{
  "type": "Domain",
  "indicator": "uploadfiler.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/uploadfiler.com",
    "alexa": "http://www.alexa.com/siteinfo/uploadfiler.com",
    "indicator": "uploadfiler.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4346840549,
      "indicator": "uploadfiler.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 15,
      "pulses": [
        {
          "id": "6a12fc685c724f6f873953e6",
          "name": "EbeeMay2026 Pt4",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2026-05-24T13:26:00.146000",
          "created": "2026-05-24T13:26:00.146000",
          "tags": [
            "filehashsha256",
            "filehashmd5",
            "filehashsha1",
            "cve20232868 cve",
            "cve20231389 cve",
            "cve20214034 cve",
            "cve20213493 cve"
          ],
          "references": [
            "IOCs-MAY2.csv"
          ],
          "public": 1,
          "adversary": "Deploy Shai-Hulud Clones, Banana RAT, P2Pinfect Kubernetes Compromise, TamperedChef",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 71,
            "URL": 59,
            "FileHash-MD5": 169,
            "FileHash-SHA1": 153,
            "FileHash-SHA256": 225,
            "CIDR": 1,
            "CVE": 29,
            "domain": 128,
            "hostname": 111
          },
          "indicator_count": 946,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 39,
          "modified_text": "6 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a10c1c488a7f300a313067e",
          "name": "FoxTempest Malware Signing Abuse  Campaign",
          "description": "Fox Tempest abused Microsoft\u2019s signing infrastructure to issue trusted certificates for malware, enabling attackers to bypass security controls and distribute ransomware and stealers via fake software installers. The service impacted multiple sectors globally, including government, healthcare, finance and education, before being disrupted in 2026 by Microsoft through certificate revocation and infrastructure takedown.",
          "modified": "2026-05-22T20:51:16.677000",
          "created": "2026-05-22T20:51:16.677000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "cryptocti",
            "id": "110256",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4,
            "IPv4": 1,
            "FileHash-MD5": 3,
            "FileHash-SHA1": 3,
            "FileHash-SHA256": 3
          },
          "indicator_count": 14,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 502,
          "modified_text": "8 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a09ae6a0a2c2feb589cb316",
          "name": "MuddyWater APT Used Raas for Cyber Espionage Campaign",
          "description": "",
          "modified": "2026-05-17T12:02:50.993000",
          "created": "2026-05-17T12:02:50.993000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "cryptocti",
            "id": "110256",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 1,
            "domain": 3,
            "FileHash-MD5": 5,
            "FileHash-SHA1": 5,
            "FileHash-SHA256": 5
          },
          "indicator_count": 19,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 501,
          "modified_text": "13 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a0681dc8eb8b8292b82017a",
          "name": "IOC - Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware",
          "description": "In early 2026, a sophisticated intrusion initially appearing to be a standard Chaos ransomware attack was assessed to be consistent with a targeted state-sponsored operation. While the threat actor operated under the banner of the Chaos ransomware-as-a-service (RaaS) group, forensic analysis revealed the incident was a \"false flag\" masquerade. Technical artifacts, including a specific code-signing certificate and Command-and-Control (C2) infrastructure, suggest with moderate confidence that this activity is linked to MuddyWater (Seedworm), an Iranian Advanced Persistent Threat (APT) affiliated with the Ministry of Intelligence and Security (MOIS).",
          "modified": "2026-05-15T02:15:56.431000",
          "created": "2026-05-15T02:15:56.431000",
          "tags": [],
          "references": [
            "https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "celestre",
            "id": "295357",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 5,
            "FileHash-SHA1": 5,
            "FileHash-SHA256": 5,
            "domain": 4
          },
          "indicator_count": 19,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "15 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a04873aa32e956eec586c77",
          "name": "Botnet_C2 | May 14, 2026",
          "description": "Botnet_C2 indicators. Date: May 14, 2026. Total: 1170 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-05-13T14:14:18.218000",
          "created": "2026-05-13T14:14:18.218000",
          "tags": [
            "botnet_c2"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 5,
            "hostname": 161,
            "URL": 112,
            "domain": 134
          },
          "indicator_count": 412,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 92,
          "modified_text": "17 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a047bb5f2b9d59bf3636161",
          "name": "EbeeMay2026 Pt2",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2026-05-13T13:25:09.112000",
          "created": "2026-05-13T13:25:09.112000",
          "tags": [
            "filehashsha256",
            "filehashmd5",
            "filehashsha1",
            "cve20250921 cve",
            "cve20260300 cve",
            "cve20261281 cve",
            "cve20261340 cve",
            "cve20261731 cve",
            "cve20261357 cve",
            "cve20259501 cve",
            "yara"
          ],
          "references": [
            "IOCs.csv"
          ],
          "public": 1,
