dns",
            "backdoor",
            "http request",
            "twitter",
            "win32/crix.c check-in",
            "gmt content",
            "ipv4",
            "urls",
            "files",
            "data upload",
            "extraction",
            "domain add",
            "e emeseieee",
            "dynamicloader",
            "e eue",
            "eweienedeoewese",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "edeeefeaeuelete",
            "unknown",
            "write",
            "bits",
            "malware",
            "xserver",
            "encrypt",
            "unknown aaaa",
            "moved",
            "cloudfront x",
            "hio52 p1",
            "name servers",
            "accept encoding",
            "emails",
            "servers",
            "extr",
            "u a640",
            "a69f u",
            "fe2e fe2f",
            "u a720",
            "a7ff",
            "u feff",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "pattern match",
            "mitre att",
            "null",
            "body",
            "pizza",
            "friday",
            "hybrid",
            "general",
            "local",
            "path",
            "starfield",
            "iframe",
            "click",
            "strings",
            "core",
            "bet",
            "gambling",
            "record value",
            "date",
            "present sep",
            "present apr",
            "colombia",
            "present jun",
            "present nov",
            "cookie",
            "present oct",
            "entries",
            "next associated",
            "error",
            "attack",
            "government",
            "scotland",
            "news",
            "covid19",
            "subscribe",
            "october",
            "crown copyright",
            "nhs scotland",
            "parliament",
            "coronavirus",
            "redacted for",
            "domain status",
            "server",
            "privacy tech",
            "privacy admin",
            "email",
            "country",
            "postal code",
            "stateprovince",
            "code",
            "host name",
            "rdap database",
            "handle",
            "iana registrar",
            "entity roles",
            "links",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cnr12",
            "validity",
            "subject public",
            "key info",
            "medium",
            "write c",
            "search",
            "pe file",
            "high",
            "checks",
            "http",
            "delete",
            "copy",
            "guard",
            "mozilla",
            "next",
            "godaddy",
            "creation date",
            "hostname",
            "pulse submit",
            "url analysis",
            "domain",
            "files ip",
            "trojandropper",
            "mtb oct",
            "mtb may",
            "refloadapihash",
            "foundry",
            "fastly",
            "value a",
            "com laude",
            "ltd dba",
            "nomiq",
            "limited dba",
            "pulse",
            "location united",
            "asn asnone",
            "nameservers"
          ],
          "references": [
            "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
            "fazendabetb.live \u2022 bowiesports.com Check first???",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
            "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
            "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
            "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
            "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
            "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
            "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
            "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
            "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
            "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
            "The Scottish Government www.gov.scot The NHS Scotland support",
            "http://129.2.4.2/32 Lencr",
            "qlw020.managed-sprint.dynalabs.io (Check)",
            "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
            "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
            "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
            "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
            "ExternalHosts: US",
            "Starfield again - HoneyPot / Dod- DoW",
            "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
            "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
            "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
          ],
          "public": 1,
          "adversary": "NSO",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Bulgaria",
            "Singapore",
            "Denmark",
            "Australia",
            "Jersey",
            "Japan",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Upatre",
              "display_name": "Upatre",
              "target": null
            },
            {
              "id": "Autoit",
              "display_name": "Autoit",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti",
              "display_name": "Ransom:Win32/Crowti",
              "target": "/malware/Ransom:Win32/Crowti"
            },
            {
              "id": "Backdoor:Win32/Tofsee.",
              "display_name": "Backdoor:Win32/Tofsee.",
              "target": "/malware/Backdoor:Win32/Tofsee."
