{ "type": "Domain", "indicator": "zmsupport.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/zmsupport.com", "alexa": "http://www.alexa.com/siteinfo/zmsupport.com", "indicator": "zmsupport.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3318643590, "indicator": "zmsupport.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 36, "pulses": [ { "id": "698a3590b78fb5ef2d81d5f1", "name": "UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering", "description": "North Korean threat actor UNC1069 has evolved its tactics to target the cryptocurrency and decentralized finance sectors. In a recent intrusion, they deployed seven unique malware families, including new tools SILENCELIFT, DEEPBREATH, and CHROMEPUSH, designed to capture host and victim data. The attack utilized social engineering involving a compromised Telegram account, fake Zoom meeting, and reported AI-generated video. UNC1069 has shifted from spear-phishing to targeting Web3 industry entities like centralized exchanges, software developers, and venture capital firms. The intrusion demonstrated sophisticated techniques to bypass macOS security features and harvest credentials, browser data, and cryptocurrency information. This marks a significant expansion in UNC1069's capabilities and highlights their focus on financial theft and fueling future social engineering campaigns.", "modified": "2026-02-12T14:41:53.254000", "created": "2026-02-09T19:29:20.975000", "tags": [ "macos", "deepbreath", "chromepush", "hypercall", "silencelift", "waveshaper", "north korea", "sugarloader", "hiddencall", "social engineering", "cryptocurrency", "malware", "ai", "web3" ], "references": [ "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering" ], "public": 1, "adversary": "UNC1069", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1132.001", "name": "Standard Encoding", "display_name": "T1132.001 - Standard Encoding" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1055.001", "name": "Dynamic-link Library Injection", "display_name": "T1055.001 - Dynamic-link Library Injection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [ "Finance", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 8, "FileHash-SHA256": 7, "FileHash-SHA1": 8, "domain": 7, "hostname": 1, "YARA": 8 }, "indicator_count": 39, "is_author": false, "is_subscribing": null, "subscriber_count": 377565, "modified_text": "66 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bbba3ed3b01bcf222ccc1d", "name": "EbeeMar2026 Pt3", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-04-18T08:06:12.483000", "created": "2026-03-19T08:56:30.058000", "tags": [ "filehashsha256", "filehashmd5", "filehashsha1", "yara" ], "references": [ "IOCs.2026.3.csv" ], "public": 1, "adversary": "ClipXDaemon, TENGU RANSOMWARE, A0Backdoor, GlassWorm, Operation CamelClone, VOID#GEIST", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 97, "URL": 96, "CVE": 3, "FileHash-MD5": 93, "FileHash-SHA1": 101, "FileHash-SHA256": 153, "domain": 156, "email": 9 }, "indicator_count": 708, "is_author": false, "is_subscribing": null, "subscriber_count": 37, "modified_text": "1 day ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a046863c1c92107079f81b", "name": "EbeeFeb2026 Pt5", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-03-31T06:00:59.128000", "created": "2026-02-26T13:11:34.763000", "tags": [ "filehashsha1", "filehashsha256", "filehashmd5" ], "references": [ "IOCs.2026.csv" ], "public": 1, "adversary": "Contagious Interview Campaign, Triton fork campaign, CRESCENTHARVEST, MIMICRAT, Operation Olalampo", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 78, "FileHash-MD5": 191, "FileHash-SHA1": 220, "FileHash-SHA256": 192, "CVE": 2, "URL": 58, "domain": 220 }, "indicator_count": 961, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "19 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699c294fa357642ede4fd71a", "name": "Ninja Browser & Lumma Infostealer", "description": "\"Nai-browser\" or \"ninja- browser\", as it is now known, is a \"nad-nodelink\" and \"apicl.xyz\".", "modified": "2026-03-25T10:03:31.959000", "created": "2026-02-23T10:17:51.748000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "sharkstriker_soc", "id": "139120", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 16, "FileHash-SHA1": 14, "FileHash-SHA256": 18, "domain": 17, "hostname": 13, "URL": 2 }, "indicator_count": 80, "is_author": false, "is_subscribing": null, "subscriber_count": 37, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b03486131dc4cd33f0f3c3", "name": "Phishing | Mar 11, 2026 | Part 409/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 409/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T15:11:02.143000", "created": "2026-03-10T15:11:02.143000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1309, "domain": 691 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "40 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69af738e9a1d05c81a99263b", "name": "IOC - Fake VCs target crypto talent in a new ClickFix campaign", "description": "In a new investigation, Moonlock Lab has been tracking a malware campaign targeting cryptocurrency and Web3 professionals. The threat actors operate through fabricated venture capital identities, engage victims on LinkedIn with tailored job or partnership offers, and funnel them toward spoofed video conferencing links\u2014fake