          "adversary": "JDownloader, DarkCloud, Chaos Ransomware, APT29, Shadow-Earth-053",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 66,
            "URL": 45,
            "CVE": 23,
            "FileHash-MD5": 232,
            "FileHash-SHA1": 239,
            "FileHash-SHA256": 264,
            "domain": 130,
            "email": 3,
            "hostname": 41
          },
          "indicator_count": 1043,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 40,
          "modified_text": "17 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a0335a9ce1b312bb85367f7",
          "name": "Botnet_C2 | May 13, 2026",
          "description": "Botnet_C2 indicators. Date: May 13, 2026. Total: 1052 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-05-12T14:14:01.762000",
          "created": "2026-05-12T14:14:01.762000",
          "tags": [
            "botnet_c2"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 5,
            "URL": 102,
            "domain": 140,
            "hostname": 165
          },
          "indicator_count": 412,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 91,
          "modified_text": "18 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69fc23105d3bac4bb98ec761",
          "name": "Credit Tr1sha111 Clone [\"Muddying the Tracks: The State-Sponsored Shadow\"]",
          "description": "",
          "modified": "2026-05-12T05:32:41.787000",
          "created": "2026-05-07T05:28:48.237000",
          "tags": [
            "description",
            "c2 url",
            "tool",
            "service binary",
            "dwservice",
            "background",
            "source ip",
            "microsoft teams",
            "quick assist"
          ],
          "references": [
            "https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "69fc1914c878d5cc2c6d474b",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 7,
            "FileHash-SHA1": 7,
            "FileHash-SHA256": 10,
            "IPv4": 5,
            "domain": 7,
            "CVE": 2,
            "URL": 1
          },
          "indicator_count": 39,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "18 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a01e4064798f56d423e2d96",
          "name": "Botnet_C2 | May 12, 2026",
          "description": "Botnet_C2 indicators. Date: May 12, 2026. Total: 945 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-05-11T14:13:26.060000",
          "created": "2026-05-11T14:13:26.060000",
          "tags": [
            "botnet_c2"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 5,
            "hostname": 96,
            "domain": 145,
            "URL": 124
          },
          "indicator_count": 370,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 92,
          "modified_text": "19 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a00928de04e9ba4cac1d6eb",
          "name": "Botnet_C2 | May 11, 2026",
          "description": "Botnet_C2 indicators. Date: May 11, 2026. Total: 861 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-05-10T14:13:33.465000",
          "created": "2026-05-10T14:13:33.465000",
          "tags": [
            "botnet_c2"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 5,
            "URL": 133,
            "hostname": 112,
            "domain": 125
          },
          "indicator_count": 375,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 94,
          "modified_text": "20 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69ff40f444f57576283e05ff",
          "name": "Botnet_C2 | May 10, 2026",
          "description": "Botnet_C2 indicators. Date: May 10, 2026. Total: 850 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-05-09T14:13:08.467000",
          "created": "2026-05-09T14:13:08.467000",
          "tags": [
            "botnet_c2"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 5,
            "URL": 130,
            "hostname": 126,
            "domain": 107
          },
          "indicator_count": 368,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 91,
          "modified_text": "21 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69fdef814e48bf9214326ebd",
          "name": "Botnet_C2 | May 9, 2026",
          "description": "Botnet_C2 indicators. Date: May 9, 2026. Total: 890 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-05-08T14:13:21.488000",
          "created": "2026-05-08T14:13:21.488000",
          "tags": [
            "botnet_c2"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 5,
            "hostname": 138,
            "URL": 133,
            "domain": 103
          },
          "indicator_count": 379,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 92,
          "modified_text": "22 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69fd4528d42f4a2cded7d067",
          "name": "IOC - Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware",
          "description": "In early 2026, a sophisticated intrusion initially appearing to be a standard Chaos ransomware attack was assessed to be consistent with a targeted state-sponsored operation. While the threat actor operated under the banner of the Chaos ransomware-as-a-service (RaaS) group, forensic analysis revealed the incident was a \"false flag\" masquerade. Technical artifacts, including a specific code-signing certificate and Command-and-Control (C2) infrastructure, suggest with moderate confidence that this activity is linked to MuddyWater (Seedworm), an Iranian Advanced Persistent Threat (APT) affiliated with the Ministry of Intelligence and Security (MOIS).",
          "modified": "2026-05-08T02:06:32.113000",
          "created": "2026-05-08T02:06:32.113000",
          "tags": [
            "tool",
            "c2 url",
            "service binary",
            "dwservice",
            "background",
            "source ip",
            "microsoft teams",
            "quick assist",
            "chaos raas"
          ],
          "references": [