            },
            {
              "id": "#Lowfi:SIGATTR:DownloadAndExecute",
              "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
              "target": null
            },
            {
              "id": "Win.Dropper.Vbclone",
              "display_name": "Win.Dropper.Vbclone",
              "target": null
            },
            {
              "id": "Win.Packer",
              "display_name": "Win.Packer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "68fbc84609098d17c316f23c",
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6261,
            "domain": 1806,
            "hostname": 2427,
            "FileHash-MD5": 384,
            "FileHash-SHA1": 381,
            "email": 13,
            "FileHash-SHA256": 1418,
            "SSLCertFingerprint": 14
          },
          "indicator_count": 12704,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "146 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://podcasts.apple.com/us/podcast/the-lazarus-heist/id1561990291",
        "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
        "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b",
        "prosperhall.edsby.com \u2022 http://urlmail.hallrender.com \u2022 http://urlwww.hallrender.com \u2022 http://webdocs.hallrender.com",
        "Yara Detections :  Mirai_Botnet_Malware ,  Mirai_2 ,  is__elf ,  Linux_Mirai",
        "https://click.marketing.hallrender.com/?qs=9f3b0a760973d5628ba046a192f7fe432889bb96dc51578763a9cf11358dcde635e137184c12a031617f00faa9d172d8",
        "They blatantly steal from citizens , blame foreign entities.",
        "IDS Detections: HTTP traffic on port 443 (POST)",
        "Using Palantir Foundry tools have created a new false background for Brashears. Should be illegal.",
        "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
        "MD refused to disclose medication cocktail he was injecting into patient. Patient suffered long term  harm.",
        "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
        "apple-dns.net , http://www.pestcontrol-appleton.com/ multiple Apple IoC",
        "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
        "https://hallrender.com/attorney/brian-sabey/Accept \u2022 https://hallrender.com/wp-content/uploads/vcards/",
        "Yara Descriptive: \u2022  is__elf \u007fELF \u2022  Linux_Mirai /dev/watchdog",
        "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
        "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/",
        "The Hall Render Brian Sabey malicious media campaign was so unexpected.",
        "IDS Detections: Python Requests Suspicious User Agent",
        "The Scottish Government www.gov.scot The NHS Scotland support",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
        "https://www.patientfusion.com/doctor/michael-crincoli-59108",
        "http://southwestphysiatry.com/",
        "This is truly \u2019waste, fraud and abuse\u2019 usually a phrase used by insurance agents.",
        "fazendabetb.live \u2022 bowiesports.com Check first???",
        "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
        "Yara: Descriptive: Mirai_Botnet_Malware /dev/misc/watchdog \u2022 Mirai_2 /dev/watchdog",
        "IDS Detections : Mirai Variant Spreading",
        "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
        "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
        "hallrender.com \u2022 wwdancehall.com \u2022 hallplan.vm05.iveins.de\t \u2022 iveins.de \u2022 http://hallplan.vm05.iveins.de",
        "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
        "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
        "Starfield again - HoneyPot / Dod- DoW",
        "http://www.hallrender.com/attorney/brian-sabey-anyxxxtube.net/search-porn/tsara-brashears",
        "Assaulter Jeffrey Scott Reimer DPT isn\u2019t worth his monthly salary let alone all of this support",
        "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
        "bpc-old.palantirfoundry.com",
        "http://129.2.4.2/32 Lencr",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
        "IDS Detections: Linksys E-Series Device RCE Attempt Outbound",
        "Target had endured hired hitman , physical attacks, vehicle attacks, gunpoint",
        "qlw020.managed-sprint.dynalabs.io (Check)",
        "demos.palantirfoundry.com",
        "OTX auto populated  targeted groups.",
        "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
        "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
        "click.marketing.hallrender.com \u2022 hallrender.com \u2022 autodiscover.hallrender.com",