Zoom and Google Meet pages\u2014that serve as the delivery mechanisms for malicious payloads.", "modified": "2026-03-10T01:27:42.174000", "created": "2026-03-10T01:27:42.174000", "tags": [ "domain", "fake zoom", "mandiant", "sugarloader c2", "hypercall c2", "type value", "context domain", "megabit", "fake google", "meet page", "macho" ], "references": [ "https://moonlock.com/fake-vcs-target-crypto-talent-clickfix-campaign" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "celestre", "id": "295357", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 3, "domain": 9, "hostname": 5 }, "indicator_count": 17, "is_author": false, "is_subscribing": null, "subscriber_count": 119, "modified_text": "40 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aee0bce17d4f1abdf62780", "name": "Phishing | Mar 10, 2026 | Part 359/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 359/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T15:01:16.239000", "created": "2026-03-09T15:01:16.239000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 638, "hostname": 1362 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "41 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad8d7c6486d6b999dc12f4", "name": "Phishing | Mar 9, 2026 | Part 360/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 360/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:53:48.631000", "created": "2026-03-08T14:53:48.631000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 555, "hostname": 1337, "URL": 108 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "42 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac3c9dd592e576413e70dc", "name": "Phishing | Mar 8, 2026 | Part 360/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 360/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:56:29.776000", "created": "2026-03-07T14:56:29.776000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 555, "hostname": 1337, "URL": 108 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "43 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aaeabeefb4c226e9e04ac4", "name": "Phishing | Mar 7, 2026 | Part 360/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 360/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:54:54.770000", "created": "2026-03-06T14:54:54.770000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1338, "domain": 555, "URL": 107 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "44 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a99ea733b81170d4cf086d", "name": "Phishing | Mar 6, 2026 | Part 360/726", "description": "Phishing indicators. Date: Mar 6, 2026. Part 360/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T15:17:59.646000", "created": "2026-03-05T15:17:59.646000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1337, "domain": 554, "URL": 109 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "45 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a847f4ceb38823c2b2c9fe", "name": "Phishing | Mar 5, 2026 | Part 360/726", "description": "Phishing indicators. Date: Mar 5, 2026. Part 360/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:55:48.856000", "created": "2026-03-04T14:55:48.856000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1335, "domain": 554, "URL": 111 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "46 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a7dbb8b44812dab8fec52a", "name": "Fake VCs target crypto talent in a new ClickFix campaign", "description": "Moonlock Lab's investigation has uncovered a sophisticated malware campaign targeting cryptocurrency and Web3 professionals, driven by actors posing as venture capitalists. The campaign is characterized by its use of advanced social engineering tactics primarily through LinkedIn, where attackers engage potential victims with personalized messages related to job opportunities at fictitious firms such as SolidBit Capital and MegaBit. Victims are subsequently directed to fake video conferencing links that serve as conduits for malicious payload delivery employing a technique known as ClickFix.", "modified": "2026-03-04T07:14:00.621000", "created": "2026-03-04T07:14:00.621000", "tags": [ "moonlock lab", "linkedin", "lumax capital", "zoom", "mandiant", "megabit", "google meet", "windows", "hureiev", "macho", "solidbit", "python", "virustotal", "february", "verify", "terminal", "twitter", "team", "anna", "swift", "sugarloader", "clickfix", "dprk", "macos" ], "references": [ "https://moonlock.com/fake-vcs-target-crypto-talent-clickfix-campaign" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ClickFix", "display_name": "ClickFix", "target": null } ], "attack_ids": [ { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1056.002", "name": "GUI Input Capture", "display_name": "T1056.002 - GUI Input Capture" }, { "id": "T1059.001", "name": "PowerShell", "display_name": "T1059.001 - PowerShell" }, { "id": "T1059.004", "name": "Unix Shell", "display_name": "T1059.004 - Unix Shell" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" } ], "industries": [ "Cryptocurrency" ], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "PetrP.73", "id": "154605", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 3, "URL": 3, "domain": 13, "hostname": 5 }, "indicator_count": 24, "is_author": false, "is_subscribing": null, "subscriber_count": 172, "modified_text": "46 