            "https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "celestre",
            "id": "295357",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 7,
            "FileHash-SHA1": 7,
            "FileHash-SHA256": 11,
            "IPv4": 4,
            "domain": 4
          },
          "indicator_count": 33,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "22 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69fc9e061eb54d2816bc3580",
          "name": "Botnet_C2 | May 8, 2026",
          "description": "Botnet_C2 indicators. Date: May 8, 2026. Total: 1081 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-05-07T14:13:26.292000",
          "created": "2026-05-07T14:13:26.292000",
          "tags": [
            "botnet_c2"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 5,
            "URL": 145,
            "hostname": 139,
            "domain": 98
          },
          "indicator_count": 387,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 92,
          "modified_text": "23 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69fc1914c878d5cc2c6d474b",
          "name": "Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware",
          "description": "SHA 256 is the full text of the code used to create the Open Source operating system (TA), which is based on the open source operating System (OS) and is available to view online.",
          "modified": "2026-05-07T04:46:12.087000",
          "created": "2026-05-07T04:46:12.087000",
          "tags": [
            "description",
            "c2 url",
            "tool",
            "service binary",
            "dwservice",
            "background",
            "source ip",
            "microsoft teams",
            "quick assist"
          ],
          "references": [
            "https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Tr1sa111",
            "id": "192483",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 7,
            "FileHash-SHA1": 7,
            "FileHash-SHA256": 10,
            "IPv4": 4,
            "domain": 4
          },
          "indicator_count": 32,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 278,
          "modified_text": "23 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "IOCs-MAY2.csv",
        "IOCs.csv",
        "https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/",
        "https://ltna.com.au/cyber"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "Deploy Shai-Hulud Clones, Banana RAT, P2Pinfect Kubernetes Compromise, TamperedChef",
            "JDownloader, DarkCloud, Chaos Ransomware, APT29, Shadow-Earth-053"
          ],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 15,
  "pulses": [
    {
      "id": "6a12fc685c724f6f873953e6",
      "name": "EbeeMay2026 Pt4",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2026-05-24T13:26:00.146000",
      "created": "2026-05-24T13:26:00.146000",
      "tags": [
        "filehashsha256",
        "filehashmd5",
        "filehashsha1",
        "cve20232868 cve",
        "cve20231389 cve",
        "cve20214034 cve",
        "cve20213493 cve"
      ],
      "references": [
        "IOCs-MAY2.csv"
      ],
      "public": 1,
      "adversary": "Deploy Shai-Hulud Clones, Banana RAT, P2Pinfect Kubernetes Compromise, TamperedChef",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 71,
        "URL": 59,
        "FileHash-MD5": 169,
        "FileHash-SHA1": 153,
        "FileHash-SHA256": 225,
        "CIDR": 1,
        "CVE": 29,
        "domain": 128,
        "hostname": 111
      },
      "indicator_count": 946,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 39,
      "modified_text": "6 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a10c1c488a7f300a313067e",
      "name": "FoxTempest Malware Signing Abuse  Campaign",
      "description": "Fox Tempest abused Microsoft\u2019s signing infrastructure to issue trusted certificates for malware, enabling attackers to bypass security controls and distribute ransomware and stealers via fake software installers. The service impacted multiple sectors globally, including government, healthcare, finance and education, before being disrupted in 2026 by Microsoft through certificate revocation and infrastructure takedown.",
      "modified": "2026-05-22T20:51:16.677000",
      "created": "2026-05-22T20:51:16.677000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "cryptocti",
        "id": "110256",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4,
        "IPv4": 1,
        "FileHash-MD5": 3,
        "FileHash-SHA1": 3,
        "FileHash-SHA256": 3
      },
      "indicator_count": 14,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 502,
      "modified_text": "8 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a09ae6a0a2c2feb589cb316",
      "name": "MuddyWater APT Used Raas for Cyber Espionage Campaign",
      "description": "",
      "modified": "2026-05-17T12:02:50.993000",
      "created": "2026-05-17T12:02:50.993000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "cryptocti",
        "id": "110256",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 1,
        "domain": 3,
        "FileHash-MD5": 5,
        "FileHash-SHA1": 5,
        "FileHash-SHA256": 5
      },
      "indicator_count": 19,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 501,
      "modified_text": "13 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a0681dc8eb8b8292b82017a",
      "name": "IOC - Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware",
      "description": "In early 2026, a sophisticated intrusion initially appearing to be a standard Chaos ransomware attack was assessed to be consistent with a targeted state-sponsored operation. While the threat actor operated under the banner of the Chaos ransomware-as-a-service (RaaS) group, forensic analysis revealed the incident was a \"false flag\" masquerade. Technical artifacts, including a specific code-signing certificate and Command-and-Control (C2) infrastructure, suggest with moderate confidence that this activity is linked to MuddyWater (Seedworm), an Iranian Advanced Persistent Threat (APT) affiliated with the Ministry of Intelligence and Security (MOIS).",