        "http://elite.hallrender.com/TE_3E_PROD/web/ui/dashboard/ActionList_CCC",
        "http://hallrender.com/attorney/gregg-m-wallander/\u2022 http://hallrender.com/resources/ \u2022 http://hallrender.com/resources/blog/ \u2022 http://officemarketing.hallrender.com/ \u2022 http://urlmail.hallrender.com \u2022 http://urlwww.hallrender.com \u2022 http://webdocs.hallrender.com/",
        "You have no idea where artists get their music or how the 5 main songwriters harvest songs from independent artists",
        "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
        "ExternalHosts: US",
        "http://hallrender.com/attorney/bsabey \u2022 http://hallrender.com/attorney/gregg-m-wallander",
        "http://www.hallrender.com/attorney/brian-sabey/anyxxxtube.net/search-porn/tsara-brashears",
        "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "NSO",
            "Lazarus"
          ],
          "malware_families": [
            "Unix.trojan.gafgyt-6748839-0",
            "Elf:hajime-r\\ [trj]",
            "Alf:spikeaexr.pevpszl",
            "Ransom:win32/gandcrab.h!mtb",
            "Ransom:msil/gandcrab",
            "Backdoor:win32/tofsee.",
            "Ddos:linux/gafgyt",
            "Other malware",
            "Upatre",
            "Ransom:win32/crowti",
            "Win.dropper.vbclone",
            "Win.packer",
            "#lowfi:sigattr:downloadandexecute",
            "Autoit",
            "Zeus",
            "Mirai variant spreading",
            "Mirai"
          ],
          "industries": [
            "Banks",
            "Entertainment",
            "Bank",
            "Crypto"
          ],
          "unique_indicators": 31757
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/ringpublishing.com",
    "whois": "http://whois.domaintools.com/ringpublishing.com",
    "domain": "ringpublishing.com",
    "hostname": "plugins.flowplayer.videos.ringpublishing.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "691439014fa9d79406a83e8e",
      "name": "Mirai Botnet \u2022 Michael Crincoli - | Patient Fusion",
      "description": "I researched this doctor because of patient documentation of  unethical practices , injury , blood toxicity and other very strange circumstances experienced by a monitored target. \nMD is based in Arizona, comes to Denver for certain cases. There weren\u2019t any follow ups or return calls after serious side affects that needed aggressive intervention.",
      "modified": "2025-12-12T05:04:18.490000",
      "created": "2025-11-12T07:36:33.673000",
      "tags": [
        "practice fusion",
        "patient fusion",
        "ave suite",
        "denver",
        "help log",
        "physical",
        "medicine",
        "book",
        "friday",
        "united",
        "present aug",
        "present nov",
        "present oct",
        "present sep",
        "present jul",
        "present jun",
        "ip address",
        "url analysis",
        "msie",
        "chrome",
        "formbook cnc",
        "checkin",
        "win64",
        "next associated",
        "smokeloader",
        "twitter",
        "cookie",
        "ipv4",
        "hosting",
        "suite",
        "verdict",
        "present may",
        "domain add",
        "files show",
        "avast avg",
        "post",
        "http traffic",
        "high",
        "south korea",
        "taiwan as3462",
        "python",
        "agent",
        "malware",
        "russia asnone",
        "czechia as51420",
        "italy as47217",
        "belgium as5432",
        "serbia as15958",
        "germany as34011",
        "contacted",
        "file score",
        "detections elf",
        "eseries device",
        "rce attempt",
        "outbound python",
        "user agent",
        "p2p_cnc",
        "network_http_post",
        "network_http",
        "network_cnc_http",
        "dead_host",
        "network_icmp",
        "osquery_detection",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "signing defense",
        "tcp syn",
        "resolverror",
        "yara detections",
        "expl",
        "ddos",
        "icmp traffic",
        "copy",
        "mirai",
        "writes_to_stdout",
        "nolookup_communication",
        "tcp_syn_scan",
        "network_icmp",
        "host",
        "network_irc",
        "crincoli",
        "md",
        "mirai botnet",
        "brian sabey",
        "hall render",
        "michael crincoli",
        "palantir",
        "foundry"
      ],
      "references": [
        "https://www.patientfusion.com/doctor/michael-crincoli-59108",
        "demos.palantirfoundry.com",
        "http://southwestphysiatry.com/",
