{ "type": "Domain", "indicator": "microstteams.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/microstteams.com", "alexa": "http://www.alexa.com/siteinfo/microstteams.com", "indicator": "microstteams.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4057883848, "indicator": "microstteams.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 31, "pulses": [ { "id": "67ffb7eba715b936a2c4c2a8", "name": "Interlock ransomware evolving under the radar", "description": "The Interlock ransomware group, active since September 2024, has shown adaptability and innovation in its tactics despite a relatively low victim count. They employ fake browser updates and the ClickFix technique for initial access, followed by a multi-stage attack chain involving PowerShell backdoors, credential stealers, and a custom Remote Access Trojan. The group targets various sectors across North America and Europe, conducting Big Game Hunting and double extortion campaigns. Interlock has been observed improving their tools, including evolving their PowerShell backdoor and modifying their ransom notes to emphasize legal repercussions. The group's focus on maintaining relevance while avoiding large-scale visibility suggests a strategic approach to their operations.", "modified": "2025-11-06T10:53:56.867000", "created": "2025-04-16T14:00:11.178000", "tags": [ "berserkstealer", "clickfix", "interlock rat", "double extortion", "ransomware", "remote access trojan", "interlock ransomware", "credential stealer", "fake updaters", "powershell backdoor", "lumma" ], "references": [ "https://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar" ], "public": 1, "adversary": "Interlock", "targeted_countries": [], "malware_families": [ { "id": "Interlock RAT", "display_name": "Interlock RAT", "target": null }, { "id": "LummaStealer", "display_name": "LummaStealer", "target": null }, { "id": "BerserkStealer", "display_name": "BerserkStealer", "target": null }, { "id": "Interlock ransomware", "display_name": "Interlock ransomware", "target": null } ], "attack_ids": [ { "id": "T1053.005", "name": "Scheduled Task", "display_name": "T1053.005 - Scheduled Task" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1489", "name": "Service Stop", "display_name": "T1489 - Service Stop" }, { "id": "T1204.002", "name": "Malicious File", "display_name": "T1204.002 - Malicious File" }, { "id": "T1573.001", "name": "Symmetric Cryptography", "display_name": "T1573.001 - Symmetric Cryptography" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1087", "name": "Account Discovery", "display_name": "T1087 - Account Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059.001", "name": "PowerShell", "display_name": "T1059.001 - PowerShell" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1078", "name": "Valid Accounts", "display_name": "T1078 - Valid Accounts" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1021.001", "name": "Remote Desktop Protocol", "display_name": "T1021.001 - Remote Desktop Protocol" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" } ], "industries": [ "Education", "Healthcare" ], "TLP": "white", "cloned_from": null, "export_count": 71, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 32, "FileHash-SHA1": 37, "FileHash-SHA256": 70, "URL": 22, "domain": 5, "hostname": 35 }, "indicator_count": 201, "is_author": false, "is_subscribing": null, "subscriber_count": 386479, "modified_text": "205 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b0305419842d33d1080ea2", "name": "Phishing | Mar 11, 2026 | Part 258/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 258/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T14:53:08.958000", "created": "2026-03-10T14:53:08.958000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 582, "hostname": 1418 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "81 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aedcba3b8ac5b564d611fd", "name": "Phishing | Mar 10, 2026 | Part 217/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 217/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:44:10.358000", "created": "2026-03-09T14:44:10.358000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1430, "domain": 570 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "82 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad8984d82140cb3d6f8668", "name": "Phishing | Mar 9, 2026 | Part 218/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 218/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:36:52.163000", "created": "2026-03-08T14:36:52.163000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1242, "domain": 758 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "83 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac38a12acdc917a8963139", "name": "Phishing | Mar 8, 2026 | Part 218/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 218/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:39:29.515000", "created": "2026-03-07T14:39:29.515000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1242, "domain": 758 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "84 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aae6abe2ed8e2f0bcdf0d3", "name": "Phishing | Mar 7, 2026 | Part 218/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 218/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:37:31.205000", "created": "2026-03-06T14:37:31.205000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1242, "domain": 758 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "85 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a99a932bf189aaf7535e03", "name": "Phishing | Mar 6, 2026 | Part 218/726", "description": "Phishing indicators. Date: Mar 6, 2026. Part 218/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T15:00:35.687000", "created": "2026-03-05T15:00:35.687000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1242, "domain": 758 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "86 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a843eab5458c72be9027fa", "name": "Phishing | Mar 5, 2026 | Part 218/726", "description": "Phishing indicators. Date: Mar 5, 2026. Part 218/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:38:34.295000", "created": "2026-03-04T14:38:34.295000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1242, "domain": 758 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "87 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6f10ab036f10de20bd8f6", "name": "Phishing | Mar 4, 2026 | Part 218/726", "description": "Phishing indicators. Date: Mar 4, 2026. Part 218/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:32:41.990000", "created": "2026-03-03T14:32:41.990000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1242, "domain": 758 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "88 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5b6f411c0c4aa43a145a6", "name": "Phishing | Mar 3, 2026 | Part 218/726", "description": "Phishing indicators. Date: Mar 3, 2026. Part 218/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T16:12:36.743000", "created": "2026-03-02T16:12:36.743000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1242, "domain": 758 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5151a595395308c151d7b", "name": "Phishing | Mar 2, 2026 | Part 219/729", "description": "Phishing indicators. Date: Mar 2, 2026. Part 219/729. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T04:42:02.339000", "created": "2026-03-02T04:42:02.339000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 571, "hostname": 1429 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a441afd8a8a470eff7082a", "name": "Phishing | Mar 2, 2026 | Part 221/732", "description": "Phishing indicators. Date: Mar 2, 2026. Part 221/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T13:39:59.095000", "created": "2026-03-01T13:39:59.095000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1411, "domain": 589 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a407660cc0f31ca89e5a20", "name": "Phishing | Mar 1, 2026 | Part 221/732", "description": "Phishing indicators. Date: Mar 1, 2026. Part 221/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T09:31:18.679000", "created": "2026-03-01T09:31:18.679000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1411, "domain": 589 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a385de51925df39a550b32", "name": "Phishing | Mar 1, 2026 | Part 222/733", "description": "Phishing indicators. Date: Mar 1, 2026. Part 222/733. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T00:18:38.688000", "created": "2026-03-01T00:18:38.688000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1206, "domain": 794 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "91 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6997fc9a7fdad4ccdd259c61", "name": "Phishing | Feb 20, 2026 | Part 224/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 224/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-20T06:18:02.897000", "created": "2026-02-20T06:18:02.897000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1068, "domain": 932 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "99 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69976a5422a2ae48610dc856", "name": "Phishing | Feb 20, 2026 | Part 224/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 224/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T19:53:56.648000", "created": "2026-02-19T19:53:56.648000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1068, "domain": 932 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "100 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69972b1bf5c26181b49a3d90", "name": "Phishing | Feb 20, 2026 | Part 224/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 224/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T15:24:11.189000", "created": "2026-02-19T15:24:11.189000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1068, "domain": 932 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "100 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69970bdc0d5d0b23472ab7a1", "name": "Phishing | Feb 19, 2026 | Part 224/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 224/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T13:10:52.778000", "created": "2026-02-19T13:10:52.778000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1068, "domain": 932 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "100 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699635ab9023807b75df358c", "name": "Phishing | Feb 19, 2026 | Part 224/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 224/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T21:56:59.443000", "created": "2026-02-18T21:56:59.443000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1068, "domain": 932 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "101 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6995767e81e9ed293708bfa5", "name": "Phishing | Feb 18, 2026 | Part 224/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 224/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T08:21:18.317000", "created": "2026-02-18T08:21:18.317000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1068, "domain": 932 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "101 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69949af35fc665cd65be5a93", "name": "Phishing | Feb 18, 2026 | Part 224/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 224/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-17T16:44:35.256000", "created": "2026-02-17T16:44:35.256000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1068, "domain": 932 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "102 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699299122ee3bdf8afb0f96e", "name": "Phishing | Feb 16, 2026 | Part 227/741", "description": "Phishing indicators. Date: Feb 16, 2026. Part 227/741. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-16T04:12:02.545000", "created": "2026-02-16T04:12:02.545000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1194, "domain": 806 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "104 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699159cd2068dbe981fbc2d5", "name": "Phishing | Feb 15, 2026 | Part 231/749", "description": "Phishing indicators. Date: Feb 15, 2026. Part 231/749. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-15T05:29:49.052000", "created": "2026-02-15T05:29:49.052000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1407, "domain": 593 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "104 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69908b3a0d82137cf6b1d7e2", "name": "Phishing | Feb 15, 2026 | Part 234/754", "description": "Phishing indicators. Date: Feb 15, 2026. Part 234/754. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-14T14:48:26.148000", "created": "2026-02-14T14:48:26.148000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 998, "hostname": 1002 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "105 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698c5d9d4250366de222e687", "name": "Phishing | Feb 11, 2026 | Part 255/783", "description": "Phishing indicators. Date: Feb 11, 2026. Part 255/783. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-11T10:44:45.978000", "created": "2026-02-11T10:44:45.978000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 588, "hostname": 1412 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "108 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6981aa1b19318b8822520397", "name": "Phishing | 2026-01-31 | Part 66/163", "description": "Phishing indicators. Date: 2026-01-31. Part 66/163. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-03T07:56:11.516000", "created": "2026-02-03T07:56:11.516000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 7277, "domain": 2723 }, "indicator_count": 10000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "116 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6889ff2cfa6a2c08cb85336a", "name": "EbeeJuly2025 Pt2", "description": "IOCs of multiple threaats observed and collected in July 2025", "modified": "2025-08-29T10:02:20.542000", "created": "2025-07-30T11:17:00.302000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 65, "FileHash-MD5": 177, "FileHash-SHA1": 132, "FileHash-SHA256": 216, "domain": 136, "email": 1, "hostname": 101 }, "indicator_count": 828, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "274 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "688b0dde98e8d32361238f0f", "name": "Emmenhtal Loader Campaign deliver various payloads [IMEBEEIMFINE]", "description": "", "modified": "2025-08-29T09:03:58.967000", "created": "2025-07-31T06:31:58.326000", "tags": [], "references": [ "Emmenhtal.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6889ebeb317457163ab8fa42", "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 395, "BitcoinAddress": 1, "CVE": 6, "FileHash-MD5": 240, "FileHash-SHA1": 123, "FileHash-SHA256": 392, "domain": 182, "email": 1, "hostname": 181 }, "indicator_count": 1521, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "274 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6889ebeb317457163ab8fa42", "name": "Emmenhtal loader", "description": "Campaigns that used Emmenhtal to deliver various payloads", "modified": "2025-08-29T09:03:58.967000", "created": "2025-07-30T09:54:51.943000", "tags": [], "references": [ "Emmenhtal.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 395, "BitcoinAddress": 1, "CVE": 6, "FileHash-MD5": 240, "FileHash-SHA1": 123, "FileHash-SHA256": 392, "domain": 182, "email": 1, "hostname": 181 }, "indicator_count": 1521, "is_author": false, "is_subscribing": null, "subscriber_count": 42, "modified_text": "274 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68409244750c4c3b0bbb7729", "name": "IOCs 2025 JAN-MAY", "description": "Latest IOCs emerged in 2025", "modified": "2025-07-04T18:05:18.397000", "created": "2025-06-04T18:36:51.684000", "tags": [], "references": [ "IOC.pdf" ], "public": 1, "adversary": "Multiple Threat Actors", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 15, "FileHash-MD5": 106, "FileHash-SHA1": 141, "FileHash-SHA256": 117, "domain": 128, "email": 2, "hostname": 12 }, "indicator_count": 521, "is_author": false, "is_subscribing": null, "subscriber_count": 40, "modified_text": "330 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6800cd88a905c048a110ef0f", "name": "Interlock ransomware evolving under the radar - Sekoia.io Blog", "description": "Interlock ransomware is a multi-stage cyber-attack that targets victims who are not aware of the threat, according to a report by Sekoia Threat Detection & Research (TDR) and its researchers.", "modified": "2025-05-17T09:05:14.615000", "created": "2025-04-17T09:44:40.591000", "tags": [ "interlock", "cluster", "powershell", "february", "january", "windows", "october", "september", "detection", "clickfix", "ransom", "clop", "ransomhub", "akira", "babuk", "lynx", "qilin", "later", "anydesk", "contact", "media", "anomaly", "linux", "rhysida", "remote access" ], "references": [ "https://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar/" ], "public": 1, "adversary": "Interlock", "targeted_countries": [], "malware_families": [ { "id": "Akira", "display_name": "Akira", "target": null }, { "id": "Linux", "display_name": "Linux", "target": null }, { "id": "Rhysida", "display_name": "Rhysida", "target": null }, { "id": "Remote Access", "display_name": "Remote Access", "target": null }, { "id": "Windows", "display_name": "Windows", "target": null }, { "id": "Interlock", "display_name": "Interlock", "target": null } ], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1021", "name": "Remote Services", "display_name": "T1021 - Remote Services" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "murgif105", "id": "292958", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 9, "FileHash-MD5": 69, "FileHash-SHA1": 69, "FileHash-SHA256": 70, "URL": 27, "YARA": 5, "hostname": 35 }, "indicator_count": 284, "is_author": false, "is_subscribing": null, "subscriber_count": 21, "modified_text": "378 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "IOC.pdf", "https://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar", "Emmenhtal.pdf", "https://ltna.com.au/cyber", "https://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar/" ], "related": { "alienvault": { "adversary": [ "Interlock" ], "malware_families": [ "Berserkstealer", "Lummastealer", "Interlock rat", "Interlock ransomware" ], "industries": [ "Healthcare", "Education" ] }, "other": { "adversary": [ "Multiple Threat Actors", "Interlock" ], "malware_families": [ "Akira", "Linux", "Interlock", "Windows", "Rhysida", "Remote access" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 31, "pulses": [ { "id": "67ffb7eba715b936a2c4c2a8", "name": "Interlock ransomware evolving under the radar", "description": "The Interlock ransomware group, active since September 2024, has shown adaptability and innovation in its tactics despite a relatively low victim count. They employ fake browser updates and the ClickFix technique for initial access, followed by a multi-stage attack chain involving PowerShell backdoors, credential stealers, and a custom Remote Access Trojan. The group targets various sectors across North America and Europe, conducting Big