      "modified": "2026-05-15T02:15:56.431000",
      "created": "2026-05-15T02:15:56.431000",
      "tags": [],
      "references": [
        "https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "celestre",
        "id": "295357",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 5,
        "FileHash-SHA1": 5,
        "FileHash-SHA256": 5,
        "domain": 4
      },
      "indicator_count": 19,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "15 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a04873aa32e956eec586c77",
      "name": "Botnet_C2 | May 14, 2026",
      "description": "Botnet_C2 indicators. Date: May 14, 2026. Total: 1170 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
      "modified": "2026-05-13T14:14:18.218000",
      "created": "2026-05-13T14:14:18.218000",
      "tags": [
        "botnet_c2"
      ],
      "references": [
        "https://ltna.com.au/cyber"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "LTNA-Australia",
        "id": "380633",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 5,
        "hostname": 161,
        "URL": 112,
        "domain": 134
      },
      "indicator_count": 412,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 92,
      "modified_text": "17 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a047bb5f2b9d59bf3636161",
      "name": "EbeeMay2026 Pt2",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2026-05-13T13:25:09.112000",
      "created": "2026-05-13T13:25:09.112000",
      "tags": [
        "filehashsha256",
        "filehashmd5",
        "filehashsha1",
        "cve20250921 cve",
        "cve20260300 cve",
        "cve20261281 cve",
        "cve20261340 cve",
        "cve20261731 cve",
        "cve20261357 cve",
        "cve20259501 cve",
        "yara"
      ],
      "references": [
        "IOCs.csv"
      ],
      "public": 1,
      "adversary": "JDownloader, DarkCloud, Chaos Ransomware, APT29, Shadow-Earth-053",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 66,
        "URL": 45,
        "CVE": 23,
        "FileHash-MD5": 232,
        "FileHash-SHA1": 239,
        "FileHash-SHA256": 264,
        "domain": 130,
        "email": 3,
        "hostname": 41
      },
      "indicator_count": 1043,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 40,
      "modified_text": "17 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a0335a9ce1b312bb85367f7",
      "name": "Botnet_C2 | May 13, 2026",
      "description": "Botnet_C2 indicators. Date: May 13, 2026. Total: 1052 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
      "modified": "2026-05-12T14:14:01.762000",
      "created": "2026-05-12T14:14:01.762000",
      "tags": [
        "botnet_c2"
      ],
      "references": [
        "https://ltna.com.au/cyber"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "LTNA-Australia",
        "id": "380633",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 5,
        "URL": 102,
        "domain": 140,
        "hostname": 165
      },
      "indicator_count": 412,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 91,
      "modified_text": "18 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69fc23105d3bac4bb98ec761",
      "name": "Credit Tr1sha111 Clone [\"Muddying the Tracks: The State-Sponsored Shadow\"]",
      "description": "",
      "modified": "2026-05-12T05:32:41.787000",
      "created": "2026-05-07T05:28:48.237000",
      "tags": [
        "description",
        "c2 url",
        "tool",
        "service binary",
        "dwservice",
        "background",
        "source ip",
        "microsoft teams",
        "quick assist"
      ],
      "references": [
        "https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "69fc1914c878d5cc2c6d474b",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 7,
        "FileHash-SHA1": 7,
        "FileHash-SHA256": 10,
        "IPv4": 5,
        "domain": 7,
        "CVE": 2,
        "URL": 1
      },
      "indicator_count": 39,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "18 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a01e4064798f56d423e2d96",
      "name": "Botnet_C2 | May 12, 2026",
      "description": "Botnet_C2 indicators. Date: May 12, 2026. Total: 945 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
      "modified": "2026-05-11T14:13:26.060000",
      "created": "2026-05-11T14:13:26.060000",
      "tags": [
        "botnet_c2"
      ],
      "references": [
        "https://ltna.com.au/cyber"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "LTNA-Australia",
        "id": "380633",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 5,
        "hostname": 96,
        "domain": 145,
        "URL": 124
      },
      "indicator_count": 370,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 92,
      "modified_text": "19 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a00928de04e9ba4cac1d6eb",
      "name": "Botnet_C2 | May 11, 2026",
      "description": "Botnet_C2 indicators. Date: May 11, 2026. Total: 861 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
      "modified": "2026-05-10T14:13:33.465000",
      "created": "2026-05-10T14:13:33.465000",
      "tags": [
        "botnet_c2"
      ],
      "references": [
        "https://ltna.com.au/cyber"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "LTNA-Australia",
        "id": "380633",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 5,
        "URL": 133,
        "hostname": 112,
        "domain": 125
      },
      "indicator_count": 375,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 94,
      "modified_text": "20 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "uploadfiler.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "uploadfiler.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780180324.628636
}