        "IDS Detections: Linksys E-Series Device RCE Attempt Outbound",
        "IDS Detections: Python Requests Suspicious User Agent",
        "IDS Detections: HTTP traffic on port 443 (POST)",
        "IDS Detections : Mirai Variant Spreading",
        "Yara Detections :  Mirai_Botnet_Malware ,  Mirai_2 ,  is__elf ,  Linux_Mirai",
        "Yara: Descriptive: Mirai_Botnet_Malware /dev/misc/watchdog \u2022 Mirai_2 /dev/watchdog",
        "Yara Descriptive: \u2022  is__elf \u007fELF \u2022  Linux_Mirai /dev/watchdog",
        "http://www.hallrender.com/attorney/brian-sabey/anyxxxtube.net/search-porn/tsara-brashears",
        "http://www.hallrender.com/attorney/brian-sabey-anyxxxtube.net/search-porn/tsara-brashears",
        "click.marketing.hallrender.com \u2022 hallrender.com \u2022 autodiscover.hallrender.com",
        "https://click.marketing.hallrender.com/?qs=9f3b0a760973d5628ba046a192f7fe432889bb96dc51578763a9cf11358dcde635e137184c12a031617f00faa9d172d8",
        "hallrender.com \u2022 wwdancehall.com \u2022 hallplan.vm05.iveins.de\t \u2022 iveins.de \u2022 http://hallplan.vm05.iveins.de",
        "prosperhall.edsby.com \u2022 http://urlmail.hallrender.com \u2022 http://urlwww.hallrender.com \u2022 http://webdocs.hallrender.com",
        "http://elite.hallrender.com/TE_3E_PROD/web/ui/dashboard/ActionList_CCC",
        "https://hallrender.com/attorney/brian-sabey/Accept \u2022 https://hallrender.com/wp-content/uploads/vcards/",
        "http://hallrender.com/attorney/bsabey \u2022 http://hallrender.com/attorney/gregg-m-wallander",
        "http://hallrender.com/attorney/gregg-m-wallander/\u2022 http://hallrender.com/resources/ \u2022 http://hallrender.com/resources/blog/ \u2022 http://officemarketing.hallrender.com/ \u2022 http://urlmail.hallrender.com \u2022 http://urlwww.hallrender.com \u2022 http://webdocs.hallrender.com/",
        "The Hall Render Brian Sabey malicious media campaign was so unexpected.",
        "MD refused to disclose medication cocktail he was injecting into patient. Patient suffered long term  harm."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Italy",
        "Netherlands",
        "Russian Federation",
        "Belgium",
        "Germany",
        "Serbia",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Unix.Trojan.Gafgyt-6748839-0",
          "display_name": "Unix.Trojan.Gafgyt-6748839-0",
          "target": null
        },
        {
          "id": "ELF:Hajime-R\\ [Trj]",
          "display_name": "ELF:Hajime-R\\ [Trj]",
          "target": null
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Mirai Variant Spreading",
          "display_name": "Mirai Variant Spreading",
          "target": null
        },
        {
          "id": "DDoS:Linux/Gafgyt",
          "display_name": "DDoS:Linux/Gafgyt",
          "target": "/malware/DDoS:Linux/Gafgyt"
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1564.005",
          "name": "Hidden File System",
          "display_name": "T1564.005 - Hidden File System"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 5572,
        "domain": 788,
        "hostname": 1607,
        "email": 6,
        "FileHash-SHA256": 505,
        "FileHash-MD5": 132,
        "FileHash-SHA1": 128,
        "CVE": 2
      },
      "indicator_count": 8740,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "128 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6910cafb096eae0dcb39a800",
      "name": "Lawyers & Lazarus | Apple Spy : Treece Alfrey Musat P.C., Chris P. Ahmann Colorado State \u2022 Tam Legal Special Cousel for egregious",
      "description": "Chronicles of how  quasi government , a State owned criminal defense attorney , protects sexual assaulter Jeffrey Reimer DPT.   victim Palantir harassed, withheld healthcare , diagnoses, justice, monetary award for injured, stole insurance policies, hacked Denver artists, sold music her to artists whom profited, hacked  Denver music studios, hired stalkers, human, controlled phone , car and everything in targets life including , doctors, attorneys, hospitals. It\u2019s always been clear to coming us that Anonymous and Lazarus are the police, judge , lawyer, ransom racist.\nThis group alone has cost the US billions! Responsible for 2014 Sony hack , FMOE.\nDirect Link. by phone , email in person contact , forced settlement hearing,. Adversarial Christopher P. Ahmann , relationship w / Lazarus group, hitmen , cyber crime and other crimes against persons.\n #rip #christopher_ahmann #palantir #lazarus #target_tsara_brashears",
      "modified": "2025-12-09T17:03:48.645000",
      "created": "2025-11-09T17:10:19.498000",
      "tags": [
        "url http",
        "apple",