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6f530c349ad64bbd351a5", "name": "Phishing | Mar 4, 2026 | Part 360/726", "description": "Phishing indicators. Date: Mar 4, 2026. Part 360/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:50:24.157000", "created": "2026-03-03T14:50:24.157000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1332, "domain": 554, "URL": 114 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "47 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5bb2e0b08276c0feeec99", "name": "Phishing | Mar 3, 2026 | Part 360/726", "description": "Phishing indicators. Date: Mar 3, 2026. Part 360/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T16:30:38.280000", "created": "2026-03-02T16:30:38.280000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1333, "domain": 554, "URL": 113 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "48 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5193de08863a5139edc30", "name": "Phishing | Mar 2, 2026 | Part 362/729", "description": "Phishing indicators. Date: Mar 2, 2026. Part 362/729. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T04:59:41.815000", "created": "2026-03-02T04:59:41.815000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1417, "domain": 583 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "48 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a445def1ed0ad6f6d842f0", "name": "Phishing | Mar 2, 2026 | Part 365/732", "description": "Phishing indicators. Date: Mar 2, 2026. Part 365/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T13:57:50.807000", "created": "2026-03-01T13:57:50.807000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 706, "hostname": 1294 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "49 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a40b9432286f6daeb1920d", "name": "Phishing | Mar 1, 2026 | Part 365/732", "description": "Phishing indicators. Date: Mar 1, 2026. Part 365/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T09:49:08.616000", "created": "2026-03-01T09:49:08.616000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 706, "hostname": 1294 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "49 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a38a13672bc670244068d7", "name": "Phishing | Mar 1, 2026 | Part 366/733", "description": "Phishing indicators. Date: Mar 1, 2026. Part 366/733. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T00:36:35.529000", "created": "2026-03-01T00:36:35.529000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 669, "hostname": 1331 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "49 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699fc0513ab49ceb22c6d96b", "name": "TCS IOC", "description": "", "modified": "2026-02-26T03:38:57.799000", "created": "2026-02-26T03:38:57.799000", "tags": [ "https", "f https", "msgtype1", "http", "apiv2init" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "myerioc72", "id": "364999", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 22, "URL": 249, "FileHash-MD5": 242, "FileHash-SHA1": 337, "FileHash-SHA256": 322, "domain": 811, "hostname": 124 }, "indicator_count": 2107, "is_author": false, "is_subscribing": null, "subscriber_count": 1, "modified_text": "52 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699800d01f8f9a078d659959", "name": "Phishing | Feb 20, 2026 | Part 369/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 369/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-20T06:36:00.461000", "created": "2026-02-20T06:36:00.461000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1243, "domain": 500, "URL": 256 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "58 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6997d4484ab16fe538b80b22", "name": "UNC1069\u2019s Crypto Stealer", "description": "UNC1069, a financially motivated North Korea-linked threat actor, conducted a targeted intrusion against a financial technology (FinTech) entity in the cryptocurrency sector. The attack leveraged a compromised Telegram account, a spoofed Zoom meeting featuring AI-generated deepfake video, and a ClickFix infection vector to trick the victim into executing malicious commands. The intrusion resulted in the deployment of seven distinct malware families designed to harvest credentials, browser data, messaging content, and session tokens, facilitating cryptocurrency theft.", "modified": "2026-02-20T03:25:57.048000", "created": "2026-02-20T03:25:57.048000", "tags": [ "MAC" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "sharkstriker_soc", "id": "139120", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 7, "URL": 2, "domain": 7, "hostname": 1 }, "indicator_count": 21, "is_author": false, "is_subscribing": null, "subscriber_count": 36, "modified_text": "58 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69976ea57e7f183ba1e0ebf4", "name": "Phishing | Feb 20, 2026 | Part 369/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 369/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T20:12:21.344000", "created": "2026-02-19T20:12:21.344000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1243, "domain": 500, "URL": 256 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "59 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69972fad74322b4d94d192c4", "name": "Phishing | Feb 20, 2026 | Part 369/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 