Game Hunting and double extortion campaigns. Interlock has been observed improving their tools, including evolving their PowerShell backdoor and modifying their ransom notes to emphasize legal repercussions. The group's focus on maintaining relevance while avoiding large-scale visibility suggests a strategic approach to their operations.", "modified": "2025-11-06T10:53:56.867000", "created": "2025-04-16T14:00:11.178000", "tags": [ "berserkstealer", "clickfix", "interlock rat", "double extortion", "ransomware", "remote access trojan", "interlock ransomware", "credential stealer", "fake updaters", "powershell backdoor", "lumma" ], "references": [ "https://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar" ], "public": 1, "adversary": "Interlock", "targeted_countries": [], "malware_families": [ { "id": "Interlock RAT", "display_name": "Interlock RAT", "target": null }, { "id": "LummaStealer", "display_name": "LummaStealer", "target": null }, { "id": "BerserkStealer", "display_name": "BerserkStealer", "target": null }, { "id": "Interlock ransomware", "display_name": "Interlock ransomware", "target": null } ], "attack_ids": [ { "id": "T1053.005", "name": "Scheduled Task", "display_name": "T1053.005 - Scheduled Task" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1489", "name": "Service Stop", "display_name": "T1489 - Service Stop" }, { "id": "T1204.002", "name": "Malicious File", "display_name": "T1204.002 - Malicious File" }, { "id": "T1573.001", "name": "Symmetric Cryptography", "display_name": "T1573.001 - Symmetric Cryptography" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1087", "name": "Account Discovery", "display_name": "T1087 - Account Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059.001", "name": "PowerShell", "display_name": "T1059.001 - PowerShell" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1078", "name": "Valid Accounts", "display_name": "T1078 - Valid Accounts" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1021.001", "name": "Remote Desktop Protocol", "display_name": "T1021.001 - Remote Desktop Protocol" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" } ], "industries": [ "Education", "Healthcare" ], "TLP": "white", "cloned_from": null, "export_count": 71, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 32, "FileHash-SHA1": 37, "FileHash-SHA256": 70, "URL": 22, "domain": 5, "hostname": 35 }, "indicator_count": 201, "is_author": false, "is_subscribing": null, "subscriber_count": 386479, "modified_text": "205 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b0305419842d33d1080ea2", "name": "Phishing | Mar 11, 2026 | Part 258/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 258/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T14:53:08.958000", "created": "2026-03-10T14:53:08.958000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 582, "hostname": 1418 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "81 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aedcba3b8ac5b564d611fd", "name": "Phishing | Mar 10, 2026 | Part 217/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 217/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:44:10.358000", "created": "2026-03-09T14:44:10.358000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1430, "domain": 570 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "82 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad8984d82140cb3d6f8668", "name": "Phishing | Mar 9, 2026 | Part 218/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 218/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:36:52.163000", "created": "2026-03-08T14:36:52.163000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1242, "domain": 758 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "83 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac38a12acdc917a8963139", "name": "Phishing | Mar 8, 2026 | Part 218/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 218/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:39:29.515000", "created": "2026-03-07T14:39:29.515000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1242, "domain": 758 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "84 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aae6abe2ed8e2f0bcdf0d3", "name": "Phishing | Mar 7, 2026 | Part 218/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 218/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:37:31.205000", "created": "2026-03-06T14:37:31.205000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1242, "domain": 758 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "85 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a99a932bf189aaf7535e03", "name": "Phishing | Mar 6, 2026 | Part 218/726", "description": "Phishing indicators. Date: Mar 6, 2026. Part 218/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T15:00:35.687000", "created": "2026-03-05T15:00:35.687000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1242, "domain": 758 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "86 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a843eab5458c72be9027fa", "name": "Phishing | Mar 5, 2026 | Part 218/726", "description": "Phishing indicators. Date: Mar 5, 2026. Part 218/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:38:34.295000", "created": "2026-03-04T14:38:34.295000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1242, "domain": 758 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "87 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6f10ab036f10de20bd8f6", "name": "Phishing | Mar 4, 2026 | Part 218/726", "description": "Phishing indicators. Date: Mar 4, 2026. Part 218/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:32:41.990000", "created": "2026-03-03T14:32:41.990000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1242, "domain": 758 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "88 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5b6f411c0c4aa43a145a6", "name": "Phishing | Mar 3, 2026 | Part 218/726", "description": "Phishing indicators. Date: Mar 3, 2026. Part 218/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T16:12:36.743000", "created": "2026-03-02T16:12:36.743000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1242, "domain": 758 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "microstteams.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "microstteams.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780200748.497248 }