        "california",
        "apple public",
        "server rsa",
        "organization",
        "stateprovince",
        "ocsp",
        "nids united",
        "files",
        "united",
        "unknown ns",
        "ip address",
        "domain",
        "urls files",
        "passive dns",
        "found title",
        "sf hello",
        "myriad set",
        "pro myriad",
        "set lucida",
        "grande arial",
        "sf mono",
        "ipv4",
        "location united",
        "america flag",
        "america asn",
        "verdict",
        "files ip",
        "address",
        "as42 woodynet",
        "domain add",
        "ipv4 add",
        "reverse dns",
        "trojan",
        "name servers",
        "emails",
        "for privacy",
        "ltd dba",
        "com laude",
        "servers",
        "expiration date",
        "urls",
        "meta",
        "a domains",
        "country code",
        "store home",
        "title",
        "accept",
        "espaol",
        "english",
        "evil corp",
        "see all",
        "cyber hack",
        "republic",
        "canada",
        "season",
        "joe tidy",
        "sarah rainsford",
        "podcast",
        "bank",
        "ukraine",
        "dead",
        "indonesia",
        "police",
        "premium",
        "napoleon",
        "revolution",
        "michelangelo",
        "mozart",
        "global",
        "solid",
        "lazarus",
        "jabber zeus",
        "harrods",
        "ta markmonitor",
        "markmonitor",
        "search",
        "present aug",
        "unknown aaaa",
        "unknown soa",
        "win32",
        "invalid url",
        "trojanspy",
        "mtb apr",
        "backdoor",
        "next associated",
        "win64",
        "trojandropper",
        "twitter",
        "virtool",
        "ransom",
        "worm",
        "dynamicloader",
        "tlsv1",
        "high",
        "globalc",
        "medium",
        "windows",
        "cmd c",
        "delete c",
        "stream",
        "write",
        "next",
        "process32nextw",
        "http host",
        "dns query",
        "likely gandcrab",
        "et trojan",
        "windows nt",
        "wow64",
        "malware",
        "ms windows",
        "as16509",
        "as54113",
        "yara rule",
        "pe32 executable",
        "as15169",
        "powershell",
        "unknown",
        "response ip",
        "address google",
        "safe browsing",
        "hostname add",
        "port",
        "destination",
        "pe32",
        "intel",
        "error",
        "show",
        "delphi",
        "dcom",
        "form",
        "canvas",
        "united kingdom",
        "content type",
        "security",
        "moved",
        "great britain",
        "unknown a",
        "body doctype",
        "html public",
        "ietfdtd html",
        "showing",
        "packing t1045",
        "bytes",
        "read",
        "default",
        "christoper p ahmann",
        "target",
        "victims",
        "tsara brashears",
        "url https",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "present nov",
        "present oct",
        "date",
        "tcpmemhit",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "sha256",
        "sha1",
        "mitre att",
        "pattern match",
        "show technique",
        "ck matrix",
        "null",
        "refresh",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "palantir",
        "foundry",
        "hitmen",
        "quasi",
        "government contracts",
        "jeffrey reimer",
        "hallrender",
        "workers compensation",
        "record value",
        "certificate"
      ],
      "references": [
        "apple-dns.net , http://www.pestcontrol-appleton.com/ multiple Apple IoC",
        "https://podcasts.apple.com/us/podcast/the-lazarus-heist/id1561990291",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/",
        "bpc-old.palantirfoundry.com",
        "OTX auto populated  targeted groups.",
        "You have no idea where artists get their music or how the 5 main songwriters harvest songs from independent artists",
        "Target had endured hired hitman , physical attacks, vehicle attacks, gunpoint",
        "Assaulter Jeffrey Scott Reimer DPT isn\u2019t worth his monthly salary let alone all of this support",
        "Using Palantir Foundry tools have created a new false background for Brashears. Should be illegal.",
        "They blatantly steal from citizens , blame foreign entities.",
        "This is truly \u2019waste, fraud and abuse\u2019 usually a phrase used by insurance agents."