369/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T15:43:41.726000", "created": "2026-02-19T15:43:41.726000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1243, "domain": 500, "URL": 256 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "59 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69971055ec2a8dbd78dee254", "name": "Phishing | Feb 19, 2026 | Part 369/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 369/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T13:29:57.990000", "created": "2026-02-19T13:29:57.990000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1244, "domain": 500, "URL": 255 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "59 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69963a186a0f6f5d0aed02f7", "name": "Phishing | Feb 19, 2026 | Part 369/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 369/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T22:15:52.517000", "created": "2026-02-18T22:15:52.517000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1244, "domain": 500, "URL": 255 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "59 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69957ac898342c406d21fb37", "name": "Phishing | Feb 18, 2026 | Part 369/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 369/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T08:39:36.524000", "created": "2026-02-18T08:39:36.524000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1246, "domain": 500, "URL": 253 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "60 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69949f42251ae544d5fa0041", "name": "Phishing | Feb 18, 2026 | Part 369/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 369/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-17T17:02:58.595000", "created": "2026-02-17T17:02:58.595000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1246, "domain": 500, "URL": 253 }, "indicator_count": 1999, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "61 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69929d458d3af24bea13c8f5", "name": "Phishing | Feb 16, 2026 | Part 374/741", "description": "Phishing indicators. Date: Feb 16, 2026. Part 374/741. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-16T04:29:57.908000", "created": "2026-02-16T04:29:57.908000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1318, "domain": 682 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "62 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69915e2b1edc5120f252085e", "name": "Phishing | Feb 15, 2026 | Part 383/749", "description": "Phishing indicators. Date: Feb 15, 2026. Part 383/749. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-15T05:48:27.838000", "created": "2026-02-15T05:48:27.838000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 589, "hostname": 1358, "URL": 53 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "63 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69908fad5cf0de1c25a2aa33", "name": "Phishing | Feb 15, 2026 | Part 387/754", "description": "Phishing indicators. Date: Feb 15, 2026. Part 387/754. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-14T15:07:25.677000", "created": "2026-02-14T15:07:25.677000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 692, "hostname": 1308 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "64 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698c6245f730b1c1a9457b98", "name": "Phishing | Feb 11, 2026 | Part 416/783", "description": "Phishing indicators. Date: Feb 11, 2026. Part 416/783. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-11T11:04:37.167000", "created": "2026-02-11T11:04:37.167000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1359, "domain": 641 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "67 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698c44a388152d591aadcdb3", "name": "IOC - UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering", "description": "", "modified": "2026-02-11T08:58:11.008000", "created": "2026-02-11T08:58:11.008000", "tags": [ "macos", "deepbreath", "chromepush", "hypercall", "silencelift", "waveshaper", "north korea", "sugarloader", "hiddencall", "social engineering", "cryptocurrency", "malware", "ai", "web3" ], "references": [ "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering" ], "public": 1, "adversary": "UNC1069", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1132.001", "name": "Standard Encoding", "display_name": "T1132.001 - Standard Encoding" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1055.001", "name": "Dynamic-link Library Injection", "display_name": "T1055.001 - Dynamic-link Library Injection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [ "Finance", "Technology" ], "TLP": "white", "cloned_from": "698a3590b78fb5ef2d81d5f1", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "celestre", "id": "295357", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 8, "FileHash-SHA256": 7, "FileHash-SHA1": 8, "domain": 7, "hostname": 1, "YARA": 8 }, "indicator_count": 39, "is_author": false, "is_subscribing": null, "subscriber_count": 121, "modified_text": "67 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698b41a7d33a592a8c5bef36", "name": "UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering | Google Cloud