      ],
      "public": 1,
      "adversary": "Lazarus",
      "targeted_countries": [
        "Bangladesh",
        "Japan",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "ALF:SpikeAexR.PEVPSZL",
          "display_name": "ALF:SpikeAexR.PEVPSZL",
          "target": null
        },
        {
          "id": "Ransom:MSIL/GandCrab",
          "display_name": "Ransom:MSIL/GandCrab",
          "target": "/malware/Ransom:MSIL/GandCrab"
        },
        {
          "id": "Zeus",
          "display_name": "Zeus",
          "target": null
        },
        {
          "id": "Ransom:Win32/Gandcrab.H!MTB",
          "display_name": "Ransom:Win32/Gandcrab.H!MTB",
          "target": "/malware/Ransom:Win32/Gandcrab.H!MTB"
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1094",
          "name": "Custom Command and Control Protocol",
          "display_name": "T1094 - Custom Command and Control Protocol"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [
        "Banks",
        "Crypto",
        "Entertainment",
        "Bank"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4572,
        "FileHash-MD5": 196,
        "domain": 1523,
        "hostname": 1393,
        "FileHash-SHA256": 2400,
        "FileHash-SHA1": 175,
        "email": 18,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 10285,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "130 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69138a8144a8bf8040a92711",
      "name": "Lawyers & Lazarus | Apple Spy : Treece Alfrey Musat P.C., Chris P. Ahmann Colorado State \u2022 Tam Legal Special Counsel for egregious criminal acts \u2022 Christopher P. Ahmann attorney at Large",
      "description": "",
      "modified": "2025-12-09T17:03:48.645000",
      "created": "2025-11-11T19:12:01.843000",
      "tags": [
        "url http",
        "apple",
        "california",
        "apple public",
        "server rsa",
        "organization",
        "stateprovince",
        "ocsp",
        "nids united",
        "files",
        "united",
        "unknown ns",
        "ip address",
        "domain",
        "urls files",
        "passive dns",
        "found title",
        "sf hello",
        "myriad set",
        "pro myriad",
        "set lucida",
        "grande arial",
        "sf mono",
        "ipv4",
        "location united",
        "america flag",
        "america asn",
        "verdict",
        "files ip",
        "address",
        "as42 woodynet",
        "domain add",
        "ipv4 add",
        "reverse dns",
        "trojan",
        "name servers",
        "emails",
        "for privacy",
        "ltd dba",
        "com laude",
        "servers",
        "expiration date",
        "urls",
        "meta",
        "a domains",
        "country code",
        "store home",
        "title",
        "accept",
        "espaol",
        "english",
        "evil corp",
        "see all",
        "cyber hack",
        "republic",
        "canada",
        "season",
        "joe tidy",
        "sarah rainsford",
        "podcast",
        "bank",
        "ukraine",
        "dead",
        "indonesia",
        "police",
        "premium",
        "napoleon",
        "revolution",
        "michelangelo",
        "mozart",
        "global",
        "solid",
        "lazarus",
        "jabber zeus",
        "harrods",
        "ta markmonitor",
        "markmonitor",
        "search",
        "present aug",
        "unknown aaaa",
        "unknown soa",
        "win32",
        "invalid url",
        "trojanspy",
        "mtb apr",
        "backdoor",
        "next associated",
        "win64",
        "trojandropper",
        "twitter",
        "virtool",
        "ransom",
        "worm",
        "dynamicloader",
        "tlsv1",
        "high",
        "globalc",
        "medium",
        "windows",
        "cmd c",
        "delete c",
        "stream",
        "write",
        "next",
        "process32nextw",
        "http host",
        "dns query",
        "likely gandcrab",
        "et trojan",
        "windows nt",
        "wow64",
        "malware",
        "ms windows",
        "as16509",
        "as54113",
        "yara rule",
        "pe32 executable",
        "as15169",
        "powershell",
        "unknown",
        "response ip",
        "address google",
        "safe browsing",
        "hostname add",
        "port",
        "destination",
        "pe32",
        "intel",
        "error",
        "show",
        "delphi",
        "dcom",
        "form",
        "canvas",
        "united kingdom",
        "content type",
        "security",
        "moved",
        "great britain",
        "unknown a",
        "body doctype",
        "html public",
        "ietfdtd html",
        "showing",
        "packing t1045",
        "bytes",
        "read",
        "default",
        "christoper p ahmann",
        "target",
        "victims",
        "tsara brashears",
        "url https",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "p1377925676",
        "gaz1",
        "sid1696503456",
        "present nov",
        "present oct",
        "date",
        "tcpmemhit",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "sha256",
        "sha1",
        "mitre att",
        "pattern match",
        "show technique",
        "ck matrix",
        "null",
        "refresh",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "palantir",
        "foundry",
        "hitmen",
        "quasi",
        "government contracts",
        "jeffrey reimer",
        "hallrender",
        "workers compensation",
        "record value",
        "certificate"
      ],
      "references": [
        "apple-dns.net , http://www.pestcontrol-appleton.com/ multiple Apple IoC",
        "https://podcasts.apple.com/us/podcast/the-lazarus-heist/id1561990291",
        "https://tamlegal.com/attorneys/christopher-p-ahmann/",
        "bpc-old.palantirfoundry.com",
        "OTX auto populated  targeted groups.",
        "You have no idea where artists get their music or how the 5 main songwriters harvest songs from independent artists",
        "Target had endured hired hitman , physical attacks, vehicle attacks, gunpoint",
        "Assaulter Jeffrey Scott Reimer DPT isn\u2019t worth his monthly salary let alone all of this support",
        "Using Palantir Foundry tools have created a new false background for Brashears. Should be illegal.",
        "They blatantly steal from citizens , blame foreign entities.",
        "This is truly \u2019waste, fraud and abuse\u2019 usually a phrase used by insurance agents."
      ],
      "public": 1,
      "adversary": "Lazarus",
      "targeted_countries": [
        "Bangladesh",
        "Japan",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "ALF:SpikeAexR.PEVPSZL",
          "display_name": "ALF:SpikeAexR.PEVPSZL",
          "target": null
        },
        {
          "id": "Ransom:MSIL/GandCrab",
          "display_name": "Ransom:MSIL/GandCrab",
          "target": "/malware/Ransom:MSIL/GandCrab"
        },
        {
          "id": "Zeus",
          "display_name": "Zeus",
          "target": null
        },
        {
          "id": "Ransom:Win32/Gandcrab.H!MTB",
          "display_name": "Ransom:Win32/Gandcrab.H!MTB",
          "target": "/malware/Ransom:Win32/Gandcrab.H!MTB"
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1094",
          "name": "Custom Command and Control Protocol",
          "display_name": "T1094 - Custom Command and Control Protocol"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [
        "Banks",
        "Crypto",
        "Entertainment",
        "Bank"
      ],
      "TLP": "white",
      "cloned_from": "6910cafb096eae0dcb39a800",
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4572,
        "FileHash-MD5": 196,
        "domain": 1523,
        "hostname": 1393,
        "FileHash-SHA256": 2400,
        "FileHash-SHA1": 175,
        "email": 18,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 10285,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "130 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68fbc84609098d17c316f23c",
      "name": "NSO - Multiple crimes",
      "description": "Multiple crimes including illegal gambling, loan sharking, cybercrimes , content reputation , instructions. Starfield seen again. Team 8 has seen Starfield in more than 300 pulses. Now it\u2019s gone. Check your devices for innocent looking searches you\u2019ve never searched. Browser extensions found on 3 targeted devices with an adversary with full CnC armed with a deletion and disk wipe service. Local - Denver. \n\nAlso, very concerning is specific Airline to be attacked revealed. It cant be researched without bringing down a flight or messing up air command & control. DJT has already made travel a risky feat by being influenced to fire the (NOAA) & (DOT). Its manipulation. PP Mafia bros. \n\nDoes anyone have any power? Contact someone. We did have a mystery plane incident in Denver after I first reported. Just space junk , ya know the usual. I am serious about preventing crime. I need some help!",
      "modified": "2025-11-23T17:00:58.297000",
      "created": "2025-10-24T18:41:10.936000",
      "tags": [
        "type indicator",
        "added active",
        "related pulses",
        "script urls",
        "united",
        "unknown ns",
        "a domains",
        "ip address",
        "meta",
        "asn as13335",
        "msie",
        "chrome",
        "ransom",
        "trojan",
        "passive dns",
        "backdoor",
        "http request",
        "twitter",
        "win32/crix.c check-in",
        "gmt content",
        "ipv4",
        "urls",
        "files",
        "data upload",
        "extraction",
        "domain add",
        "e emeseieee",
        "dynamicloader",
        "e eue",
        "eweienedeoewese",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "edeeefeaeuelete",
        "unknown",
        "write",
        "bits",
        "malware",
        "xserver",
        "encrypt",
        "unknown aaaa",
        "moved",
        "cloudfront x",
        "hio52 p1",
        "name servers",
        "accept encoding",
        "emails",
        "servers",
        "extr",
        "u a640",
        "a69f u",
        "fe2e fe2f",
        "u a720",
        "a7ff",
        "u feff",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "pattern match",
        "mitre att",
        "null",
        "body",
        "pizza",
        "friday",
        "hybrid",
        "general",
        "local",
        "path",
        "starfield",
        "iframe",
        "click",
        "strings",
        "core",
        "bet",
        "gambling",
        "record value",
        "date",
        "present sep",
        "present apr",
        "colombia",
        "present jun",
        "present nov",
        "cookie",
        "present oct",
        "entries",
        "next associated",
        "error",
        "attack",
        "government",
        "scotland",
        "news",
        "covid19",
        "subscribe",
        "october",
        "crown copyright",
        "nhs scotland",
        "parliament",
        "coronavirus",
        "redacted for",
        "domain status",
        "server",
        "privacy tech",
        "privacy admin",
        "email",
        "country",
        "postal code",
        "stateprovince",
        "code",
        "host name",
        "rdap database",
        "handle",
        "iana registrar",
        "entity roles",
        "links",
        "key identifier",
        "x509v3 subject",
        "data",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cnr12",
        "validity",
        "subject public",
        "key info",
        "medium",
        "write c",
        "search",
        "pe file",
        "high",
        "checks",
        "http",
        "delete",
        "copy",
        "guard",
        "mozilla",
        "next",
        "godaddy",
        "creation date",
        "hostname",
        "pulse submit",
        "url analysis",
        "domain",
        "files ip",
        "trojandropper",
        "mtb oct",
        "mtb may",
        "refloadapihash",
        "foundry",
        "fastly",
        "value a",
        "com laude",
        "ltd dba",
        "nomiq",
        "limited dba",
        "pulse",
        "location united",
        "asn asnone",
        "nameservers"
      ],
      "references": [
        "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
        "fazendabetb.live \u2022 bowiesports.com Check first???",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
        "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
        "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
        "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
        "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
        "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
        "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
        "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
        "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
        "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
        "The Scottish Government www.gov.scot The NHS Scotland support",
        "http://129.2.4.2/32 Lencr",
        "qlw020.managed-sprint.dynalabs.io (Check)",
        "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
        "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
        "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
        "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
        "ExternalHosts: US",
        "Starfield again - HoneyPot / Dod- DoW",
        "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
        "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
        "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
      ],
      "public": 1,
      "adversary": "NSO",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Bulgaria",
        "Singapore",
        "Denmark",
        "Australia",
        "Jersey",
        "Japan",
        "Canada"
      ],
      "malware_families": [
        {
          "id": "Upatre",
          "display_name": "Upatre",
          "target": null
        },
        {
          "id": "Autoit",
          "display_name": "Autoit",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti",
          "display_name": "Ransom:Win32/Crowti",
          "target": "/malware/Ransom:Win32/Crowti"
        },
        {
          "id": "Backdoor:Win32/Tofsee.",
          "display_name": "Backdoor:Win32/Tofsee.",
          "target": "/malware/Backdoor:Win32/Tofsee."