Blog", "description": "", "modified": "2026-02-10T14:33:11.090000", "created": "2026-02-10T14:33:11.090000", "tags": [ "deepbreath", "chromepush", "google chrome", "tcc database", "brave", "sugarloader", "urls", "deepbreath a", "transparency", "consent", "swift", "desktop", "telegram" ], "references": [ "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4, "FileHash-SHA1": 1, "FileHash-SHA256": 8, "URL": 4, "YARA": 8, "domain": 12, "hostname": 1 }, "indicator_count": 38, "is_author": false, "is_subscribing": null, "subscriber_count": 845, "modified_text": "68 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698ab643ee69cb28db6690b8", "name": "Cryptocurrency Sector Targeted with New Tooling and AI-Enabled Social Engineering", "description": "", "modified": "2026-02-10T04:38:27.860000", "created": "2026-02-10T04:38:27.860000", "tags": [ "macos", "deepbreath", "chromepush", "hypercall", "silencelift", "waveshaper", "north korea", "sugarloader", "hiddencall", "social engineering", "cryptocurrency", "malware", "ai", "web3" ], "references": [ "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering" ], "public": 1, "adversary": "UNC1069", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1132.001", "name": "Standard Encoding", "display_name": "T1132.001 - Standard Encoding" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1055.001", "name": "Dynamic-link Library Injection", "display_name": "T1055.001 - Dynamic-link Library Injection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [ "Finance", "Technology" ], "TLP": "white", "cloned_from": "698a3590b78fb5ef2d81d5f1", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 8, "FileHash-SHA256": 7, "FileHash-SHA1": 8, "domain": 7, "hostname": 1, "YARA": 8 }, "indicator_count": 39, "is_author": false, "is_subscribing": null, "subscriber_count": 263, "modified_text": "68 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6981abcf34512767003ef137", "name": "Phishing | 2026-01-31 | Part 98/163", "description": "Phishing indicators. Date: 2026-01-31. Part 98/163. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-03T08:03:27.942000", "created": "2026-02-03T08:03:27.942000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 6366, "domain": 3313, "URL": 319 }, "indicator_count": 9998, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "75 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://moonlock.com/fake-vcs-target-crypto-talent-clickfix-campaign", "https://ltna.com.au/cyber", "IOCs.2026.csv", "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering/", "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering", "IOCs.2026.3.csv" ], "related": { "alienvault": { "adversary": [ "UNC1069" ], "malware_families": [], "industries": [ "Technology", "Finance" ] }, "other": { "adversary": [ "ClipXDaemon, TENGU RANSOMWARE, A0Backdoor, GlassWorm, Operation CamelClone, VOID#GEIST", "UNC1069", "Contagious Interview Campaign, Triton fork campaign, CRESCENTHARVEST, MIMICRAT, Operation Olalampo" ], "malware_families": [ "Clickfix" ], "industries": [ "Cryptocurrency", "Technology", "Finance" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 36, "pulses": [ { "id": "698a3590b78fb5ef2d81d5f1", "name": "UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering", "description": "North Korean threat actor UNC1069 has evolved its tactics to target the cryptocurrency and decentralized finance sectors. In a recent intrusion, they deployed seven unique malware families, including new tools SILENCELIFT, DEEPBREATH, and CHROMEPUSH, designed to capture host and victim data. The attack utilized social engineering involving a compromised Telegram account, fake Zoom meeting, and reported AI-generated video. UNC1069 has shifted from spear-phishing to targeting Web3 industry entities like centralized exchanges, software developers, and venture capital firms. The intrusion demonstrated sophisticated techniques to bypass macOS security features and harvest credentials, browser data, and cryptocurrency information. This marks a significant expansion in UNC1069's capabilities and highlights their focus on financial theft and fueling future social engineering campaigns.", "modified": "2026-02-12T14:41:53.254000", "created": "2026-02-09T19:29:20.975000", "tags": [ "macos", "deepbreath", "chromepush", "hypercall", "silencelift", "waveshaper", "north korea", "sugarloader", "hiddencall", "social engineering", "cryptocurrency", "malware", "ai", "web3" ], "references": [ "https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering" ], "public": 1, "adversary": "UNC1069", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1132.001", "name": "Standard Encoding", "display_name": "T1132.001 - Standard Encoding" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1055.001", "name": "Dynamic-link Library Injection", "display_name": "T1055.001 - Dynamic-link Library Injection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [ "Finance", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 8, "FileHash-SHA256": 7, "FileHash-SHA1": 8, "domain": 7, "hostname": 1, "YARA": 8 }, "indicator_count": 39, "is_author": false, "is_subscribing": null, "subscriber_count": 377565, "modified_text": "66 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bbba3ed3b01bcf222ccc1d", "name": "EbeeMar2026 Pt3", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-04-18T08:06:12.483000", "created": "2026-03-19T08:56:30.058000", "tags": [ "filehashsha256", "filehashmd5", "filehashsha1", "yara" ], "references": [ "IOCs.2026.3.csv" ], "public": 1, "adversary": "ClipXDaemon, TENGU RANSOMWARE, A0Backdoor, GlassWorm, Operation CamelClone, VOID#GEIST", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 97, "URL": 96, "CVE": 3, "FileHash-MD5": 93, "FileHash-SHA1": 101, "FileHash-SHA256": 153, "domain": 156, "email": 9 }, "indicator_count": 708, "is_author": false, "is_subscribing": null, "subscriber_count": 37, "modified_text": "1 day ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a046863c1c92107079f81b", "name": "EbeeFeb2026 Pt5", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-03-31T06:00:59.128000", "created": "2026-02-26T13:11:34.763000", "tags": [ "filehashsha1", "filehashsha256", "filehashmd5" ], "references": [ "IOCs.2026.csv" ], "public": 1, "adversary": "Contagious Interview Campaign, Triton fork campaign, CRESCENTHARVEST, MIMICRAT, Operation Olalampo", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 78, "FileHash-MD5": 191, "FileHash-SHA1": 220, "FileHash-SHA256": 192, "CVE": 2, "URL": 58, "domain": 220 }, "indicator_count": 961, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "19 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699c294fa357642ede4fd71a", "name": "Ninja Browser & Lumma Infostealer", "description": "\"Nai-browser\" or \"ninja- browser\", as it is now known, is a \"nad-nodelink\" and \"apicl.xyz\".", "modified": "2026-03-25T10:03:31.959000", "created": "2026-02-23T10:17:51.748000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "sharkstriker_soc", "id": "139120", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 16, "FileHash-SHA1": 14, "FileHash-SHA256": 18, "domain": 17, "hostname": 13, "URL": 2 }, "indicator_count": 80, "is_author": false, "is_subscribing": null, "subscriber_count": 37, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b03486131dc4cd33f0f3c3", "name": "Phishing | Mar 11, 2026 | Part 409/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 409/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T15:11:02.143000", "created": "2026-03-10T15:11:02.143000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1309, "domain": 691 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "40 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69af738e9a1d05c81a99263b", "name": "IOC - Fake VCs target crypto talent in a new ClickFix campaign", "description": "In a new investigation, Moonlock Lab has been tracking a malware campaign targeting cryptocurrency and Web3 professionals. The threat actors operate through fabricated venture capital identities, engage victims on LinkedIn with tailored job or partnership offers, and funnel them toward spoofed video conferencing links\u2014fake Zoom and Google Meet pages\u2014that serve as the delivery mechanisms for malicious payloads.", "modified": "2026-03-10T01:27:42.174000", "created": "2026-03-10T01:27:42.174000", "tags": [ "domain", "fake zoom", "mandiant", "sugarloader c2", "hypercall c2", "type value", "context domain", "megabit", "fake google", "meet page", "macho" ], "references": [ "https://moonlock.com/fake-vcs-target-crypto-talent-clickfix-campaign" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "celestre", "id": "295357", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 3, "domain": 9, "hostname": 5 }, "indicator_count": 17, "is_author": false, "is_subscribing": null, "subscriber_count": 119, "modified_text": "40 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aee0bce17d4f1abdf62780", "name": "Phishing | Mar 10, 2026 | Part 359/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 359/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T15:01:16.239000", "created": "2026-03-09T15:01:16.239000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 638, "hostname": 1362 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "41 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad8d7c6486d6b999dc12f4", "name": "Phishing | Mar 9, 2026 | Part 360/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 360/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:53:48.631000", "created": "2026-03-08T14:53:48.631000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 555, "hostname": 1337, "URL": 108 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "42 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac3c9dd592e576413e70dc", "name": "Phishing | Mar 8, 2026 | Part 360/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 360/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:56:29.776000", "created": "2026-03-07T14:56:29.776000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 555, "hostname": 1337, "URL": 108 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "43 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aaeabeefb4c226e9e04ac4", "name": "Phishing | Mar 7, 2026 | Part 360/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 360/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:54:54.770000", "created": "2026-03-06T14:54:54.770000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1338, "domain": 555, "URL": 107 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "44 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "zmsupport.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "zmsupport.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1776636227.1378393 }