        },
        {
          "id": "#Lowfi:SIGATTR:DownloadAndExecute",
          "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
          "target": null
        },
        {
          "id": "Win.Dropper.Vbclone",
          "display_name": "Win.Dropper.Vbclone",
          "target": null
        },
        {
          "id": "Win.Packer",
          "display_name": "Win.Packer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6261,
        "domain": 1806,
        "hostname": 2427,
        "FileHash-MD5": 384,
        "FileHash-SHA1": 381,
        "email": 13,
        "FileHash-SHA256": 1418,
        "SSLCertFingerprint": 14
      },
      "indicator_count": 12704,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "146 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68fc18514965ccd3b55c216d",
      "name": "Dorv \u2022 Obfuscator - Affecting DropBox",
      "description": "",
      "modified": "2025-11-23T17:00:58.297000",
      "created": "2025-10-25T00:22:41.686000",
      "tags": [
        "type indicator",
        "added active",
        "related pulses",
        "script urls",
        "united",
        "unknown ns",
        "a domains",
        "ip address",
        "meta",
        "asn as13335",
        "msie",
        "chrome",
        "ransom",
        "trojan",
        "passive dns",
        "backdoor",
        "http request",
        "twitter",
        "win32/crix.c check-in",
        "gmt content",
        "ipv4",
        "urls",
        "files",
        "data upload",
        "extraction",
        "domain add",
        "e emeseieee",
        "dynamicloader",
        "e eue",
        "eweienedeoewese",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "edeeefeaeuelete",
        "unknown",
        "write",
        "bits",
        "malware",
        "xserver",
        "encrypt",
        "unknown aaaa",
        "moved",
        "cloudfront x",
        "hio52 p1",
        "name servers",
        "accept encoding",
        "emails",
        "servers",
        "extr",
        "u a640",
        "a69f u",
        "fe2e fe2f",
        "u a720",
        "a7ff",
        "u feff",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "pattern match",
        "mitre att",
        "null",
        "body",
        "pizza",
        "friday",
        "hybrid",
        "general",
        "local",
        "path",
        "starfield",
        "iframe",
        "click",
        "strings",
        "core",
        "bet",
        "gambling",
        "record value",
        "date",
        "present sep",
        "present apr",
        "colombia",
        "present jun",
        "present nov",
        "cookie",
        "present oct",
        "entries",
        "next associated",
        "error",
        "attack",
        "government",
        "scotland",
        "news",
        "covid19",
        "subscribe",
        "october",
        "crown copyright",
        "nhs scotland",
        "parliament",
        "coronavirus",
        "redacted for",
        "domain status",
        "server",
        "privacy tech",
        "privacy admin",
        "email",
        "country",
        "postal code",
        "stateprovince",
        "code",
        "host name",
        "rdap database",
        "handle",
        "iana registrar",
        "entity roles",
        "links",
        "key identifier",
        "x509v3 subject",
        "data",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cnr12",
        "validity",
        "subject public",
        "key info",
        "medium",
        "write c",
        "search",
        "pe file",
        "high",
        "checks",
        "http",
        "delete",
        "copy",
        "guard",
        "mozilla",
        "next",
        "godaddy",
        "creation date",
        "hostname",
        "pulse submit",
        "url analysis",
        "domain",
        "files ip",
        "trojandropper",
        "mtb oct",
        "mtb may",
        "refloadapihash",
        "foundry",
        "fastly",
        "value a",
        "com laude",
        "ltd dba",
        "nomiq",
        "limited dba",
        "pulse",
        "location united",
        "asn asnone",
        "nameservers"
      ],
      "references": [
        "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
        "fazendabetb.live \u2022 bowiesports.com Check first???",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
        "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
        "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
        "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
        "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
        "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
        "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
        "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
        "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
        "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
        "The Scottish Government www.gov.scot The NHS Scotland support",
        "http://129.2.4.2/32 Lencr",
        "qlw020.managed-sprint.dynalabs.io (Check)",
        "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
        "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
        "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
        "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
        "ExternalHosts: US",
        "Starfield again - HoneyPot / Dod- DoW",
        "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
        "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
        "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
      ],
      "public": 1,
      "adversary": "NSO",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Bulgaria",
        "Singapore",
        "Denmark",
        "Australia",
        "Jersey",
        "Japan",
        "Canada"
      ],
      "malware_families": [
        {
          "id": "Upatre",
          "display_name": "Upatre",
          "target": null
        },
        {
          "id": "Autoit",
          "display_name": "Autoit",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti",
          "display_name": "Ransom:Win32/Crowti",
          "target": "/malware/Ransom:Win32/Crowti"
        },
        {
          "id": "Backdoor:Win32/Tofsee.",
          "display_name": "Backdoor:Win32/Tofsee.",
          "target": "/malware/Backdoor:Win32/Tofsee."
        },
        {
          "id": "#Lowfi:SIGATTR:DownloadAndExecute",
          "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
          "target": null
        },
        {
          "id": "Win.Dropper.Vbclone",
          "display_name": "Win.Dropper.Vbclone",
          "target": null
        },
        {
          "id": "Win.Packer",
          "display_name": "Win.Packer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "68fbc84609098d17c316f23c",
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6261,
        "domain": 1806,
        "hostname": 2427,
        "FileHash-MD5": 384,
        "FileHash-SHA1": 381,
        "email": 13,
        "FileHash-SHA256": 1418,
        "SSLCertFingerprint": 14
      },
      "indicator_count": 12704,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "146 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://plugins.flowplayer.videos.ringpublishing.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://plugins.flowplayer.videos.ringpublishing.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776617167.6534853
}